Chapter 7 — Internet Security And Web Services

What is Internet Security?

Internet security is the practice of protecting users, devices, networks and data when they are connected to the Internet. The main goals are:

• Confidentiality – ensure only authorized people can read the data.
• Integrity – ensure data is not changed or tampered with.
• Availability – ensure services and data are available when needed.

Common security principles and features:

• Authentication – proving identity (passwords, OTPs, biometrics).
• Authorization – granting permission to access resources (roles, access control).
• Encryption – converting data so only intended recipients can read it (TLS/SSL for websites).
• Non-repudiation – preventing users from denying actions (digital signatures).

Major threats on the Internet

• Malware (viruses, worms, ransomware)
• Phishing (fraudulent emails or websites to steal credentials)
• Man-in-the-Middle (attacker intercepts communication)
• Denial-of-Service (DoS/DDoS) attacks that make services unavailable
• Injection attacks (e.g., SQL injection) and other web vulnerabilities

Basic protections everyone should use

• Use strong, unique passwords and change them periodically; enable two-factor authentication (2FA) where possible.
• Keep software and operating systems updated to patch security holes.
• Use HTTPS when visiting websites and check for the padlock icon.
• Install reputable antivirus and use a firewall.
• Be careful with email links and attachments; verify senders before sharing sensitive information.
• Back up important data regularly.

What are Web Services?

A web service is a way for two devices or programs to communicate over the Internet. Web services allow applications to share data and functionality. Two common styles are:

• SOAP — a protocol that uses XML messages and a strict standard for communication.
• REST — a simpler style that commonly uses HTTP methods (GET, POST, PUT, DELETE) and data formats like JSON or XML.

Key terms:

• Endpoint – the URL where a web service can be accessed.
• Request – the message a client sends to the web service.
• Response – the message the web service returns.
• API key / Token – credentials used to authenticate API requests.

Security for Web Services

• Always use HTTPS to encrypt data in transit.
• Authenticate users and applications (API keys, OAuth tokens).
• Validate and sanitize all inputs to prevent injections.
• Use rate limiting to prevent abuse (throttling excessive requests).
• Log and monitor access; apply least privilege for access control.

How web services work (simple flow)

1. Client sends an HTTP request to the web service endpoint (e.g., GET /weather?city=Delhi).
2. Server processes the request (may query a database or another service).
3. Server sends back an HTTP response with status (200 OK, 404 Not Found, etc.) and data (JSON/XML).

This chapter helps students understand how to use the internet safely and how web services allow programs and websites to share information securely.

What are threats and vulnerabilities?

A threat is any potential event or action that can cause harm to computer systems, data, or users (for example, malware or phishing). A vulnerability is a weakness in a system, network, software, or human behavior that a threat can exploit (for example, an unpatched operating system or weak passwords).

Difference (short): Threat = actor or event that can do harm. Vulnerability = weakness that allows harm.

Common types of threats and vulnerabilities

• Malware — software created to harm or exploit devices: viruses (attach to files), worms (self-replicating across networks), trojans (malicious program disguised as useful). Prevention: antivirus, keep software updated, avoid unknown downloads.
• Ransomware — encrypts files and demands payment for the key. Backups and patching reduce risk.
• Phishing — fraudulent emails/messages that trick users into giving credentials or clicking malicious links. Prevention: verify sender, don’t click suspicious links, use email filters.
• Social engineering — manipulation of people to reveal confidential information (eg. pretexting, baiting). Training and policies help reduce this risk.
• Man-in-the-Middle (MitM) — attacker intercepts communication between two parties (common on unsecured Wi‑Fi). Use HTTPS, VPNs, and secure Wi‑Fi to prevent.
• DoS / DDoS (Denial of Service) — flooding a service with traffic so legitimate users cannot access it. Mitigation by traffic filtering and scalable resources.
• SQL Injection — attacker sends malicious database commands via input fields to read/modify data. Prevent by input validation and using parameterized queries (prepared statements).
• Cross-Site Scripting (XSS) — injecting malicious scripts into web pages viewed by others. Prevent by encoding output and input sanitization.
• Weak or Reused Passwords — easy to guess or reused across sites; lead to account takeover. Use long, unique passwords and two-factor authentication (2FA).
• Unpatched/Outdated Software — known bugs provide exploits. Keep systems and apps updated with security patches.
• Insider Threats — employees or users with legitimate access misuse data intentionally or accidentally. Principle of least privilege and monitoring help reduce risk.

