chapter 7 1artificial intelligent. objectives explain why information systems need special...
TRANSCRIPT
![Page 1: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/1.jpg)
Chapter 7
1Artificial Intelligent
![Page 2: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/2.jpg)
OBJECTIVES
• Explain why information systems need special protection from destruction, error, and abuse
• Assess the business value of security and control
• Evaluate elements of an organizational and managerial framework for security and control
• Evaluate the most important tools and technologies for safeguarding information resources
• Identify the challenges posed by information systems security and control and management solutions
2Artificial Intelligent
![Page 3: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/3.jpg)
• Challenge: provide network and infrastructure security to a financial services firm in a Web-enabled high-threat environment
• Solutions: outsource to a well-known security firm the task of providing 24 x 7 network and infrastructure monitoring and reporting
• Real-time security monitoring 24 x 7, best practices, online security portal, data mining of network transactions
• Illustrates the role of system and network security in providing customers with service and managing corporate risk in online environments
Wesfarmers Limited Case
3Artificial Intelligent
![Page 4: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/4.jpg)
SYSTEM VULNERABILITY AND ABUSE
Why Systems Are Vulnerable
Contemporary Security Challenges and Vulnerabilities
Figure 10-1 4Artificial Intelligent
![Page 5: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/5.jpg)
• Use of fixed Internet addresses through use of cable modems or DSL
• Lack of encryption with most Voice over IP (VoIP)
• Widespread use of e-mail and instant messaging (IM)
SYSTEM VULNERABILITY AND ABUSE
Internet Vulnerabilities:
5Artificial Intelligent
![Page 6: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/6.jpg)
• Radio frequency bands are easy to scan
• The service set identifiers (SSID) identifying the access points broadcast multiple times
SYSTEM VULNERABILITY AND ABUSE
Wireless Security Challenges:
6Artificial Intelligent
![Page 7: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/7.jpg)
SYSTEM VULNERABILITY AND ABUSE
Wi-Fi Security Challenges
Figure 10-2 7Artificial Intelligent
![Page 8: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/8.jpg)
• Virus – rogue software program that attaches itself to other software programs or data files in order to be executed, usually without user knowledge or permission
• Worms – independent computer programs that copy themselves from one computer to other computer over a network. Can rely on their own without attaching to other computer program files, and spread rapidly.
• Trojan Horse – software program that appears to be benign but then does something other than expected. A way for virus or other malicious code to be introduced in a computer system.
• Spyware – Small programs that nstall themselves surreptitously on computers to monitor user web surfing activity and serve up advertising.
SYSTEM VULNERABILITY AND ABUSE
Malicious Software: Viruses, Worms, Trojan Horses, and Spyware
8Artificial Intelligent
![Page 9: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/9.jpg)
• Spoofing and Sniffers
• Denial of Service (DoS) Attacks
• Identity theft
• Cyberterrorism and Cyberwarfare
• Vulnerabilities from internal threats (employees); software flaws
SYSTEM VULNERABILITY AND ABUSE
Hackers and Cybervandalism
9Artificial Intelligent
![Page 10: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/10.jpg)
• Inadequate security and control may create serious legal liability.
• Businesses must protect not only their own information assets but also those of customers, employees, and business partners. Failure to do so can lead to costly litigation for data exposure or theft.
• A sound security and control framework that protects business information assets can thus produce a high return on investment.
BUSINESS VALUE OF SECURITY AND CONTROL
10Artificial Intelligent
![Page 11: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/11.jpg)
BUSINESS VALUE OF SECURITY AND CONTROL
Legal and Regulatory Requirements for Electronic Records Management
• Electronic Records Management (ERM): Policies,
procedures and tools for managing the retention,
destruction, and storage of electronic records
11Artificial Intelligent
![Page 12: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/12.jpg)
BUSINESS VALUE OF SECURITY AND CONTROL
Data Security and Control Laws:
• The Health Insurance Portability and Accountability Act (HIPAA)
• Gramm-Leach-Bliley Act
• Sarbanes-Oxley Act of 2002
12Artificial Intelligent
![Page 13: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/13.jpg)
• Electronic Evidence: Computer data stored on disks and
drives, e-mail, instant messages, and e-commerce
transactions
• Computer Forensics: Scientific collection, examination,
authentication, preservation, and analysis of computer data
for use as evidence in a court of law
BUSINESS VALUE OF SECURITY AND CONTROL
Electronic Evidence and Computer Forensics
13Artificial Intelligent
![Page 14: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/14.jpg)
General controls:
• Software and hardware
• Computer operations
• Data security
• Systems implementation process
ESTABLISHING FRAMEWORK FOR SECURITY MANAGEMENT STRATEGIES AND CONTROL
Types of Information Systems Controls
14Artificial Intelligent
![Page 15: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/15.jpg)
• Input
• Processing
• Output
Application controls:
ESTABLISHING FRAMEWORK FOR SECURITY MANAGEMENT STRATEGIES AND CONTROL
15Artificial Intelligent
![Page 16: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/16.jpg)
• Determines the level of risk to the firm if a specific activity or process is not properly controlled
Risk Assessment:
ESTABLISHING FRAMEWORK FOR SECURITY MANAGEMENT STRATEGIES AND CONTROL
16Artificial Intelligent
![Page 17: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/17.jpg)
• Consists of statements ranking information risks, identifying acceptable security goals, and identifying mechanisms for achieving these goals.
