Gathering accurate and relevant data is a critical first step in the website design and development process, especially in the cyber security sector. Cyber security professionals in Kenya must understand and correctly interpret key web terms to ensure that websites are designed with security, usability, and compliance in mind. This chapter explores foundational web terminology that informs requirements gathering and guides secure web architecture. Mastery of these terms supports effective communication with stakeholders, precise specification of website features, and identification of potential security vulnerabilities early in the design phase.

1.1 Meaning of Web Terms

In cyber security-focused website projects, comprehending core web terms is essential for analyzing client needs and translating them into secure technical specifications. These terms cover components of web architecture, data transmission, protocols, and security mechanisms that form the backbone of website functionality and protection. Kenyan cyber security teams working with banks, government agencies, or health institutions rely on these terms to align design with regulatory standards such as the Kenya Data Protection Act and to anticipate threats like cross-site scripting or data breaches.

1.1.1 Domain Name and URL

Understanding the concepts of Domain Name and URL (Uniform Resource Locator) is foundational for web design professionals, as these define how users locate and access websites. A domain name is a human-readable address such as "www.nairobihealth.go.ke" that maps to an IP address on the internet. The URL extends this concept by specifying the exact resource location within the website, including protocol, domain, path, and parameters.

Domain Name

• Identification of Websites: The domain name uniquely identifies a website on the internet, allowing users to access services without memorizing numeric IP addresses. For example, the domain "kcb.co.ke" identifies Kenya Commercial Bank’s official website.
• Hierarchy and Structure: Domain names have a hierarchical structure from top-level domains (TLD) like ".ke" to subdomains such as "mail.kcb.co.ke" that specify distinct services or departments.
• Branding and Trust: A recognizable domain name enhances brand credibility and user confidence, which is critical for secure online transactions.
• Registration and Management: Domains must be registered through accredited registrars and managed carefully to avoid hijacking or unauthorized transfers.
• DNS Resolution: The Domain Name System (DNS) translates domain names to IP addresses, enabling browsers to locate website servers efficiently.

URL

• Resource Locator: A URL specifies the exact location of a resource on the web, including the protocol (e.g., https), domain name, path, and query parameters.
• Protocol Specification: The URL begins with a protocol (http or https), where HTTPS indicates secure communication using SSL/TLS encryption, essential for protecting sensitive data.
• Path and File Identification: The path component directs the server to a specific file or script, such as "/login.php" for user authentication pages.
• Query Strings: URLs can include query parameters that pass data to web applications, which must be validated to prevent injection attacks.
• Bookmarking and Sharing: Well-structured URLs improve user experience by enabling easy bookmarking and sharing of specific content.

1.1.2 HTTP, HTTPS and Web Protocols

Web protocols define the rules for data exchange between clients and servers. In cyber security, understanding these protocols is vital for designing secure communication channels and defending against network-based attacks.

HTTP (Hypertext Transfer Protocol)

• Basic Protocol for Web Communication: HTTP governs the transfer of web pages from servers to browsers but does not inherently encrypt data, making it vulnerable to interception.
• Statelessness: Each HTTP request is independent, requiring additional mechanisms like cookies or sessions to maintain user state.
• Common Use Cases: HTTP is often used for public or non-sensitive content delivery but is discouraged for transmitting confidential data.
• Susceptibility to Attacks: Without encryption, HTTP traffic can be intercepted or modified by attackers via man-in-the-middle attacks.
• Port Number: HTTP typically operates over TCP port 80.

HTTPS (HTTP Secure)

• Encrypted Communication: HTTPS adds SSL/TLS encryption to HTTP, securing data in transit and preventing eavesdropping or tampering.
• Authentication: HTTPS uses digital certificates to authenticate website identity, which is crucial for trust in online banking or government portals.
• Data Integrity: Encryption ensures that data is not altered during transmission, protecting against message modification attacks.
• Regulatory Compliance: Many Kenyan institutions, including NHIF and county health systems, mandate HTTPS for online services to protect personal data.
• Port Number: HTTPS operates over TCP port 443.

