Chapter 10 - Securing Information Systems

•Define computer crime and describe several types of computer crime.

•Describe and explain the differences between cyberwar and cyberterrorism.

•Explain what is meant by the term “IS security” and describe both technology andhuman based safeguards for information systems.

Information Systems Controls, Auditing, and the Sarbanes-Oxley Act

•Discuss how to better manage IS security and explain the process of developing an ISsecurity plan.

•Describe how organizations can establish IS controls to better ensure IS security.

Computer Crime

•Define computer crime and describe several types ofcomputer crime.

Describe and explain the differences between cyberwar and cyberterrorism.

Explain what is meant by the term “IS security” and describe both technology and human basedsafeguards for information systems.

Information Systems Controls, Auditing, and the Sarbanes-Oxley Act

Discuss how to better manage IS security and explain the process of developing an IS security plan.

Describe how organizations can establish IS controls to better ensure IS security.

Computer Crime

•Computer crime—The act of using a computerto commit an illegal act.

–Targeting a computer while committing an offense.

–Using a computer to commit an offense.

–Using computers to support a criminal activity.

•Reported trend for computer crime has beendeclining over the past several years (CSI, 2011).

–Many incidents are never reported.

–Many incidents are never detected.

Primary Threats to InformationSystems Security

•Natural disasters

–Power outages, hurricanes,floods, and so on

•Accidents

–Power outages, cats walkingacross keyboards

•Links to outside businesscontacts

–Data travel between businessaffiliates

•Outsiders

–Viruses

•Employees and consultants

Types of Computer Crimes andFinancial Losses

What do you think happens to acompany’s stock price if theyreport that their systems havebeen compromised?

Would you report it if you didn’thave to?

Federal and State Laws

–Computer Fraud and Abuse Act of 1986

•Stealing or compromising data about national defense, foreignrelations, atomic energy, or other restricted information

•Violating data belonging to banks or other financial institutions

•Intercepting or otherwise intruding on communications betweenstates or foreign countries

•Threatening to damage computer systems in order to extort moneyor other valuables from persons, businesses, or institutions

–Electronic Communications Privacy Act of 1986

•makes it a crime to break into any electronic communicationsservice, including telephone services

•prohibits the interception of any type of electronic communications

Question

•Some computer criminals attempt to break intosystems or deface Web sites to promotepolitical or ideological goals. They are called________.

–A) crackers

–B) cyber soldiers

–C) ethical hackers

–D) patriot hackers

–E) hacktivists

Hacking and Cracking

•Which one is the “bad guy”?

–Hackers

–Crackers

–Hacktivists

•Know that hackers work on every side of thegame

–White Hat / Black Hat

–What they are depends on what team you play for

Types of Criminals

Four groups of computer criminals

1.Current or former employees

85–95% of theft from businesses comes from the inside

2.People with technical knowledge committing crimes forpersonal gain

3.Career criminals using computers to assist them in crimes

4.Outside crackers hoping to find information of value

About 12 percent of cracker attacks cause damage

Computer Viruses and Other Destructive Code

•What is your favorite type of destructive code?

–Two basic methodologies: Focused attack andopportunistic attack

•Viruses – self propagating executable

–Attached to a host file

•Worms – also self propagating

–Standalone file

•Trojans – malware designed to enter the system by appearinglegitimate

•Bots – task automation and information retrieval

•Phishing, buffer overload, keystroke scanners, packet sniffers,brute force cracks, etc

Types of Crimes

3 Major Groups

Types of Attacks - Denial of Service Attack

•Attackers preventlegitimate users fromaccessing services.

•Zombie computers

–Created by viruses orworms

–Attack Web sites

•Servers crash underincreased load.

Types of Attacks - Cybersquatting

•The book presents a conceptual definition I would disagreewith

–The practice of registering a domain name and later reselling it.

–It is also the practice of exploiting name commonalities byinfringing on established brand

•Some of the victims include:

–Eminem, Panasonic, Hertz, Avon

•Anti-Cybersquatting Consumer Protection Act in 1999

–Fines as high as $100,000

–Some companies pay the cybersquatters to speed up the process ofgetting the domain.

Types of Attacks - Cyber Harassment, Stalking,and Bullying

•Cyber harassment—Crime that broadly refers to theuse of a computer to communicate obscene, vulgar, orthreatening content.

http://media-cache-ak0.pinimg.com/736x/6c/62/f8/6c62f8bc309a72945d31cccdaf541e62.jpg

http://www.tricitypsychology.com/blog/wp-content/uploads/2008/08/cyberbullying.jpg

Cyberwar and Cyberterrorism

Define computer crime and describe several types of computer crime.

Cyberwar and Cyberterrorism

•Describe and explain the differences between cyberwarand cyberterrorism.

Explain what is meant by the term “IS security” and describe both technology and human basedsafeguards for information systems.

Information Systems Controls, Auditing, and the Sarbanes-Oxley Act

Discuss how to better manage IS security and explain the process of developing an IS security plan.

