Chapter 10, part 1
- 1. TECHNOLOGICAL SAFEGUARDS •There are six commonly used methods in which technology is employed to safeguard information systems
- 2. PHYSICAL ACCESS RESTRICTIONS • Organizations can prevent unauthorized access to information systems by keeping stored information safe and allowing access only to those employees who need it to do their jobs. • The most common form of authentication is the use of passwords, which are effective only if chosen carefully and changed frequently. • Access is usually limited by making it dependent on one of the following: – Something You Have: Keys, picture identification cards, smart cards – Something You Know: passwords, PINs, answers to secret questions – Something You Are: fingerprints, voice patterns, biometrics
- 3. PHYSICAL ACCESS RESTRICTIONS • Biometrics is a form of authentication used to govern access to systems, data, and/or facilities. With biometrics, employees may be identified by fingerprints, retinal patterns, or other bodily characteristics. • A virtual private network (VPN) is a network connection that is constructed dynamically within an existing network—often called a secure tunnel—in order to connect users or nodes. • The practice of creating an encrypted “tunnel” to send secure (private) data over the (public) Internet is known as tunneling.
- 4. FIREWALLS
- 5. ENCRYPTION • When you do not have access to a secure channel for sending information over a wired or wireless network, encryption is the best bet for keeping snoopers out. • Encryption is the process of encoding messages before they enter the network or airwaves, then decoding them at the receiving end of the transfer so that the intended recipients can read or hear them. The process works because if you scramble messages before you send them, eavesdroppers who might intercept them cannot decipher them without the decoding key. • Implementing encryption on a large scale, such as on a busy Web site, requires a third party,
- 6. VIRUS MONITORING AND PREVENTION • Purchase and install antivirus software, then update frequently to be sure you are protected against new viruses. • Do not use flash drives, disks, or shareware from unknown or suspect sources and be equally careful when downloading material from the Internet, making sure that the source is reputable. • Delete without opening any e-mail message received from an unknown source. Be especially wary of opening attachments. • Do not blindly open e-mail attachments, even if they come from a known source. Many viruses are spread without the sender’s knowledge, so it is better to check with the sender before opening a potentially unsafe attachment. • If your computer system contracts a virus, report the infection to your school or company’s IT department so that appropriate measures can be taken.
- 7. AUDIT-CONTROL SOFTWARE • Audit-control software is used to keep track of computer activity so that auditors can spot suspicious activity and take action. Any user leaves electronic footprints that auditors can trace. Audit- control software helps creating an audit trail, a record showing who has used a computer system and how it was used.
- 9. SECURE DATA CENTERS: SECURING THE FACILITIES INFRASTRUCTURE • Backup Sites – duplication. A cold backup site is nothing more than an empty warehouse with all necessary connections for power and communication but nothing else. In the case of a disaster, a company has to first set up all necessary equipment, ranging from office furniture to Web servers. A hot backup site is a fully equipped backup facility, having everything from office chairs to a one-to-one replication of the most current data. Further, hot backup sites also have a redundant backup of the data so that the business processes are interrupted as little as possible. To achieve this redundancy, all data are mirrored on separate servers. • Redundant Data Centers – separation. Often, companies choose to replicate their data centers in multiple locations. Events such as a hurricane can damage systems that are located across town from each other. Thus, even if the primary infrastructure is located in-house, it pays to have a backup located in a different geographic area to minimize the risk of a disaster happening to both systems.
- 10. HUMAN SAFEGUARDS • In addition to the technological safeguards, there are various human safeguards that can help to safeguard information systems, specifically ethics, laws, and effective management. • Educating potential users at an early age as to what constitutes appropriate behavior can help, but unethical users will undoubtedly always remain a problem for those wanting to maintain IS security. • Additionally, there are numerous federal and state laws against unauthorized use of networks and computer systems. Unfortunately, individuals who want unauthorized access to networks and computer systems usually find a way to exploit them; often, after the fact, laws are enacted to prohibit that activity in the future.
- 11. COMPUTER FORENSICS • As computer crime has gone mainstream, law enforcement has had to become much more sophisticated in their computer crime investigations. Computer forensics is the use of formal investigative techniques to evaluate digital information for judicial review. • Organizations and governments are increasingly utilizing honeypots to proactively gather intelligence to improve their defenses or to catch cybercriminals. • A honeypot is a computer, data, or network site that is designed to be enticing to hackers so as to detect, deflect, or counteract illegal activity. • Additionally, beyond human and technological safeguards, the quality of information security in any organization depends on effective management. Managers must continuously check for security problems, recognize that holes in security exist, and take appropriate action.