Other Web Protocols

• FTP (File Transfer Protocol): Used for transferring files between client and server, FTP requires secure alternatives like SFTP or FTPS to prevent credential interception.
• SMTP/IMAP/POP3: Email protocols integral to webmail services, requiring secure configurations to prevent phishing attacks.
• WebSocket: Enables real-time communication between client and server, important for live security monitoring dashboards.
• REST and SOAP: Protocols for web services that require secure API design to prevent unauthorized access.
• DNS Protocol: Critical for domain name resolution and often targeted in attacks like DNS spoofing.

1.1.3 IP Address and Hosting

The IP address and hosting environment determine where and how a website is physically and logically located on the internet. Cyber security professionals must understand these concepts to design secure hosting architectures and implement network-level protections.

IP Address

• Unique Network Identifier: An IP address uniquely identifies a device on the internet, enabling routing of web traffic to the correct server.
• IPv4 and IPv6: IPv4 uses 32-bit addresses, while IPv6 uses 128-bit addresses to accommodate the growing number of internet devices.
• Static vs Dynamic IPs: Static IPs remain constant and are preferred for hosting websites to ensure consistent access, while dynamic IPs change periodically.
• IP Address Geolocation: IP addresses can indicate the physical location of the server, affecting compliance with regional data laws.
• Security Implications: IP addresses can be targeted by denial-of-service attacks, so cybersecurity measures like firewalls and IP filtering are essential.

Hosting

• Types of Hosting: Shared, dedicated, VPS, and cloud hosting options offer varying levels of control, performance, and security.
• Physical Location of Servers: Hosting within Kenya or trusted jurisdictions can improve compliance with data protection regulations.
• Managed vs Unmanaged Hosting: Managed hosting includes security monitoring and updates, reducing risk for organizations without dedicated IT staff.
• Redundancy and Backup: Hosting providers must offer data backups and failover mechanisms to ensure availability during attacks or failures.
• Security Controls: Hosting environments should implement firewalls, intrusion detection systems, and regular patching to mitigate vulnerabilities.

1.1.4 Front-End and Back-End Concepts

Differentiating between front-end and back-end components is crucial for cyber security professionals to evaluate risk exposure and apply appropriate controls in website design.

Front-End

• User Interface Elements: Includes HTML, CSS, and JavaScript that render the website visible and interactive to users.
• Client-Side Processing: Front-end code executes in the user’s browser, requiring careful validation to prevent injection and cross-site scripting attacks.
• Responsiveness and Accessibility: Designing for multiple devices and users with disabilities enhances usability and compliance.
• Security Considerations: Protecting against manipulation of front-end scripts and ensuring secure communication with back-end services.
• Performance Impact: Efficient front-end design reduces load times, indirectly supporting security by minimizing exposure to certain timing attacks.

Back-End

• Server-Side Logic: Handles data processing, database operations, and business rules, typically implemented with languages like PHP, Python, or Java.
• Database Interaction: Manages storage and retrieval of sensitive user data, requiring encryption and access controls.
• Authentication and Authorization: Back-end enforces login procedures and user permissions to secure resources.
• API Integration: Connects with external services, necessitating secure API design to prevent data leaks or unauthorized access.
• Monitoring and Logging: Back-end systems often generate logs for security auditing and incident response.

Chapter Summary

This chapter explored the essential web terms necessary for understanding website design and development, emphasizing the importance of careful observation to gather accurate data. It highlighted the critical role a website plays in establishing an online presence, promoting services, and engaging users effectively. Various types of website development were discussed, including static, dynamic, e-commerce, and content management systems, each serving different purposes and user needs. The chapter also detailed the specific requirements for developing a functional website, covering hardware, software, content, and user interface considerations. Finally, it introduced key web programming languages such as HTML, CSS, JavaScript, and server-side languages, explaining their roles in creating interactive and responsive websites. Together, these topics provide a comprehensive foundation for beginning the website design and development process.