As we learned in section one, people can be the weakest link when it comes to cyber attacks. Most people use the internet these days, whether it's for work or for personal use. But being online opens us up to being exploited as people. In this module, we'll review how we use the internet and social media, and what risks this carries. At the end of this module, you should be able to understand core web technologies, identify how browsers and web servers communicate, describe metadata, and describe scripting languages. Many people think of the internet and the World Wide Web as being the same thing, but they're not.

The internet is a global network of computer networks that are all connected together, the World Wide Web is just one of the many types of resources that we can access via the internet. The internet grew from the 1970s, and it was built on a network that was originally created for the US Department of Defence. The World Wide Web was invented by Sir Tim Berners-Lee around 1989. And he came up with three technologies which make up the foundation of the World Wide Web, the Hypertext Markup Language, universal resource locators, and the Hypertext Transfer Protocol. The World Wide Web was originally designed to be a system that interconnected basic text documents with hyperlinks. And if you ever wondered what that might look like, the world's first ever web page has been kept for people to see. But the World Wide Web's come a long way since it was first invented, and even today it's changing and getting better all of the time. Hypertext Markup Language or HTML is the code that's used to describe what a web page looks like. When we view a web page in a web browser, such as Google Chrome, the web server sends a file which contains the HTML. The HTML code tells the web browser what the page looks like and includes the text and references to other content, such as pictures and videos, which the web server also sends to the browser.

You might have seen HTML code or even written some code yourself already. But have you ever right-clicked on a web page in your browser and selected ‘view page source’? If you do this, you can see the HTML code. Now HTML uses tags to describe the document and the content and how it should look. But not all of the text in an HTML file will be displayed in the web browser. Some of the text will be added as metadata. Metadata means data about data, and it's used to provide information about the code that makes up the web page. The metadata that comes with a web page can be used to tell the web browser how to display the page or it might contain information that's used by search engines to help categorise the page, or even improve the chances of it being found in a search. Metadata can also contain information about the web page, such as its author and their email address, and in some rare cases even sensitive information, such as usernames and passwords. Remember although we don't see the metadata when we view the web page normally, it can be seen if you view the page source. HTML is a language that defines static content and it was designed with documents in mind.

But most web pages we visit these days will be full of interactive content, such as animations, forms, and other code with customises the page in some way. Scripting languages are programming languages that developers use to add dynamic content to the web pages. And there are lots of scripting languages that can be used. When web developers use scripting languages, they can create client-side or service-side scripts. A client-side script is the code that runs on the client device when the web page loads in the browser. A server-side script runs on the web server and it'll generate content which is then sent to the browser as static content. There are advantages and disadvantages to each type. When it comes to security, client-side scripts can be dangerous, as the code needs to be sent to the computer where the browser wants.

And this means that malicious code could run on a device which accesses sensitive data, or it could be used to deliver malware. Of course, another important component we use when we view web pages is our web browser. A web browser is the client application that receives the content from the web server and displays it. And there are many web browsers available. Do you have a favourite? Web browser software is made up of a number of components, including the rendering engine. The rendering engine is the software that decodes the HTML code and scripts to work out how the page is displayed. The common rendering engine is chroming, which is used by Google Chrome, Microsoft Edge, Opera, and many other browsers. So, even though people use different browsers, underneath they actually share a lot in common. It's still possible, though, that two different browsers might display web pages slightly differently. Now, this is caused by a number of things, including the options and the add-ons, as well as the device that the browser's running on. For example, web pages will usually have a mobile-friendly version and a desktop version. Add-ons are extra software programmes that extend the capabilities of the browser, and support advanced web page functions. But they add another aspect of security. We need to consider where the add-ons have come from, what they do, and whether they've been securely coded. It's a good idea to learn about what your browser does and how it's set up, this will help you to keep it working safely, and it might help reduce the risk of getting malware or leaking personal information onto the internet. A cookie is a small text file that's downloaded onto your computer when you visit a website. Cookies are used by websites to remember your preferences, and they can also be used for other things, such as keeping track of the shopping basket or tracking your browsing habits.

These days, organisations have to provide information about the way they use cookies and ensure that they give you a choice to reject any cookies that are not strictly necessary for their website. Usually, when you access a web page for the first time, you'll be presented with the cookie policy and given some choices about which cookies you allow or disallow. So, remember cookies are small pieces of texts, they're not computer programmes, and they can't run code. Cookies can't access your data on your device or give you viruses. However, cookies can still present risks to our security and our privacy. For example, if a web page is not properly secured, a cookie could be stolen and, in some cases, used to impersonate another user. But the real issue tends to be around privacy.