- 12. DEVELOPING AN IS SECURITY • Risk Analysis. PLAN – Determine the value of electronic information – Assess threats to confidentiality, integrity, and availability of information – Determine which computer operations are most vulnerable to security breaches – Assess current security policies – Recommend changes to existing practices and/or policies that will improve computer security –
- 13. DEVELOPING AN IS SECURITY PLAN • Policies and Procedures. Once risks are assessed, a plan should be formulated that details what action will be taken if security is breached. – Information Policy. Outlines how sensitive information will be handled, stored, trans- mitted, and destroyed. – Security Policy. Explains technical controls on all organizational computer systems, such as access limitations, audit-control software, and firewalls. – Use Policy. Outlines the organization’s policy regarding appropriate use of in-house computer systems. – Backup Policy. Explains requirements for backing up information. – Account Management Policy. Lists procedures for adding new users to systems and removing users who have left the organization. – Incident Handling Procedures. Lists procedures to follow when handling a security breach. – Disaster Recovery Plan. Lists all the steps an organization will take to restore computer operations in case of a natural or deliberate disaster.
- 15. DESIGNING THE RECOVERY PLAN • When planning for disaster, two objectives should be considered by an organization: recovery time and recovery point objectives. – Recovery time objectives specify the maximum time allowed to recover from a catastrophic event. Having completely redundant systems minimizes the recovery time and are best suited for mission-critical applications, such as e-commerce transaction servers. For other applications, such as data mining, while important, the recovery time can be longer without disrupting primary business processes. – Recovery point objectives specify how current the backup data should be. Imagine that your computer’s hard drive crashes while you are working on a term paper. Luckily, you recently backed up your data. Would you prefer the last backup to be a few days old, or would you rather have the last backup include your most recent changes to the term paper? Having completely redundant systems that mirror the data helps to minimize (or even avoid) data loss in the event of a catastrophic failure.
- 16. RESPONDING TO A SECURITY BREACH • Organizations that have developed a comprehensive IS security plan have the ability to rapidly respond to any type of security breach to their IS resources or to a natural disaster. • In addition to restoring lost data using backups, common responses to a security breach include performing a new risk audit and implementing a combination of additional (more secure) safeguards. • Additionally, when intruders are discovered, organizations can contact local law enforcement agencies and the FBI for assistance in locating and prosecuting them. Several online organizations issue bulletins to alert organizations and individuals to possible software vulnerabilities or attacks based on reports from organizations when security breaches occur.
- 17. THE STATE OF SYSTEMS SECURITY MANAGEMENT • Financial fraud attacks result in the greatest financial losses for organizations; other significant costs were due to viruses, data theft, unauthorized access, and denial-of-service attacks. • Relatively few organizations (about 29 percent) report computer intrusions to law enforcement because of various fears, such as how negative publicity would hurt stock values or how competitors might gain an advantage over news of a security incident. • Most organizations do not outsource security activities. • Nearly all organizations conduct routine and ongoing security audits. • The majority of organizations believed security training of employees is important, but most respondents said their organization did not spend enough on security training.
- 18. INFORMATION SYSTEMS CONTROLS, AUDITING, AND THE SARBANES- OXLEY ACT • Preventive controls • Detective controls • Corrective controls
- 19. IS AUDITING • Analyzing the IS controls should be an ongoing process for organizations. However, often it can be beneficial for organizations to periodically have an external entity review the controls so as to uncover any potential problems. • An information systems audit, often performed by external auditors, can help organizations assess the state of their IS controls to determine necessary changes and to help ensure the information systems’ availability, confidentiality, and integrity. • The response to the strengths and weaknesses identified in the IS audit is often determined by the potential risks an organization faces. Testing all controls under all possible conditions is very inefficient and often infeasible. Thus, auditors frequently rely on computer-assisted auditing tools, or specific software that tests applications and data using test data or simulations. • In addition to using specific auditing tools, auditors use audit sampling procedures to assess the controls, enabling the audit to be conducted in the most cost-effective manner. Once the audit has been performed and sufficient evidence has been gathered, reports are issued to the organization.
- 20. THE SARBANES-OXLEY ACT • Another major factor that has contributed to a high demand for IS auditors is the need to comply with government regulations, most notably the Sarbanes-Oxley Act of 2002 (S-OX). • Formed as a reaction to large-scale accounting scandals that led to the downfall of corporations such as WorldCom and Enron, S-OX addresses primarily the accounting side of organizations. According to S-OX, companies have to demonstrate that there are controls in place to prevent misuse or fraud, controls to detect any potential problems, and effective measures to correct any problems. • The IS architecture plays a key role in S-OX compliance, given that many controls are IS based, providing capabilities to detect information exceptions and to provide a management trail for tracing exceptions. However, S-OX itself barely addresses IS controls specifically; rather, it addresses general processes and practices, leaving companies wondering how to comply with the guidelines put forth in the act. • Failure to present such documents in the case of litigious activity can lead to severe fines being imposed on companies and their executives, and courts usually will not accept the argument that a message could not be located.