How attacks typically work (general steps)

• Reconnaissance: attacker gathers information about the target.
• Delivery/Exploitation: attacker exploits a vulnerability (e.g., sends phishing email, injects SQL).
• Execution: malware runs, credentials are stolen, or data is altered.
• Persistence & Impact: attacker retains access, disrupts services, or exfiltrates data.

Impacts: data loss, financial loss, privacy breach, reputational damage, service downtime.

Basic prevention and good practices

• Keep OS and applications updated; install security patches.
• Use antivirus/antimalware and keep definitions current.
• Create strong, unique passwords and enable 2FA where possible.
• Be cautious about email links and attachments; verify senders.
• Back up important data regularly and test restores.
• Use secure network settings (WPA2/WPA3 for Wi‑Fi), avoid public Wi‑Fi for sensitive tasks or use a VPN.
• Validate and sanitize user inputs in web applications; use prepared statements for database access.
• Apply the principle of least privilege and monitor user activity.
• Educate users with security awareness training (recognize phishing/social engineering).

Classroom tip: Encourage students to imagine a real scenario (e.g., clicking a suspicious message) and follow a checklist: identify, do not open, report, change passwords if needed, run malware scan.

What is Malware?
Malware (malicious software) is any program or file designed to harm, infiltrate, or exploit computer systems, networks, or users. It may steal data, damage files, encrypt information for ransom, or turn devices into bots.

Common Types of Malware

• Virus: Attaches to files or programs and spreads when infected files are executed. Needs user action to propagate.
• Worm: Self-replicates across networks without user action. Can spread rapidly and consume bandwidth.
• Trojan Horse: Masquerades as legitimate software but contains hidden malicious functionality (backdoors, data theft).
• Ransomware: Encrypts files or systems and demands payment for decryption keys.
• Spyware: Secretly monitors user activity and harvests sensitive information (credentials, browsing habits).
• Adware: Automatically displays or downloads advertising material; may be intrusive and privacy-invasive.
• Rootkit: Hides the presence of other malware by modifying the operating system, giving attackers stealthy control.
• Botnet: A network of compromised devices (bots) controlled by an attacker (C2 server) for tasks like DDoS or spam.
• Keylogger: Records keystrokes to capture passwords and confidential input.

Typical Malware Behaviors

• Replication: Copying itself to other files, systems, or removable media.
• Propagation: Using email attachments, malicious links, network vulnerabilities, or infected USB drives to spread.
• Payload Delivery: Executing the harmful action — data theft, encryption, deletion, or making the system part of a botnet.
• Persistence: Installing components (services, scheduled tasks, registry entries) to survive reboots and evade removal.
• Stealth and Evasion: Using obfuscation, encryption, rootkits, or polymorphism (changing code) to avoid detection.
• Command and Control (C2): Communicating with attacker servers to receive instructions or exfiltrate data.

Malware Lifecycle (stages)

1. Initial Access (phishing, exploit, drive-by download)
2. Execution (malicious code runs)
3. Persistence and Privilege Escalation (establish control and gain higher rights)
4. Discovery and Lateral Movement (scan network, compromise other hosts)
5. Action on Objectives (data theft, encryption, DDoS)
6. Covering Tracks (log clearing, disabling security tools)

Prevention and Detection

• Keep systems and software updated (patch vulnerabilities).
• Use reputable antivirus/endpoint protection and enable firewalls.
• Back up important data offline and test restore procedures.
• Use strong, unique passwords and multi-factor authentication.
• Educate users to recognise phishing and suspicious downloads.
• Apply principle of least privilege — users and apps get only needed rights.
• Monitor logs and network traffic for anomalies and implement intrusion detection.

Key Concepts to Remember: Malware spreads by vectors (email, web, removable media, network vulnerabilities), can be standalone (worm) or hidden in legitimate software (Trojan), and defense requires layered security: people, processes, and technology.

What are Email and Web-based Threats?

Email and web-based threats are malicious activities that use email messages or websites to steal information, spread harmful software, or trick users into doing something that harms them or their organization.

