8.1 © 2007 by Prentice Hall Minggu ke 6 Chapter 8 Securing Information Systems Chapter 8 Securing Information Systems

8.1 © 2007 by Prentice Hall

Minggu ke 6Minggu ke 6

Chapter 8Chapter 8

Securing Information Securing Information SystemsSystems

Chapter 8Chapter 8

Securing Information Securing Information SystemsSystems


LEARNING OBJECTIVES

Management Information SystemsManagement Information SystemsChapter 8 Securing Information SystemsChapter 8 Securing Information Systems

• Analyze why information systems need special protection from destruction, error, and abuse.

• Assess the business value of security and control.

• Design an organizational framework for security and control.

• Evaluate the most important tools and technologies for safeguarding information resources.


Phishing: A Costly New Sport for Internet Users

• Problem: Large number of vulnerable users of online financial services, ease of creating bogus Web sites.

• Solutions: Deploy anti-phishing software and services and a multilevel authentication system to identify threats and reduce phishing attempts.

• Deploying new tools, technologies, and security procedures, along with educating consumers, increases reliability and customer confidence.

• Demonstrates IT’s role in combating cyber crime.

• Illustrates digital technology as part of a multilevel solution as well as its limitations in overcoming discouraged consumers.



Phishing: A Costly New Sport for Internet Users

• Security: the policies, procedures and technical measures used to prevent unauthorized access, alteration, theft or physical damage to IS.

• Control: methods, policies, and organizational procedures that ensure the safety of the organization’s assets, the accuracy and reliability of its records, and operational adherence to management standards.



Systems Vulnerability and Abuse

• Why systems are vulnerable

• Internet vulnerabilities

• Wireless security challenges

• Malicious software: Viruses, worms, Trojan horses, and spyware

• Hackers and cybervandalism

• Spoofing and sniffing

• Denial-of-service attacks



Contemporary Security Challenges and VulnerabilitiesContemporary Security Challenges and Vulnerabilities

Figure 8-1

The architecture of a Web-based application typically includes a Web client, a server, and corporate information systems linked to databases. Each of these components presents security challenges and vulnerabilities. Floods, fires, power failures, and other electrical problems can cause disruptions at any point in the network.




Worldwide Damage from Digital AttacksWorldwide Damage from Digital Attacks

Figure 8-3

This chart shows estimates of the average annual worldwide damage from hacking, malware, and spam since 1999. These data are based on figures from mi2G and the authors.




• Read the Interactive Session: Technology, and then discuss the following questions:

• What is the business impact of botnets?

• What management, organization, and technology factors should be addressed in a plan to prevent botnet attacks?

• How easy would it be for a small business to combat botnet attacks? A large business?

Bot Armies and Network Zombies





• Computer crime and cyberterrorism

• Identity theft

• Phishing

• Evil twins

• Pharming

• Click fraud

• Cyberterrorism and cyberwarfare

• Internal threats: Employees

• Software vulnerability



Business Value of Security and Control

• Companies have very valuable information to protect• Security and control framework that protect business

information assets can produce high return on investment

• Strong security and control also increase employee productivity and lower operational costs.




• Legal and regulatory requirements for electronic records management• HIPAA (Health Insurance Portability & Accountability Act)• Gramm-Leach-Bliley Act• Sarbanes-Oxley Act




• Electronic evidence and computer forensics

• Electronic evidence: digital data stored on portable floppy disks, CDs & computer hard disk drives, in email, instant messages, and e-commerce transactions over the Internet.

• Computer forensics: the scientific collection, examination, authentication, preservation, and analysis of data held on or retrieved from computer storage media in such a way that information can be used as evidence in a court of law, such as:

• Recover data from companies while preserve evidential integrity

• Securely storing & handling recovered electronic data

• Finding significant information in a large volume of electronic data

• Present the information to a court of law



Establishing a Framework for Security and Control

• Information Systems Controls:1. General controls

• Govern the design, security, and use of computer programs and the security of data files in general throughout the organization’s IT infrastructure.

2. Application controls• Specific controls unique to each computerized

application, such as payroll or order processing.• Include automated & manual procedures that ensure that

only authorized data are completely and accurately processed by that application.

• Application controls can be classified as (1) input controls, (2) processing controls, and (3) output controls.




• Information Systems Controls:2. General controls (cont.)

General controls can be classified as:(1) software controls

monitor the use of system software and prevent unauthorized access of software programs, system software and computer programs.

(2) hardware controlsensure that computer hardware is physically secure, and check for equipment malfunction.

(3) computer operation controlsoversee the work of the computer department to ensure that programmed procedures are consistently and correctly applied to the storage and processing of data.




• Information Systems Controls:2. General controls (cont.)

General controls can be classified as:(4) data security controls

ensure that valuable business data files on either disk or tape are not subject to unauthorized access, change, or destruction while they are in use or in storage

(5) Implementation controlsAudit the system development process at various points to ensure that the process is properly controlled and managed.

(6) Administrative controlsFormalize standards, rules, procedures, and control disciplines to ensure that the organization’s general and application controls are properly executed and enforced.




• Information Systems Controls:2. Application controls (cont.)

Application controls can be classified as:(1) input controls :

check data for accuracy and completeness when they enter the system, eg: input authorization, data conversation, data editing, and error handling.

(2) processing controlsestablish that data are complete and accurate during updating.

(3) output controls

ensure that the results of computer processing are accurate, complete and properly distributed.




• Risk Assessment• The level of risk to the firm if a specific activity or process is not

properly controlled.

• Security policy

• Consists of statement ranking information risks, identifying acceptable security goals, and identifying mechanisms for achieving these goals.

• Ensuring business continuity• Disaster recovery planning and business continuity planning• Security outsourcing

• The role of auditing



• Access control

• Firewalls, intrusion detection systems, and antivirus

software

• Securing wireless networks

• Encryption and public key infrastructure

Technologies and Tools for Security



A Corporate FirewallA Corporate Firewall

Figure 8-6

The firewall is placed between the firm’s private network and the public Internet or another distrusted network to protect against unauthorized traffic.




• Read the Interactive Session: Management, and then discuss the following questions:

• How are Unilever executives’ wireless handhelds related to the company’s business performance?

• Discuss the potential impact of a security breach at Unilever.

• What management, organization, and technology factors had to be addressed in developing security policies and procedures for Unilever’s wireless handhelds?

• Is it a good idea to allow Unilever executives to use both BlackBerrys and cell phones? Why or why not?

Unilever Secures Its Mobile Devices




Public Key EncryptionPublic Key Encryption

Figure 8-7

A public key encryption system can be viewed as a series of public and private keys that lock data when they are transmitted and unlock the data when they are received. The sender locates the recipient’s public key in a directory and uses it to encrypt a message. The message is sent in encrypted form over the Internet or a private network. When the encrypted message arrives, the recipient uses his or her private key to decrypt the data and read the message.



Documents

8.1 © 2007 by Prentice Hall Minggu ke 6 Chapter 8 Securing Information Systems Chapter 8 Securing Information Systems