- [Instructor] You may already be familiar with web cookies.
These are small pieces of content
that can track users between website visits
and across different websites.
Understanding the uses of cookies
and how to move them from a system is a critical task
for privacy minded security administrators.
Cookies are stored in user browsers by websites
and are typically used to track a single user
or to retain information needed between web sessions.
There are some privacy risks associated with cookies.
This is especially true when a cookie is used
to track activity across multiple websites.
The tracking might be theoretically anonymous
but as soon as you provide your name to just one
of the websites using the same tracking cookie,
you activity across all
of those websites becomes deanonymized.
This is a particular concern with cookies belonging
to advertising networks
that are used across a large number of sites.
Fortunately, the user has a high degree
of control over the use of cookies.
Let's look at how you can control cookies in Google Chrome.
I'm going to go ahead and open the Chrome settings.
And then scroll down and choose the advanced option.
In the privacy and security section that's just appeared,
I'm going to choose the content settings option.
Then I'll choose cookies to take a look at how my copy
of Chrome is currently configured to handle cookies.
There are a few options here that we can look at.
First, we have the option Allow sites to save
and read cookie data.
That option is turned on by default and as you can see here,
it's recommended that you do keep it turned on.
This setting is required for many websites
to function normally.
The second option, Keep local data
only until you quit your browser,
causes Chrome to discard all cookies each time
you close the browser.
This does provide strong security
because someone else using the same computer account later
on won't be able to access your cookies,
but it is very inconvenient
because websites will forget you after each use,
requiring you to login every time.
The final toggle switch here,
Block third-party cookies,
prevents websites from accessing cookies
created by other sites.
This feature is most commonly used for advertising,
and there aren't many good reasons to leave it turned on.
So I'm going to block third-party cookies.
These three settings at the top
of the screen are all global settings.
If I change any of these three sliders,
the option I choose will apply to all websites that I visit.
In the bottom portion of the screen,
I can add specific rules for individual websites.
I'm now going to click on See all cookies and site data.
Here I can see what cookies
are currently in my browser by scrolling through this list.
I can also explore the contents of those cookies.
I can use the trashcan option to remove an individual cookie
or use the remove all option to remove all
of the cookies in my browser.
While web browsers are the most common place
to find cookies, they are not the only cookies in use.
Some application platforms use cookies as well.
For example, many people are surprised to learn
that Adobe Flash has its own cookie system.
These Flash cookies are known
as locally shared objects or LSOs.
Cookies track user activity across the web.
As a security professional,
you should be able to explain the risks
of cookies to end-users
and you should be knowledgeable about
the privacy settings available for cookie management.