Common types of email threats

• Phishing: Fraudulent emails that pretend to be from a trusted source (bank, school, social site) asking you to click a link or enter personal details.
• Spear phishing: Targeted phishing aimed at a specific person or organization using personal information to increase believability.
• Email spoofing: The sender address is forged so the email looks like it comes from someone you know.
• Spam: Unwanted bulk email, often advertising but sometimes carrying links or attachments that are harmful.
• Malicious attachments: Files (e.g., .exe, .docm, .js) sent by email that install malware when opened.
• Business Email Compromise (BEC): Fraudulent emails that trick employees into transferring money or sensitive data to attackers.

Common types of web-based threats

• Malicious websites: Sites designed to steal information or automatically install malware (drive-by downloads).
• Drive-by downloads: Software that installs without the user’s clear consent when visiting a compromised site.
• Pharming: Redirecting users from legitimate sites to fake ones to steal credentials.
• Adware and pop-up scams: Fake alerts or pop-ups that ask you to download software or call a number.
• XSS and other web exploits: Attacks that inject malicious code into websites to attack visitors (conceptual level for Class 9).

How these threats work (simple flow)

• Attacker crafts a message or page that looks trustworthy.
• User receives an email or visits a website and sees a convincing message, link, or attachment.
• User clicks the link or opens the attachment and either gives away credentials, downloads malware, or performs an action (e.g., money transfer).
• Attacker uses stolen information or malware to steal data, money, or take control of devices.

Signs of a threat

• Unexpected emails from known contacts with odd language or requests.
• Generic greetings like “Dear customer” when an organization usually uses your name.
• Links that show a different web address when you hover over them.
• Attachments you did not expect, or files with unusual extensions.
• Urgent requests for money, passwords, or personal details.

How to protect yourself (basic rules)

• Do not click suspicious links or open unexpected attachments.
• Verify requests by contacting the sender using a known phone number or address (not by replying to the suspicious email).
• Use strong, unique passwords and enable two-factor authentication (2FA).
• Keep your browser, operating system, and antivirus programs updated.
• Look for HTTPS (padlock) on sites where you enter personal information, and check the URL carefully.
• Use spam filters and be cautious on public Wi-Fi.
• Report phishing or suspicious emails to your teacher, parents, or service provider.

Why this matters for students

Many threats target students (fake scholarship offers, exam result scams, or shareable links). Learning to recognize these threats protects your identity, school accounts, and family finances.

Overview

Protection measures and best practices are the set of technical controls, behaviours and policies used to keep systems, data and users safe on the Internet and when using web services. They reduce the chance of successful attacks (like phishing, malware, unauthorised access) and limit damage if an attack occurs.

Core protection measures

• Authentication: Use strong passwords/passphrases, unique credentials and multi-factor authentication (MFA). Apply the principle of least privilege so accounts have only the access they need.
• Encryption: Protect data in transit using TLS/HTTPS and protect sensitive data at rest using strong encryption. Use trusted certificates for websites and services.
• Software updates & patching: Keep operating systems, browsers, apps and firmware updated to fix known vulnerabilities.
• Firewalls & antivirus/anti-malware: Deploy endpoint protection and network firewalls or filtering to block malicious traffic and detect threats.
• Backups & recovery: Maintain regular backups (offline or offsite copies) and test restores. Follow the 3-2-1 backup strategy: 3 copies, on 2 different media, 1 offsite.
• Secure network practices: Use secure Wi‑Fi (WPA3/WPA2), change default router passwords, disable open/unused services, and prefer VPNs on public networks.
• Email and web hygiene: Avoid clicking unknown links or attachments, verify sender addresses, and use email filtering and spam/phishing protection.
• Access control & monitoring: Log and monitor activity, remove inactive user accounts, and implement role-based access.
• Physical security: Lock devices, encrypt laptop drives, and restrict physical access to servers and network equipment.
• User education: Train users on recognising phishing, safe browsing, social engineering and reporting incidents promptly.

Best practices checklist

• Use long passphrases (12+ characters) and a password manager to store unique passwords.
• Enable MFA (2FA) for email, cloud and important services.
• Always check for HTTPS and valid certificates before entering credentials.
• Back up important data regularly and verify backups.
• Install security updates automatically where safe to do so.
• Limit administrative privileges and use separate accounts for admin tasks.
• Disable or uninstall unnecessary services and software.
• Keep a written or documented incident response plan and contact list.

Protection for web services

• Use API keys, tokens or OAuth for authentication; never send credentials in plain text.
• Validate and sanitise inputs to avoid injection attacks (SQL/XSS).
• Implement rate limiting and logging to detect abuse.
• Use CORS, proper headers and least-privilege service accounts for microservices.

