Social Networking and Blogs: Networking, Internet & Cyber Security Notes for NCO (Cyber Olympiad)

Social Networking & Blogs

Subject: Networking, Internet & Cyber Security
Program: NCO (Cyber Olympiad)
Topic: Social Networking and Blogs

1. Simple Explanation

Term	What It Means	Why It Matters
Social Network	An online platform (e.g., Facebook, Twitter) where users create profiles, form connections, and exchange messages, media, and content.	Enables mass communication and data sharing over the Internet.
Blog	A website or section of a website where an individual or group publishes regular posts (text, images, video).	Acts as a personal or professional voice; content is often indexed by search engines.
Client‑Server Model	All social networks and blogs run on servers that serve content to clients (web browsers, mobile apps).	Centralizes control, data storage, and security enforcement.
HTTP/HTTPS	The protocol that transfers web pages and data between client and server. HTTPS adds TLS encryption.	HTTPS is essential to protect user data from eavesdropping.
API	Application Programming Interface – a set of endpoints that let developers programmatically interact with the platform (e.g., Facebook Graph API).	Enables third‑party apps, analytics, and automation.
OAuth	An authentication protocol that allows a user to grant limited access to their data without giving out a password.	Widely used by social networks for “Login with …” and data sharing.
Digital Footprint	The trail of data a user leaves online.	Influences privacy, reputation, and potential security risks.

2. Key Points (Study Checklist)

Category	Highlights
Architecture	• Client‑Server (web or mobile) • CDN + caching for fast content delivery • Load balancers & micro‑services for scalability
Transport & Security	• HTTPS everywhere; TLS 1.3 recommended • HSTS, HTTP Strict Transport Security header • Content Security Policy (CSP) to mitigate XSS
Authentication & Authorization	• Username/Password + 2FA • OAuth 2.0 for third‑party access • Role‑based access control (admin vs. user)
Data Flow	1. User requests page → DNS lookup → TCP handshake → HTTPS request 2. Server authenticates → returns HTML/JSON 3. Client renders → user interacts (post, comment)
Privacy Settings	• Who can see posts (public, friends, private) • Data sharing preferences (profile, activity, location) • GDPR / CCPA compliance
Security Threats	• Phishing & credential‑stealing • Cross‑Site Scripting (XSS) • Cross‑Site Request Forgery (CSRF) • Malicious media attachments • Mass data leaks
Mitigation Techniques	• Input validation & sanitization • CSRF tokens • Content‑disposition headers for uploads • Rate‑limiting & bot detection • Regular security audits & penetration testing
Legal & Ethical	• Copyright & user‑generated content • Hate‑speech & defamation filters • Data retention & deletion policies
Analytics & Monetisation	• Cookie‑based tracking • Ad network integration • Data‑mining for targeted ads
Emerging Trends	• Decentralised social networks (IPFS, blockchain) • Federated platforms (Mastodon, Diaspora) • AI‑driven content moderation

3. Worked Example

Scenario: A user posts a new blog entry on a typical blogging platform.

3.1 Step‑by‑Step Flow

Step	Action	Network Layer	Security Feature
1. User Login	User enters credentials on `https://blog.example.com/login`.	HTTPS POST	TLS 1.3, CSRF token
2. Session Creation	Server validates, generates JWT (JSON Web Token) + session cookie.	HTTPS Response	Secure‑flag, SameSite=Lax
3. Compose Post	User writes Markdown, attaches image.	Browser → HTTPS PUT/POST to `/api/posts`	Content-Type: multipart/form-data
4. Server Validation	Server checks JWT, sanitises input, stores data in database.		XSS protection (escaping), CSRF token validation
5. Image Upload	Image stored in CDN bucket (e.g., S3).	HTTPS PUT	Signed URL with expiry
6. Publish	Server updates `posts` table, emits event to CDN cache invalidation.	HTTPS GET/PUT	HSTS, CSP for image sources
7. Front‑end Render	Blog page fetched via HTTPS GET, cached by CDN.		ETag, Cache‑Control
8. Social Share	User clicks “Share on Twitter”; app opens OAuth flow to Twitter.	HTTPS	OAuth 2.0, PKCE

3.2 Code Snippet (Python Flask‑like Pseudocode)

@app.post("/api/posts")
@require_auth  # verifies JWT in cookie
def create_post():
    title = request.form['title']
    body