File-Sharing: Creative Destruction or Just Plain Destruction? Stan
10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection...
-
Upload
harriet-casey -
Category
Documents
-
view
226 -
download
0
Transcript of 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection...
![Page 1: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/1.jpg)
10Lecture
Security and ControlSecurity and ControlSecurity and ControlSecurity and Control
![Page 2: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/2.jpg)
OBJECTIVES
• Explain why information systems need special protection from destruction, error, and abuse
• Assess the business value of security and control
• Evaluate the most important tools and technologies for safeguarding information resources
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
![Page 3: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/3.jpg)
SYSTEM VULNERABILITY AND ABUSE
Why Systems Are Vulnerable
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
Contemporary Security Challenges and Vulnerabilities
Figure 10-1
![Page 4: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/4.jpg)
• Lack of encryption with most Real Time applications
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
SYSTEM VULNERABILITY AND ABUSE
Internet Vulnerabilities:
Why Systems Are Vulnerable (Continued)
![Page 5: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/5.jpg)
• Radio frequency bands are easy to scan
• The service set identifiers (SSID) identifying the access points broadcast multiple times
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
SYSTEM VULNERABILITY AND ABUSE
Wireless Security Challenges:
![Page 6: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/6.jpg)
• Computer viruses, worms, trojan horses
• Spyware
• Spoofing and Sniffers
• Denial of Service (DoS) Attacks
• Identity theft
• Cyberterrorism and Cyberwarfare
• Vulnerabilities from internal threats (employees); software flaws
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
SYSTEM VULNERABILITY AND ABUSE
Malicious Software: Viruses, Worms, Trojan Horses, and Spyware
Hackers and Cybervandalism
![Page 7: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/7.jpg)
SYSTEM VULNERABILITY AND ABUSE
Worldwide Damage from Digital Attacks
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
Figure 10-3
![Page 8: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/8.jpg)
• Inadequate security and control may create serious legal liability.
• Businesses must protect not only their own information assets but also those of customers, employees, and business partners.
• A sound security and control framework that protects business information assets can thus produce a high return on investment.
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
BUSINESS VALUE OF SECURITY AND CONTROL
![Page 9: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/9.jpg)
Security Incidents Continue to Rise
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
BUSINESS VALUE OF SECURITY AND CONTROL
Figure 10-4
Source: CERT Coordination Center, www.cert.org, accessed July 6, 2004.
![Page 10: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/10.jpg)
• Electronic Evidence: Computer data stored on disks
and drives, e-mail, instant messages, and e-
commerce transactions
• Computer Forensics: Scientific collection,
examination, authentication, preservation, and
analysis of computer data for use as evidence in a
court of law
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
BUSINESS VALUE OF SECURITY AND CONTROL
Electronic Evidence and Computer Forensics
![Page 11: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/11.jpg)
General controls:
• Software and hardware
• Computer operations
• Data security
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Types of Information Systems Controls
![Page 12: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/12.jpg)
• Input
• Processing
• Output
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Application controls:
![Page 13: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/13.jpg)
• Risk detection: Based on auditing process, identified the potential entity which could cause risk and classified them
• Risk assessment: Determines the level of risk to the firm if a specific activity or process is not properly controlled: Severity*Probability=Risk. Values of severity and probability range each from 1 out of 5.