Applying these measures together — technical controls, policies and user awareness — creates layered defence (defence in depth) that is far more effective than any single control.

What is HTTPS?
HTTPS means HTTP over TLS (historically SSL). It is the secure version of the web protocol used when you visit websites whose addresses start with https://. HTTPS runs on port 443 and protects data between your browser and the website.

Why do we need it? HTTPS provides three main security goals:

• Confidentiality – eavesdroppers cannot read the data (it is encrypted).
• Integrity – the data cannot be changed undetected in transit.
• Authentication – you can be confident you are talking to the real website (not an impostor).

SSL and TLS
SSL (Secure Sockets Layer) was an older protocol. TLS (Transport Layer Security) is the modern, safer successor. Common TLS versions are TLS 1.0, 1.1, 1.2 and 1.3 (TLS 1.2 and 1.3 are widely used today). TLS combines two kinds of cryptography:

• Asymmetric (public-key) cryptography – used for authentication and key exchange (examples: RSA, ECC). It uses a public key and a private key.
• Symmetric cryptography – used for fast bulk encryption of the session once a shared secret (session key) is established (examples: AES).

Certificates and Certificate Authorities (CAs)
A digital certificate links a website's identity to a public key. A certificate contains fields like the subject (website name), the public key, the issuer (the CA that signed it), validity dates, and a digital signature from the issuer. Browsers trust certificates that are signed (directly or indirectly) by trusted Certificate Authorities. This creates a chain of trust from a website certificate up to a trusted root CA.

How a TLS handshake works (simplified) – this is the process used to authenticate the server and establish a shared session key:

1. ClientHello: browser sends supported TLS versions, cipher suites, and a random nonce.
2. ServerHello: server picks TLS version and cipher, returns its nonce.
3. Server sends its certificate (and sometimes a server key exchange message).
4. Client verifies the certificate (checks signature, validity dates, and domain name). If valid, the client creates a pre-master secret and encrypts it with the server's public key (or performs an ephemeral key exchange like ECDHE).
5. Both sides compute the session keys from the pre-master secret and nonces using a key-derivation function.
6. Encrypted application data flows using symmetric encryption and message authentication codes (or AEAD algorithms) protecting confidentiality and integrity.

Certificate checks and revocation
A browser validates a certificate by checking the signature chain to a trusted root, ensuring the certificate is not expired, and confirming the hostname matches. Revoked certificates can be checked by CRL (Certificate Revocation List) or OCSP (Online Certificate Status Protocol).

Visual cues in browsers
When a site uses valid HTTPS you typically see a padlock icon and the address starts with https://. If a certificate is invalid, modern browsers warn the user and often block access.

What is Encryption? Encryption is the process of converting readable information (plaintext) into an unreadable form (ciphertext) so that only authorized parties can read it. The reverse process is called decryption. Encryption protects confidentiality of data.

Basic parts of encryption

• Plaintext: original readable message.
• Ciphertext: encrypted message sent or stored.
• Key: secret value used by the encryption algorithm.
• Encryption/Decryption algorithms: mathematical methods that transform data using keys.

Types of encryption

• Symmetric-key encryption: Same key is used to encrypt and decrypt. Fast and used for bulk data (examples: AES). Requires a secure way to share the key.
• Asymmetric-key (public-key) encryption: Uses a key pair: a public key (shared) and a private key (kept secret). Data encrypted with one key can be decrypted with the other. Common for secure key exchange and digital signatures (examples: RSA, ECC).

What is Authentication? Authentication is the process of verifying that someone (a user or a device) or something (a message) is who or what it claims to be. Authentication ensures the identity of parties and, together with encryption, contributes to secure communication.

Common authentication methods

• Passwords/PINs — something you know.
• One-Time Passwords (OTP) / SMS/Email codes — short-lived codes for second-factor verification.
• Biometrics — something you are (fingerprint, face).
• Digital signatures — cryptographic proof that a specific private key holder signed a message (provides authentication and non-repudiation).

Hashing and Integrity

A hash function converts data of any size into a fixed-size string (hash). If the message changes, the hash changes — this helps verify integrity. Examples of hash algorithms: SHA-256.

How these pieces work together

• Confidentiality: achieved with encryption (only holders of correct key can read ciphertext).
• Integrity: achieved with hashing (compare message hash to expected hash).
• Authentication: achieved with passwords, OTPs, certificates, or digital signatures.