• Identity management – business process and software tools for identiying the valid users of a system and controlling their access to system resources.
Security Policy:
ESTABLISHING FRAMEWORK FOR SECURITY MANAGEMENT STRATEGIES AND CONTROL
17Artificial Intelligent
![Page 18: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/18.jpg)
Security Profiles for a Personnel System
Figure 10-5
ESTABLISHING FRAMEWORK FOR SECURITY MANAGEMENT STRATEGIES AND CONTROL
18Artificial Intelligent
![Page 19: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/19.jpg)
• Downtime: Period of time in which a system is not
operational
• Fault-tolerant computer systems: Redundant hardware,
software, and power supply components to provide
continuous, uninterrupted service
• High-availability computing: Designing to maximize
application and system availability
Disaster Recovery Plan and Business Continuity Plan
ESTABLISHING FRAMEWORK FOR SECURITY MANAGEMENT STRATEGIES AND CONTROL
19Artificial Intelligent
![Page 20: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/20.jpg)
• Disaster recovery planning: Plans for restoration of computing and communications disrupted by an event such as an earthquake, flood, or terrorist attack
• Business continuity planning: Plans for handling mission-critical functions if systems go down
Ensuring Business Continuity (Continued)
ESTABLISHING FRAMEWORK FOR SECURITY MANAGEMENT STRATEGIES AND CONTROL
20Artificial Intelligent
![Page 21: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/21.jpg)
• MIS audit: Identifies all of the controls that govern
individual information systems and assesses their
effectiveness
• Security audits: Review technologies, procedures,
documentation, training, and personnel
Auditing:
ESTABLISHING FRAMEWORK FOR SECURITY MANAGEMENT STRATEGIES AND CONTROL
21Artificial Intelligent
![Page 22: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/22.jpg)
Sample Auditor’s List of Control Weaknesses
Figure 10-6
ESTABLISHING FRAMEWORK FOR SECURITY MANAGEMENT STRATEGIES AND CONTROL
22Artificial Intelligent
![Page 23: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/23.jpg)
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Access Control
• Passwords
Authentication:
Access control: Consists of all the policies and procedures a company uses to prevent improper access to systems by unauthorized insiders and outsiders
• Tokens, smart cards
• Biometric authentication
23Artificial Intelligent
![Page 24: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/24.jpg)
• Firewalls: Hardware and software controlling flow of
incoming and outgoing network traffic
• Intrusion detection systems: Full-time monitoring tools
placed at the most vulnerable points of corporate networks
to detect and deter intruders
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Firewalls, Intrusion Detection Systems, and Antivirus Software
24Artificial Intelligent
![Page 25: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/25.jpg)
• Antivirus software: Software that checks computer systems
and drives for the presence of computer viruses and can
eliminate the virus from the infected area
• Wi-Fi Protected Access specification
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Firewalls, Intrusion Detection Systems, and Antivirus Software (Continued)
25Artificial Intelligent
![Page 26: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/26.jpg)
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
A Corporate Firewall
Figure 10-7 26Artificial Intelligent
![Page 27: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/27.jpg)
• Public key encryption: Uses two different keys, one private
and one public. The keys are mathematically related so that
data encrypted with one key can be decrypted using only the
other key
• Message integrity: The ability to be certain that the message
being sent arrives at the proper destination without being
copied or changed
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Encryption and Public Key Infrastructure
27Artificial Intelligent
![Page 28: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/28.jpg)
• Digital signature: A digital code attached to an electronically transmitted message that is used to verify the origin and contents of a message
• Digital certificates: Data files used to establish the identity of users and electronic assets for protection of online transactions
• Public Key Infrastructure (PKI): Use of public key cryptography working with a certificate authority
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Encryption and Public Key Infrastructure (Continued)
28Artificial Intelligent
![Page 29: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/29.jpg)
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Public Key Encryption
Figure 10-8 29Artificial Intelligent
![Page 30: Chapter 7 1Artificial Intelligent. OBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business](https://reader035.vdocuments.net/reader035/viewer/2022062409/5697bff71a28abf838cbe88e/html5/thumbnails/30.jpg)
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Digital Certificates
30Artificial Intelligent