Describe how organizations can establish IS controls to better ensure IS security.

Question

•An organized attempt by a country's military to disruptor destroy the information and communicationsystems of another country. Which of the followingterms best represents such attacks by a country?

–A) cyber terrorism

–B) cyberwar

–C) logic bomb

–D) Web vandalism

–E) Internet hoaxing

Cyberterrorism and Warfare

http://file.scirp.org/Html/8-7800099%5C041c73da-1e60-456b-93bc-1f7e328abfe8.jpg

Information Systems Security

Define computer crime and describe several types of computer crime.

Describe and explain the differences between cyberwar and cyberterrorism.

Information Systems Security

•Explain what is meant by the term “IS security” anddescribe both technology and human based safeguards forinformation systems.

Information Systems Controls, Auditing, and the Sarbanes-Oxley Act

Discuss how to better manage IS security and explain the process of developing an IS security plan.

Describe how organizations can establish IS controls to better ensure IS security.

Safeguarding IS Resources

•Risk Reduction

–Actively installing countermeasures

•Risk Acceptance

–Accepting any losses that occur

•Risk Transference

–Insurance

–Outsourcing

Information Systems Security

•All systems connected to a network are at risk.

•Information systems security

–Precautions to keep IS safe from unauthorized access anduse

•Increased need for well executed computer securitywith increased use of the Internet

http://slissrv01.iowa.uiowa.edu/~mhalterm/MemoryBeta/battlestarnode/battlestarseal.jpg

http://www.movieviral.com/wp-content/uploads/2009/03/skynet_logo-300x300.png

Technological Safeguards

•Physical access restrictions

•Authentication

–Use of passwords

–Photo ID cards, smart cards

–Keys to unlock a computer

–Combination

•Authentication dependenton

–Something you have

–Something you know

–Something you are

Passwords – A personal note

•Never make your password about:

–Your parents

–Your birthday

–Your school

–Your significant other

–Your children

–A real word

•The best passwords are

–@GoBleTG51!oOk927_

–This password is long and nonsensical

Biometrics

•Form of authentication

–Fingerprints

–Retinal patterns

–Facial features and so on

•Fast authentication

•High security

•What is the failing of the biometric password?

Securing the Facilities Infrastructure

•Backups

–Secondary storage devices

–Regular intervals

•Backup sites

–Cold backup site

–Hot backup site

•Redundant data centers

–Different geographic areas

•Closed-circuit television (CCTV)

–Monitoring for physical intruders

–Video cameras display and record all activity

–Digital video recording

•Uninterruptible power supply (UPS)

–Protection against power surges

Firewalls

•Firewall—A system designed to detect intrusion andprevent unauthorized access

•Implementation

–Hardware, software, mixed

Virtual Private Networks

•Connection constructeddynamically within anexisting network

•Tunneling

–Send private data overpublic network

–Encrypted information

Encryption

•Message encoded before sending

•Message decoded when received

•Cryptography—the science of encryption.

–It requires use of a key for decoding.

•Certificate authority—manages distribution of keys on a busyWeb site.

•Secure Sockets Layer (SSL)—popular public key encryptionmethod.

https://www.eleceng.adelaide.edu.au/personal/dabbott/wiki/images/thumb/8/8c/Public-Key.jpg/350px-Public-Key.jpg

Managing IS Security

Define computer crime and describe several types of computer crime.

Describe and explain the differences between cyberwar and cyberterrorism.

Information Systems Controls, Auditing, and the Sarbanes-Oxley Act

Explain what is meant by the term “IS security” and describe both technology and human basedsafeguards for information systems.

Managing IS Security

•Discuss how to better manage IS security and explain theprocess of developing an IS security plan.

Describe how organizations can establish IS controls to better ensure IS security.

Question

•The ________ policy explains technical controls on allorganizational computer systems, such as accesslimitations, audit-control software, firewalls, and so on.

–A) incident handling

–B) information

–C) security

–D) disaster recovery

–E) account management

Managing Information Systems Security

•Non-technicalsafeguards

–Management ofpeople’s use of IS

•Acceptable usepolicies

–Trustworthyemployees

–Well-treatedemployees

Disaster Planning

•Disasters can’t be completely avoided. Need to beprepared.

•Business continuity plan

–describes how a business resumes operation after a disaster

•Disaster recovery plan

–Subset of business continuity plan

–Procedures for recovering from systems-related disasters

–Two types of objectives

•Recovery time objectives (Maximum time allowed to recover)

•Recovery point objectives (How current should the backup materialbe?)

Responding to a Security Breach

•Restore lost data

•Perform new risk audit

•Implement additional safeguards

•Contact law enforcement (yeah, right!)

–Computer Emergency Response Team Coordination Center(Federal government center of Internet security expertise)

Information Systems Controls, Auditing, andthe Sarbanes-Oxley Act

Define computer crime and describe several types of computer crime.

Describe and explain the differences between cyberwar and cyberterrorism.

Explain what is meant by the term “IS security” and describe both technology and human basedsafeguards for information systems.