Real-world protocol example — HTTPS

When you open a bank website (https://...), your browser and the bank perform a TLS/SSL handshake: the site presents a certificate (authentication of the website), keys are exchanged (often using asymmetric crypto), and then a symmetric session key is used for fast encrypted communication. This gives confidentiality, integrity and server authentication.

Simple example: Caesar cipher (classroom example)

A Caesar cipher shifts letters by a fixed number k: each letter P is replaced by C = (P + k) mod 26. This shows the basic idea of encryption and decryption but is not secure for real use.

Security goals

• Confidentiality — only authorized can read.
• Integrity — data not altered.
• Authentication — parties are who they claim to be.
• Non-repudiation — sender cannot deny sending (via digital signatures).

Note for students: At this level, focus on the ideas and use simple diagrams to show how messages become ciphertext and how keys and signatures are used. Real systems combine these methods to provide secure services (messaging apps, online banking, email protection).

What is Privacy?
Privacy means control over your personal information — who can see it, how it is used, and when it is deleted. On the internet, privacy concerns include who can access your name, email, location, browsing behaviour and other personal details.

What are Cookies?
Cookies are small text files that websites store on your device through your browser. They contain simple data such as a user ID, session token, or preferences. Cookies help websites remember you and your settings.

• Session cookies: temporary, deleted when you close the browser.
• Persistent cookies: stored for a longer time to remember preferences (eg, language).
• First-party cookies: set by the website you are visiting.
• Third-party cookies: set by other domains (often used for tracking and advertising).
• Secure and HttpOnly flags: Secure cookies are sent only over HTTPS; HttpOnly cookies are inaccessible to JavaScript (reduce theft risk).

Why cookies matter for privacy
Cookies can be harmless (remembering a language choice) or privacy-invading (cross-site tracking to build profiles for targeted ads). Many sites ask for consent to use cookies because collecting and reusing behavioural data affects user privacy.

Data protection
Data protection are practices and rules that keep personal data safe, ensure it is used fairly and only for permitted purposes. Key principles include:

• Consent: collecting data with user permission.
• Purpose limitation: use data only for stated purposes.
• Data minimization: collect only what is necessary.
• Storage limitation: keep data only as long as needed.
• Security: protect data from unauthorized access or loss (encryption, access controls).

User rights (simple)
Users should be able to know what data is held about them, correct it, request deletion and refuse tracking where laws apply.

How websites use cookies and protect data
Common uses: session management (logins), personalization (preferences), and analytics/advertising (tracking). Protection measures include encryption (HTTPS), limiting cookie lifetime, setting Secure and HttpOnly flags, asking for cookie consent, and implementing privacy policies.

Practical steps for students & parents
Use strong unique passwords, enable two-factor authentication, clear cookies periodically, configure browser privacy settings, avoid accepting unnecessary cookies, use HTTPS sites, and be cautious on public Wi-Fi. For apps, check permissions and privacy settings.

Class 9 level summary
Privacy = control over personal information. Cookies = small files used to remember data; some help usability, others track you. Data protection = rules and technical steps to keep personal data safe and used correctly.

Overview
Cyber Ethics, Safety and Legal Aspects teach students how to behave responsibly online, protect themselves and others from cyber harm, and understand the law that governs computer and internet use. The goal is safe, respectful and lawful use of digital resources.

Key Concepts

Cyber Ethics

• Principles of right and wrong behaviour on the internet: honesty, respect, responsibility, and fairness.
• Respect others' privacy and intellectual property (no piracy, do not copy without permission, cite sources).
• Netiquette — polite behaviour in emails, social media and forums (no spamming, flaming or cyberbullying).

Cyber Safety (Practical Tips)

• Use strong, unique passwords and change them periodically; enable two-factor authentication (2FA).
• Recognize phishing: verify sender, check links before clicking, never share OTPs or passwords.
• Keep software, OS and antivirus up to date; install apps from trusted stores only.
• Use HTTPS sites (look for the padlock in the browser) when sharing sensitive info.
• Back up important files regularly and use encryption for sensitive data when possible.
• Configure privacy settings on social media; think before you post (digital footprint is persistent).
• Use parental controls for younger users and teach children about safe online behaviour.

