Information Security

1. Information Security EDU 5815

2. EDU 5815 IT Security Terms

3. EDU 5815

4. EDU 5815 Organizational needs for security and control • Importance of keeping all of the resources, virtual as well as physical, secure from both inside and outside threats • Two critical issues must be addressed: • Security vs. individual rights • Security vs. availability

5. EDU 5815 Security vs. individual rights • Implement adequate security and control measures that do not infringe on the individual rights guaranteed by the constitution

6. EDU 5815 Security vs. availability • Prominent in the medical area • Concerns over the privacy of the individuals’ records are receiving attention

7. EDU 5815 Objective of Information Security • Confidentiality • Availability • Integrity

8. EDU 5815 Confidentiality • The organization seek to protect its data and information from disclosure to unauthorized persons. • Executive information systems, human resources information systems, and such transaction processing systems as payroll, accounts receivable, purchasing, and accounts payable are especially critical in this regard.

9. EDU 5815 Availability • The purpose of the organization’s information infrastructure is to make its data and information available to those who are authorized to used it. • This objective is especially important to information-oriented systems such as human resources information systems

10. EDU 5815 Integrity • All the information systems should provide an accurate representation of the physical systems that they represent.

11. EDU 5815 System Vulnerability • A universal vulnerability is a state in a computing system which either: allows an attacker to execute commands as another user; allows an attacker to access data that is contrary to the access restrictions for that data; allows an attacker to pose as another entity; or allows an attacker to conduct a denial of service. • An exposure is a state in a computing system (or set of systems) which is not a universal vulnerability, but either: allows an attacker to conduct information gathering activities; allows an attacker to hide activities; includes a capability that behaves as expected, but can be easily compromised; is a primary point of entry that an attacker may attempt to use to gain access to the system or data; and is considered a problem according to some reasonable security policy.

12. EDU 5815 System Vulnerability Continued The vulnerability of information systems is increasing as we move to a world of networked and especially wireless computing. Theoretically, there are hundreds of points in a corporate information system that can be subject to some threats. • These threats can be classified as: • Unintentional • Human errors • Environmental hazards • Computer system failures • Intentional • Theft of data • Inappropriate use of data • Theft of mainframe computer time • Theft of equipment and/or programs

13. EDU 5815 System Vulnerability Continued • Intentional continued • Deliberate manipulation in handling • Entering data • Processing data • Transferring data • Programming data • Labor strikes • Riots • Sabotage • Malicious damage to computer resources • Destruction from viruses and similar attacks • Miscellaneous computer abuses • Internet fraud. • Terrorists’ attack

14. EDU 5815 Threats • An information security threat is a person, organization, mechanism, or event that has potential to inflict harm on the organization’s information resources. • Threats can be internal as well as external, and they can be accidental as well as intentional.

15. EDU 5815 Type of threats • A virus is one example of a type of software that bears the name malicious software • Malicious software or malware consists of complete programs or segments of code that can invade a system and perform functions not intended by the system owners • In addition to viruses, there are worms, Trojan horses, adware, and spyware

16. EDU 5815 Type of threats • A virus is a computer program that can replicate itself without being observable and embed copies of itself in other programs and boot sectors • A worm cannot replicate itself within a system, but it can transmit its copies by means of email

17. EDU 5815 Type of threats • A Trojan horse can neither replicate nor distribute itself; users distributes it as utility. • When the utility is used, it produced unwanted changes in the system’s functionality.

18. EDU 5815 Type of threats • Adware generates intrusive advertising messages • Spyware gathers data from the user’s machine

19. EDU 5815

20. EDU 5815 Risks • Information security risk is a potential undesirable outcome of a breach of information security by an information security threat • All risks represent unauthorized acts

21. EDU 5815 Four type of risks • Unauthorized Disclosure and Theft • When the database and software library are made available to persons not entitled to have access • The result can be the loss of information or money • Unauthorized Use • When persons who are not ordinarily entitled to use the organization’s resources are able to do so • hacker

22. EDU 5815 Four type of risks • Unauthorized Destruction and Denial of Service • Individuals can damage or destroy hardware or software, causing the organization’s computer operation to shut down • Unauthorized Modification • Changes been made to the data, information and software. • Changes go unnoticed and cause the users of the system outputs to make the wrong decisions

23. EDU 5815 Challenges and Ethics of IT • Application of IT • Customer relationship management • Human resources management • Business intelligence systems • Potential Harm • Infringements on privacy • Inaccurate information • Collusion

24. EDU 5815 Challenges and Ethics of IT • Possible Responses

25. EDU 5815 Protecting Information Resources Information security problems are increasing rapidly, causing damage to many organizations. Protection is expensive and complex. Therefore, companies must not only use controls to prevent and detect security problems, they must do so in an organized manner. An approach similar to TQM (total quality management) would have the following characteristics: • Aligned. The program must be aligned with organizational goals. • Enterprisewide. Everyone in the organization must be included. • Continuous. The program must be operational all the time. • Proactive. Use innovative, preventive, and protective measures. • Validated. The program must be tested to ensure it works. • Formal. It must include authority, responsibility & accountability.

26. EDU 5815 Difficulties –Protecting (discussion)

27. EDU 5815 Defense Strategy-Protecting • The major objectives of a defense strategy are: • Prevention and deterrence. • Detection. • Limitation of damage. • Recovery. • Correction • Awareness and compliance

28. EDU 5815 Defense Strategy-Controls Any defense strategy involves the use of several controls. These controls are divided into two categories general controlsthatprotect the system regardless of the specific application and applicationcontrolsthat safeguard specific applications. Application General

29. EDU 5815 Defense Strategy–Internet Security The major objective of border security is access control. Then authentication or proof of identity and finally authorizationwhich determine the action or activities a user is allowed to perform. Security Layers

30. EDU 5815 Ethical Responsibilities • What uses of IT might be considered improper or harmful to other individuals or society? • What is the proper use of the Internet or organization's IT resources? • How can you protect yourself from computer crime?