Mis security system threads
- 2. DEFINITION: The protection of information and its elements including systems, hardware that use, store and transmit the information
- 3. PRIMARY GOALS CIA triangle known as security triad tells the primary goals of IS Confidentiality Making sure that those who should not see information Integrity Making sure that the information has not been changed from its original Availability Making sure that the information is available for use when you need it
- 4. SYSTEM SECURITY THREATS AND CONTROLS Viruses A computer virus is a software code that can multiply and propagate itself. A virus can spread into another computer via e-mail, downloading files from the Internet, or opening a contaminated file. It is almost impossible to completely protect a network computer from virus attacks; the CSI/FBI survey indicated that virus attacks were the most widespread attack for six straight years since 2000. Viruses are just one of several programmed threats or malicious codes (malware) in today’s interconnected system environment. Programmed threats are computer programs that can create a nuisance, alter or damage data, steal information, or cripple system functions. Programmed threats include, computer viruses, Trojan horses, logic bombs, worms, spam, spyware, and adware.
- 5. Insider Abuse of Internet Access Unfortunately, IT tools can be abused. For example, e-mail and Internet connections are available in almost all offices to improve productivity, but employees may use them for personal reasons, such as online shopping, playing games, and sending instant messages to friends during work hours. Laptop or Mobile Theft Because they are relatively expensive, laptops and PDAs have become the targets of thieves. Besides being expensive, they often contain proprietary corporate data, access codes to company networks, and sensitive information.
- 6. Denial of Service A denial of service (Do's) attack is specifically designed to interrupt normal system functions and affect legitimate users’ access to the system. Do's attacks can result in significant server downtime and financial loss for many companies, but the controls to mitigate the risk are very technical. Unauthorized Access to Information To control unauthorized access to information, access controls, including passwords and a controlled environment, are necessary. Computers installed in a public area, such as a conference room or reception area, can create serious threats and should be avoided if possible. Employees should be allowed to access only the data necessary for them to perform their jobs.
- 7. System Penetration Hackers penetrate systems illegally to steal information, modify data, or harm the system. The following factors are related to system penetration: System holes: the design deficiency of operating systems or application systems that allow hijacking, security bypass, data manipulation, privilege escalation, and system access. Port scanning: a hacking technique used to check TCP/IP ports to reveal the services that are available and to identify the weaknesses of a computer or network system in order to exploit them. Network sniffing: a hardware and software program to collect network (traffic) data in order to decipher passwords with password-cracking software, which may result in unauthorized access to a network system. IP spoofing: a technique used to gain unauthorized access to computers, whereby hackers send messages to a computer with a deceived IP address as if it were coming from a trusted host. Back door/trap door: a hole in the security of a computer system deliberately left in place by designers or maintainers. Tunneling: a method for circumventing a firewall by hiding a message that would be rejected by the firewall inside another, acceptable
- 8. Abuse of Wireless Networks Wireless networks offer the advantage of convenience and flexibility, but system security can be a big issue. Attackers do not need to have physical access to the network. Attackers can take their time cracking the passwords and reading the network data without leaving a trace. Telecom Fraud In the past, telecom fraud involved fraudulent use of telecommunication (telephone) facilities. Intruders often hacked into a company’s private branch exchange (PBX) and administration or maintenance port for personal gains, including free long-distance calls, stealing (changing) information in voicemail boxes, diverting calls illegally, wiretapping, and eavesdropping.
- 9. Theft of Proprietary Information Information is a commodity in the e-commerce era, and there are always buyers for sensitive information, including customer data, credit card information, and trade secrets. Data theft by an insider is common when access controls are not implemented. Outside hackers can also use “Trojan” viruses to steal information from unprotected systems. Beyond installing firewall and anti-virus software to secure systems, a company should encrypt all of its important data. Financial Fraud The nature of financial fraud has changed over the years with information technology. System-based financial fraud includes scam e-mails, identity theft, and fraudulent transactions. With spam, con artists can send scam e-mails to thousands of people in hours.
- 10. Misuse of Public Web Applications The nature of e-commerce—convenience and flexibility—makes Web applications vulnerable and easily abused. Hackers can circumvent traditional network firewalls and intrusion-prevention systems and attack web applications directly. They can inject commands into databases via the web application user interfaces and surreptitiously steal data, such as customer and credit card information. Website Defacement Website defacement is the sabotage of webpages by hackers inserting or altering information. The altered webpages may mislead unknowing users and represent negative publicity that could affect a company’s image and credibility.
- 11. Company Awareness Business operations can be disrupted by many factors, including system security breaches. System downtime, system penetrations, theft of computing resources, and lost productivity have quickly become critical system security issues. The financial loss of these security breaches can be significant. In addition, system security breaches often taint a company’s image and may compromise a company’s compliance with applicable laws and regulations. The key to protecting a company’s accounting information system against security breaches is to be well prepared for all possible major threats. A combination of preventive and detective controls can mitigate security threats.
- 13. BIBLIOGRAPHY: http://www.nysscpa.org/cpajournal/2006/706/essentials/p 58.htm By P. Paul Lin, PhD, is an associate professor of accounting at the Raj Soin College of Business of Wright State University, Dayton, Ohio.