Legal Aspects (India — relevant to CBSE students)

• Information Technology Act, 2000 (IT Act) and later amendments lay down offences and penalties for cyber crimes.
• Common offences and relevant provisions (summary):
  • Unauthorised access, damage or data modification (Section 43, Section 66 and related provisions).
  • Identity theft and impersonation (Section 66C, cheating by personation Section 66D).
  • Violation of privacy/confidentiality (Section 72).
  • Publishing obscene content online (Section 67).
• Note: Section 66A (criminalising certain online speech) was struck down by the Supreme Court (Shreya Singhal v. Union of India, 2015) and is no longer valid.
• Reporting: victims can report cybercrime to local police, the National Cyber Crime Reporting Portal (https://cybercrime.gov.in/) and CERT-In for incident response.

Ethical Behaviour — Simple Rules (Netiquette)

• Be honest: do not plagiarise or cheat online.
• Respect others: no abusive messages, do not spread rumours.
• Protect privacy: do not share someone else’s photos or data without permission.
• Use content legally: follow copyright rules and prefer Creative Commons or properly licensed material.

What to do if you are a victim

• Stop interacting with the attacker; do not click suspicious links.
• Change passwords on affected accounts; enable 2FA.
• Take screenshots and collect evidence (emails, messages, transaction records).
• Report to your school/parents and file a complaint on the National Cyber Crime Portal or local police. If financial loss occurred, inform your bank immediately.

Summary: Cyber ethics = right conduct online; cyber safety = practical steps to protect yourself and devices; legal aspects = laws and procedures that define and punish cybercrime. Responsible behaviour plus basic technical precautions protect individuals and communities online.

What is a Web Service?

A web service is a software system designed to support interoperable machine-to-machine interaction over a network (usually the Internet). It allows different applications (possibly written in different languages and running on different platforms) to communicate by sending and receiving messages.

Basic Idea (simple): One program (the client) asks another program (the server/service) for some information or action over the web. The server responds with the requested data or result.

Key Components of Web Services

• Service Provider: The application or server that offers a service (for example, a weather service providing temperature data).
• Service Consumer (Client): The application that uses the web service (for example, a smartphone app requesting weather data).
• Service Registry: A directory where services are listed so clients can find them (e.g., UDDI in older models). Modern systems often use APIs and documentation portals instead.
• Service Description: A machine-readable description of what the service does and how to call it (examples: WSDL for SOAP-based services, OpenAPI/Swagger for RESTful services).
• Message Format: The structure and encoding of data exchanged. Common formats are XML and JSON.
• Transport Protocol: How messages are sent across the network. The most common is HTTP/HTTPS; others include SMTP or custom TCP/UDP.
• Operations/Methods: The specific functions the service offers (for example: getTemperature(city), makePayment(amount)).
• Security Components: Authentication (who you are), authorization (what you can do), encryption (keeping data private while travelling), and integrity (ensuring data isn’t changed).

Common Architectures and Styles

• SOAP (Simple Object Access Protocol): A standard protocol using XML for messages and WSDL for service description. SOAP is strict, supports built-in error handling and extended security features.
• REST (Representational State Transfer): An architectural style that uses standard HTTP methods (GET, POST, PUT, DELETE). Data is usually exchanged as JSON or XML. REST is lightweight and widely used for web APIs.

How a Typical Web Service Call Works (Sequence)

1. Client prepares a request (for example: GET /weather?city=Delhi).
2. Request is sent over the Internet using HTTP/HTTPS to the service provider.
3. Server processes the request, may consult a database or another service, and prepares a response (for example: JSON with temperature and humidity).
4. Server sends the response back to the client.
5. Client receives and uses the data (display to user or perform other actions).

Security Considerations

• HTTPS: Encrypts communication so data is private.
• API Keys / Tokens: Identify and authorize clients.
• Input Validation: Prevents malicious inputs (important to avoid attacks like injection).
• Rate Limiting: Restricts how many requests a client can make to avoid overload.

Advantages of Web Services

• Platform-independent communication between applications.
• Reusability — services can be used by many clients.
• Loose coupling — client and server are separate and can evolve independently.

Simple analogy: A web service is like a restaurant kitchen (provider) and a customer (client). The customer places an order (request). The kitchen prepares the dish (processes) and serves it (response). The menu (service description) tells the customer what they can order.

Overview: Web services (cloud apps, email, social networks, map services) and search tools (search engines, image search, site-specific search) help find and share information quickly. Using them safely means protecting your personal data, avoiding malware and scams, and evaluating the trustworthiness of information you find online.