If a web server uses a cookie to track down visits, the owner of that site could then share that information, say, with an advertising company. Sites that we visit might include content that's retrieved from other web servers, such as images, videos, or adverts. So, in these cases, we view a page from one web server and we end up getting cookies from others. The other sites might then use those cookies to track us on the web. Strictly necessary cookies are essential for websites to provides simple functions, such as being able to sign in. Cookies that come from other web servers are called third-party cookies. Session cookies are only stored on your computer while you visit the site, and they get deleted when you leave it. A persistent cookie will stay on your computer so it can be reused every time you visit the site. Zombie cookies are a type of third-party cookie. They have the capability to reappear after they've been deleted from your computer. And likewise, super cookies are cookies that are designed to stay on your computer permanently. Secure cookies are cookies that will only be used if the connection is using HTTPS.

And HTTP-Only cookies are ones which can't be read by JavaScript. So, it's a good idea to understand cookies and also know how to manage them in your browser. As well as cookies, tracking pixels are another technique used in things like marketing and advertising campaigns. Tracking pixels are tiny image files that can be inserted into web pages and emails. They only display a single pixel, which can't be seen. While tracking pixels were designed to be used for good things, yet another tool that can be abused by attacks. When sending out phishing emails, tracking pixels can be used by the attacker to confirm that an email address is valid and that someone has opened the email. They might also be able to establish IP addresses and geo-locate people from information that's sent back to them when the tracking pixel's accessed.

Now, everyone who uses the internet has a digital footprint. Your digital footprint is all of the information that exists about you on the internet, and this comes from activities like posting on social media, using search engines, playing games, watching videos, and many other sources. And sometimes people don't really think enough about what they're posting. And this can be dangerous both to individuals and employees. Not everyone on the internet is who they say they are. And criminals will often use social media and other internet sources to gather information about employees to build up intelligence, which they'll then go on to use to carry out cyber attacks. For individuals and employees, the slide gives some good advice about using social media. Think carefully about what you post about yourself, and be aware of what other people are posting about you. Make sure that your privacy and security settings are set correctly. Never allow profiles to be public, and never share sensitive information in posts. And avoid posting personal sensitive information, such as phone numbers, addresses, and holidays.

Now, many organisations have got policies and guidance for their employees, and this helps them to use social media safely. Remember that searching the internet for information is known as open-source intelligence. And this is done by security professionals and also by criminals when they're researching their target. Most people who use search engines like Google will just simply type in what they're looking for, but this can turn up millions of results that can take ages to plough through. Search engines will ignore certain words that aren't considered relevant and these are called stop words. But they also support logic operators and filters, which can help narrow search results down to make them more relevant. So, simply tricks in Google can make a big difference to what results come back, and some knowledge of the advanced search syntax can be very helpful.

When we use the usual Google search, we can enter logical operators and apply other search rules. As an example, if we wanted to search for CyberFirst courses, we could put the word ‘CyberFirst’ and ‘courses’ in quotes to tell Google we want to search for the whole phrase. If you wanna get started with advanced searches in Google-, and the easiest way to do this is to use the advanced search page. And of course if you need to find this page, just Google it. Today, artificial intelligence is everywhere. It's used for facial recognition, speech recognition, spam filtering, grammar suggestions, and language translation. Artificial intelligence is technology that enables computers and machines to simulate human intelligence and problem-solving capabilities. So, where machines have the ability to learn and make decisions like people. So, have you heard of ChatGPT? It's an example of a large language model, or an LLM. An LLM is where an algorithm has been trained on a large amount of text-based data. That's typically scraped from the open internet, and so covers web pages.

And depending on the LLM, other sources, such as scientific research, books, or even social media posts-. There are a number of common LLM tools, which are also called Generative AI. Microsoft Co-pilot and Google Gemini are also popular examples. Some generative AI tools can create unique music and videos. When using LLMs, we need to understand that currently, they don't have the intelligence of human beings. Their responses are limited by the information that they learn from and the way they're trained with algorithms. They can get things wrong and present incorrect facts. They can be fed with information that causes them to create toxic content and they are prone to injection attacks. Anyone that uses an LLM should avoid including sensitive information and queries, particularly to public LLMs. And what about deep-fakes? A deep-fake is an audio clip, a video, or a picture generated by AI to look real. Of course they can be used for fun, but sometimes they're used to impersonate people like politicians or company owners in order to deliberately mislead people. Think about how deep-fakes could be used by criminals to embarrass people or impersonate people to help them with crimes.

