1 / 70

Chapter 1- Introduction

Chapter 1- Introduction. 1.1 The Birth of Computer Security. Data Security requirements The Network Criminal Hackers Hacker’s Prey Employee Passwords. 1.1.1 Data Security. Decentralized networks lend data vulnerable to intentional destruction, alteration, theft, and espionage.

misae
Download Presentation

Chapter 1- Introduction

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Chapter 1- Introduction

  2. 1.1 The Birth of Computer Security • Data Security requirements • The Network Criminal • Hackers • Hacker’s Prey • Employee Passwords

  3. 1.1.1 Data Security Decentralized networks lend data vulnerable to intentional destruction, alteration, theft, and espionage.

  4. 1.1.2 The Network Criminal The people who attack the vulnerability of data systems possess significant computer expertise and/or have access to sensitive data.

  5. 1.1.3 Hackers Most computer system intruders are not teenagers. Instead, most hackers are competitors who are stealing proprietary or sensitive government information.

  6. 1.1.4 Hackers’ Prey Hackers begin by persuading unsuspecting people to give away their passwords over the phone. Employees should be alerted to such scams.

  7. 1.1.5 Employee Passwords Employees use passwords to work on computer systems. Employers expect these passwords to be kept secret from others.

  8. 1.2 Ways to Secure Employee Secrets • Avoid common name • mix-n-match characters • store passwords wisely • change password often • avoid hackers scams

  9. 1.2.1 Avoid Common Names Common names associated with you are naturally easy for you to remember, but they are easily cracked.

  10. 1.2.2 Mix-n-Match Characters Make your password a mix of: • letters and numbers • upper and lower case • alphabetic and non-alphabetic characters not2hard JUST4u Han$on

  11. 1.2.3 Store Passwords Wisely Keep your password in your head or in a safe, not in an obvious location.

  12. 1.2.4 Change Password Often Changing your password should become a habit so that you lessen the chance of it becoming known to intruders.

  13. 1.2.5 Avoid Hacker Scams In these scams, the hacker poses as a person to whom you can confide your password. Regardless of the ruse, the wise user will not give their password to anyone.

  14. 1.3 Ways to Threaten Computer Security • Computer Crime • Credit Card Fraud • Data Communication Fraud • Unauthorized Access • Unlawful copying

  15. Computer Crime Computer crime includes: • Credit card fraud • Data communications fraud • Unauthorized access • Unlawful copying

  16. Credit Card Fraud Credit card customer numbers pass between public and private networks. Sometimes these numbers are captured by computer criminals and used to commit fraud.

  17. Data Communications Fraud This form of fraud involves the interception of network passwords or packets of data passing through networks.

  18. Unauthorized Access Hackers try to gain access to confidential employee records, company trade secrets and product pricing structures, and much more.

  19. Unlawful Copying This category of computer crime results in major losses for computer vendors.

  20. 1.4 Compromising Security • Without realizing it, employers and employees can compromise the security of their computer system. • Twelve examples are shown as follows:

  21. 1.4.1 A Disgruntled or Militant Employee Could… • Sabotage equipment or programs • Hold data or programs hostage

  22. 1.4.2 A Competitor Could… • Sabotage operations • Engage in espionage • Steal data or programs • Photograph records, documentation, or CRT screen displays

  23. 1.4.3. A Data Control Worker Could… • Insert data • Delete data • Bypass controls • Sell Information

  24. 1.4.4. A Clerk/Supervisor Could… • Forge or falsify data • Embezzle funds • Engage in collusion with people inside or outside the company

  25. 1.4.5. A System User Could… • Sell data to competitors • Obtain unauthorized information

  26. 1.4.6. An Operator Could… • Copy files • Destroy files

  27. 1.4.7. A User Requesting Reports Could… • Sell information to competitors • Receive unauthorized information

  28. 1.4.8. An Engineer Could… • Install “bugs” • Sabotage the system • Access security information

  29. 1.4.9. A Data Conversion Worker Could • Change codes • Insert data • Delete data

  30. 1.4.10. A Programmer Could… • Steal programs or data • Embezzle via programming • Bypass controls

  31. 1.4.11. A Report Distribution Worker Could… • Examine confidential reports • Keep duplicates of reports

  32. 1.4.12. A Trash Collector Could… • Sell reports or duplicates to competitors

  33. 1.5 Ways To Prevent Computer Crimes • Detecting • Prosecuting • Security • Authorised Access

  34. Detecting Computer Crime Most cases are discovered by accident—by actions having nothing to do with computers. The Computer Fraud and Abuse Act of 1986 has improved awareness of computer-related crimes in USA In Hong Kong, all under Criminal Acts - theft

  35. Prosecuting Computer Crime Eighty-five percent of detected computer crime is not reported. Prosecution is further hampered by law enforcement officers, attorneys, and judges who do not fully understand the nature of the violation.

  36. Security A system of safeguards is needed to protect a computer system and data from deliberant or accidental damage or access by unauthorized persons.

  37. Authorized Access To assure that only the right person is accessing the right computer system, various means have been developed based on: • What you have • What you know • What you do • What you are

  38. What You Have This means of authentication is based on your having a physical thing. It might be a key, badge, token, or plastic card.

  39. What You Know Many systems verify authorized access based on what you know. This might be a password, identification number, or the correct combination of numbers on locks.

  40. What You Do This mode of authorized access is based on something you do that is unique such as your signature.

  41. What You Are This security system uses biometrics—the science of measuring individual body characteristics. Fingerprints, retinal scans, and hand characteristics are examples of what you are.

  42. 1.6 Compromised Systems When a computer system has been compromised by a natural or man-made disaster, the resulting problems might include: • Loss of hardware • Loss of software • Loss of data

  43. 1.6.1 Recovery From Loss of Hardware There are various approaches to restoring computer processing operations: • revert to manual services. • temporarily use a service bureau. • mutual aid from another company. • pre-planned consortium facilities.

  44. 1.6.2 Recovery From Loss of Software Software security has been an industry concern for years. At risk here is who owns custom-made software.

  45. Custom Software Ownership Ownership depends on the programmer’s affiliation with the company whose software has been compromised.

  46. Company Ownership of Software If the programmer was employed by the company for whom the software was written, then the company owns the software.

  47. Programmer Ownership of Custom Software If the programmer was hired as a consultant, then ownership should have been addressed in the contract between the company and the programmer.

  48. 1.6.3 Recovery From Loss of Data To prevent theft or alteration of data, security techniques can include: • Secured waste • Internal controls • Auditor checks • Applicant screening • Passwords • Built-in software protection • Backup systems

  49. Secured Waste Discarded printouts, printer ribbons, and the like can be sources of data leaks to unauthorized persons. Paper shredders and locked trash barrels can secure these waste products.

  50. Internal Controls These are controls that are planned as part of the computer system. The transaction log is an example. This log records all successful or failed attempts to access certain data.

More Related