Common risks:

• Phishing and fake websites that steal passwords and personal information.
• Malware, ransomware or malicious downloads from unsafe sites.
• Privacy leaks: apps or sites collecting and sharing more data than needed.
• Misinformation and unreliable sources returned by searches.
• Unsecured networks (public Wi‑Fi) that allow eavesdropping.

Practical safe-use guidelines:

• Use HTTPS: check for the padlock in the address bar before entering sensitive data. Prefer sites with HTTPS.
• Create strong, unique passwords and enable two-factor authentication (2FA) where available.
• Verify email and link authenticity: do not click links or open attachments from unknown senders; hover to see the real URL.
• Keep devices and apps updated, and use reputable antivirus or endpoint protection.
• Limit personal data shared on profiles; review app permissions and privacy settings.
• When using public Wi‑Fi, avoid banking or private transactions; use a VPN for added security.
• Use search engine safety features: SafeSearch (to filter explicit content), site: to search a single domain, "" (quotes) for exact phrases, - (minus) to exclude terms, filetype: to find specific document types.
• Evaluate sources using simple checks: who is the author or organization, when was it published, are claims supported by evidence, and do other trusted sources agree?
• Verify images and news with reverse image search and multiple reputable sources before sharing.
• Backup important data regularly to protect against data loss or ransomware.

How to verify a website or search result (quick checklist):

1. Look for HTTPS and a correct domain name (watch for misspellings).
2. Check the site’s contact details and "About" page for credibility.
3. Search for reviews or complaints about the site/company.
4. Use a reverse image search if an image or story looks suspicious.
5. If unsure, do not enter credentials—go directly to the official site or service.

Classroom activity idea: Give students a list of links and have them mark each as "safe", "suspicious", or "unsafe" using the checklist above, then explain their choices.

This topic gives students practical, safe, and classroom-friendly ways to understand and practise Internet security and basic web services concepts. It combines everyday security tips (passwords, updates, secure browsing, privacy) with hands-on classroom activities that build awareness and technical skills while emphasizing ethics and safety.

Key practical tips (what students should practise daily):

• Strong passwords: use long passphrases (12+ characters), mix of letters, numbers and symbols; avoid reuse across sites.
• Two-factor authentication (2FA): enable where available (SMS, authenticator apps, hardware tokens) to reduce account takeover risk.
• HTTPS and trusted sites: check for HTTPS and valid certificates before submitting sensitive data; for unfamiliar domains verify official sources.
• Software updates: keep OS, browsers and apps patched to close vulnerabilities.
• Secure Wi‑Fi: use WPA2/WPA3 at home; avoid sensitive transactions on open public Wi‑Fi or use a trusted VPN.
• Phishing awareness: inspect sender addresses, hover over links, don’t download unexpected attachments, and verify requests (especially money requests) using a secondary channel.
• Backups and recovery: maintain regular offline/online backups and know account recovery options.
• Privacy settings and digital footprint: review social media privacy controls and think before sharing personal data.
• Antivirus and firewall: use reputable endpoint protection and enable system firewall for basic defence.

Classroom activities (safe, educational, and low-cost):

• Password strength lab: students create passwords and compute entropy; class compares strengths on a chart. Demonstrate why longer passphrases often beat short complex passwords.
• Phishing role-play: teacher prepares simulated emails (safe, non-malicious) that students must classify as phishing or legitimate and list red flags.
• HTTPS inspection exercise: students visit sample sites (teacher-vetted) to inspect certificates, padlock icon and mixed-content warnings using browser developer tools.
• Secure vs insecure Wi‑Fi demo: discuss differences (open vs WPA2) and show a network diagram of risks like man-in-the-middle; do not perform real attacks—use simulated capture screenshots or classroom diagrams.
• API/web service mini-project: use a public, no-auth API (e.g., weather or open data) to send a simple REST request and display JSON response; students learn request/response and basic parsing.
• Poster and awareness campaigns: groups make posters/infographics on phishing, password rules, and safe social media use to present to school.
• Incident response drill: present a mock security incident (lost device or suspicious email) and have teams write step-by-step response plans.
• Privacy settings walkthrough: students check and document privacy settings on a social media platform (using demo accounts or guided screenshots).

Safety & ethics note: all demonstrations must avoid illegal or harmful actions (no real hacking, no unauthorized access). Use simulations, controlled examples, and teacher supervision. Emphasize reporting suspicious activity to adults and IT staff.