And how intelligent can AI get? Do you think ChatGPT could write malware? When sending out phishing emails or creating fake content, criminals will often include pictures of people or products to make the content look more convincing. Often criminals will use pictures of people that they just find online. A useful technique that can help you to spot phishing and online scams is reverse image searching. In a reverse image search, you can upload a picture to one of the imaging sites and your pictures compare to other images that have been found on the internet by search engines. So, reverse image search might show that the picture belongs to somebody else. Companies can use reverse image searching to hunt down people who are selling fake goods, using their original pictures.

And if you're thinking about buying something online from a marketplace, look to see if there are any other adverts that use the same image. Or try doing a reverse image search to see if the picture's unique. Of course reverse image search that doesn't turn up any results doesn't prove that the picture's genuine. But if not, it might help. If you're posting images online, also be aware that cameras and phones will store metadata about the picture and the picture file. The metadata will typically include date and time, location coordinates, and information about the camera settings. And the standard for this is known as EXIF.

Many websites and social media apps will strip the EXIF data off, although they might actually keep it for their own use. But be careful. If you post an image which contains the EXIF data and it's not stripped off, someone can see where the picture was taken, the type of camera used, the time and date, and even whether the flash was used. Company employees who create content for public websites or who post company promotions on the internet could be unwittingly be given information away that could be used by criminals. So, it's a good idea to make sure that all EXIF data is removed from images before they're used in emails or on websites. Windows and Mac OS allows the EXIF data to be removed from files using the file management tools. Our phones and many apps are also tracking where we are using GPS. If you've got an Apple account or a Google account signed in on your phone, it'll track your location. And this information is combined with your search history, your browsing habits, and social media activity to personalise adverts and content that you see. So, do you sometimes get adverts and posts on social media which are linked to your location when you've been travelling? But if anyone else can get access to this information they'll know exactly where you've been.

If company employees use social media, some platforms will include location information with public posts. And this could be used to locate and track the movements of employees. Think about the search engine used to find stuff on the World Wide Web. Search engines work by using web crawlers which are programmes that automatically connect to web pages and gather information about the content. The information found by crawlers is then added to a huge index. So, when we search something like Google, we're actually looking at their index. There are billions of web pages out on the World Wide Web, so would you be surprised to know that we can only find about 5% of the content using Google, which has got the biggest index? And this is because not all web pages are indexed, either because they've got restricted access, or the owners just haven't asked them to be included in the searches. And also the crawlers, they'll only discover certain types of content. So, think about how much we can find these days just by searching, and then imagine how much other stuff's out there. And it's not necessarily that it's hidden, it's just not indexed. But if we know where to look, we'll still be able to find it.

The content on the web that isn't indexed is called the deep web. And this can include all sorts of things that could be useful to us. But of course it could also be used by criminals. So, if you're looking for something in particular, rather than just relying on a search engine, have a think about what other ways you might be able to find what you're looking for. There are lots of specialist websites that store particular types of content or can provide links to it. Attackers will also use this to their advantage when they're doing reconnaissance. For example, a simple search on the Companies House website will give them a list of directors of the company.

We've talked a lot about phishing attacks already, and that's because they're the most common method that attackers use to get users' log-in details and deliver malware. And as you can see in the slide, hundreds of brands have been targeted every week. Phishing emails can lead to damage, but they can also affect the reputation of organisations who are being impersonated in the emails. Here are some useful tips that can help us to spot phishing. Although phishing emails are becoming more convincing these days, there are usually some telltale signs. Organisations, they'll have training programmes for employees which teach them about how to spot these telltale signs.

The first and most important thing to do is to look at where the email came from. Criminals will try to impersonate real people and companies but the email address they send from can give away an important clue. Many email apps don't usually show the full email address, but if you just hover your mouse, or hold and click on the sender on a mobile, you'll be able to see where the email's coming from. Criminals create realistic-looking addresses that appear similar to real ones in the hopes that people just won't notice. And often the receiver address is blank, and emails won't be personalised. They'll use urgent wording to try and instil panic and try and get people to respond quickly without thinking. And often fake emails contain spelling or grammar mistake. If there's a link in a phishing email, it's likely to point to something harmful. Again, if you hover your mouse over a link, or tap and hold on a mobile, you can see where the link goes without visiting it. It's really important that people can do their best to spot phishing, and they should never reply or click on the links. In an organisation, employees should report any suspicious messages to their security teams. We're gonna finish off this section with a lab session.

The labs demonstrate how open-source information can be used to gathered intelligence about an individual. You can use the tools and techniques you've learned about to complete the labs. But please do your research on the lab computer. In lab eight we've given you an image, and your job is to get some information from the image and answer some questions. And as a hint, you can right-click on the image to get some details. In lab nine, we'd like you to use your open-source intelligence skills to research a company director and gather some information. Please ensure that you only use public information and don't contact anyone that you find in your searches.

Module 4: Using the Internet

About