• Risk avoidance: Based on risk assessment creating the strategic plan to avoid the most probable risk (with higher risk)
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Type of Risks:
![Page 14: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/14.jpg)
• Acceptable Use Policy (AUP)
• Authorization policies
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Security Policy:
Policy ranking information risks, identifying acceptable security goals, and identifying the mechanisms for achieving these goals
![Page 15: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/15.jpg)
• Downtime: Period of time in which a system is not
operational
• Fault-tolerant computer systems: Redundant
hardware, software, and power supply components to
provide continuous, uninterrupted service
• High-availability computing: Designing to maximize
application and system availability
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Ensuring Business Continuity
![Page 16: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/16.jpg)
• Load balancing: Distributes access requests across
multiple servers
• Mirroring: Backup server that duplicates processes on
primary server
• Recovery-oriented computing: Designing computing systems to recover more rapidly from mishaps
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Ensuring Business Continuity (Continued)
![Page 17: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/17.jpg)
• Disaster recovery planning: Plans for restoration of computing and communications disrupted by an event such as an earthquake, flood, or terrorist attack
• Business continuity planning: Plans for handling mission-critical functions if systems go down
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Ensuring Business Continuity (Continued)
![Page 18: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/18.jpg)
• MIS audit: Identifies all of the controls that govern
individual information systems and assesses their
effectiveness
• Security audits: Review technologies, procedures,
documentation, training, and personnel
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Auditing:
![Page 19: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/19.jpg)
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Access Control
• Passwords
Authentication:
Access control: Consists of all the policies and procedures a company uses to prevent improper access to systems by unauthorized insiders and outsiders
• Tokens, smart cards
• Biometric authentication
![Page 20: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/20.jpg)
• Firewalls: Hardware and software controlling flow of
incoming and outgoing network traffic
• Intrusion detection systems: Full-time monitoring
tools placed at the most vulnerable points of
corporate networks to detect and deter intruders
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Firewalls, Intrusion Detection Systems, and Antivirus Software
![Page 21: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/21.jpg)
• Antivirus software: Software that checks computer
systems and drives for the presence of computer
viruses and can eliminate the virus from the infected
area
• Wi-Fi Protected Access specification
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Firewalls, Intrusion Detection Systems, and Antivirus Software (Continued)
![Page 22: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/22.jpg)
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
A Corporate Firewall
Figure 10-7
![Page 23: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/23.jpg)
• Public key encryption: Uses two different keys, one
private and one public. The keys are mathematically
related so that data encrypted with one key can be
decrypted using only the other key
• Message integrity: The ability to be certain that the
message being sent arrives at the proper destination
without being copied or changed
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Encryption and Public Key Infrastructure
![Page 24: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/24.jpg)
• Digital signature: A digital code attached to an electronically transmitted message that is used to verify the origin and contents of a message
• Digital certificates: Data files used to establish the identity of users and electronic assets for protection of online transactions
• Public Key Infrastructure (PKI): Use of public key cryptography working with a certificate authority
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Encryption and Public Key Infrastructure (Continued)
![Page 25: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/25.jpg)
• Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS): protocols for secure information transfer over the Internet; enable client and server computer encryption and decryption activities as they communicate during a secure Web session.
• Secure Hypertext Transfer Protocol (S-HTTP): used for encrypting data flowing over the Internet; limited to Web documents, whereas SSL and TLS encrypt all data being passed between client and server.
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Encryption and Public Key Infrastructure (Continued)
![Page 26: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/26.jpg)
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Public Key Encryption
Figure 10-8
![Page 27: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/27.jpg)
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Digital Certificates
Figure 10-9
![Page 28: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/28.jpg)
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
MANAGEMENT OPPORTUNITIES, CHALLENGES AND SOLUTIONS
Management Opportunities:
Creation of secure, reliable Web sites and
systems that can support e-commerce and
e-business strategies
![Page 29: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/29.jpg)
• Designing systems that are neither overcontrolled
nor undercontrolled
• Implementing an effective security policy
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
MANAGEMENT OPPORTUNITIES, CHALLENGES AND SOLUTIONS
Management Challenges:
![Page 30: 10 Lecture Security and Control. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business.](https://reader036.fdocuments.us/reader036/viewer/2022062407/56649d345503460f94a0a369/html5/thumbnails/30.jpg)
• Security and control must become a more visible and explicit priority and area of information systems investment.
• Support and commitment from top management is required to show that security is indeed a corporate priority and vital to all aspects of the business.
• Security and control should be the responsibility of everyone in the organization.
Management Information SystemsManagement Information SystemsLecture 10 Lecture 10 Security and ControlSecurity and Control
MANAGEMENT OPPORTUNITIES, CHALLENGES AND SOLUTIONS
Solution Guidelines: