Lecture 9 Term 2

1. Lecture 9 Term 2 6/3/12

2. Security and IS System Vulnerability and Abuse • Security: • Policies, procedures and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems • Controls: • Methods, policies, and organizational procedures that ensure safety of organization’s assets; accuracy and reliability of its accounting records; and operational adherence to management standards

3. System Vulnerability and Abuse • Why systems are vulnerable • Hardware problems • Breakdowns, configuration errors, damage from improper use or crime • Software problems • Programming errors, installation errors, unauthorized changes) • Disasters • Power failures, flood, fires, etc. • Use of networks and computers outside of firm’s control • E.g., with domestic or offshore outsourcing vendors

4. System Vulnerability and Abuse • Internet vulnerabilities • Network open to anyone • Size of Internet means abuses can have wide impact • Use of fixed Internet addresses with permanent connections to Internet eases identification by hackers • E-mail attachments • E-mail used for transmitting trade secrets • IM messages lack security, can be easily intercepted

5. System Vulnerability and Abuse Wi-Fi Security Challenges Figure 8-2 Many Wi-Fi networks can be penetrated easily by intruders using sniffer programs to obtain an address to access the resources of a network without authorization.

6. System Vulnerability and Abuse • Malicious software (malware) • Viruses: Rogue software program that attaches itself to other software programs or data files in order to be executed • Worms: Independent computer programs that copy themselves from one computer to other computers over a network • Trojan horses: Software program that appears to be benign but then does something other than expected • Spyware: Small programs install themselves surreptitiously on computers to monitor user Web surfing activity and serve up advertising • Key loggers: Record every keystroke on computer to steal serial numbers, passwords, launch Internet attacks

7. System Vulnerability and Abuse • Hackers and computer crime • Hackers vs. crackers • Activities include • System intrusion • Theft of goods and information • System damage • Cybervandalism • Intentional disruption, defacement, destruction of Web site or corporate information system

8. System Vulnerability and Abuse • Computer crime • Defined as “any violations of criminal law that involve a knowledge of computer technology for their perpetration, investigation, or prosecution” • Computer may be target of crime, e.g.: • Breaching confidentiality of protected computerized data • Accessing a computer system without authority • Computer may be instrument of crime, e.g.: • Theft of trade secrets • Using e-mail for threats or harassment

9. System Vulnerability and Abuse • Identity theft: Theft of personal Information (social security id, driver’s license or credit card numbers) to impersonate someone else • Phishing: Setting up fake Web sites or sending e-mail messages that look like legitimate businesses to ask users for confidential personal data. • Evil twins: Wireless networks that pretend to offer trustworthy Wi-Fi connections to the Internet • Pharming: Redirects users to a bogus Web page, even when individual types correct Web page address into his or her browser

10. System Vulnerability and Abuse • Click fraud • Individual or computer program clicks online ad without any intention of learning more or making a purchase • Global threats - Cyberterrorism and cyberwarfare • Concern that Internet vulnerabilities and other networks make digital networks easy targets for digital attacks by terrorists, foreign intelligence services, or other groups

11. System Vulnerability and Abuse • Internal threats – Employees • Security threats often originate inside an organization • Inside knowledge • Sloppy security procedures • User lack of knowledge • Social engineering: • Tricking employees into revealing their passwords by pretending to be legitimate members of the company in need of information

12. System Vulnerability and Abuse • Software vulnerability • Commercial software contains flaws that create security vulnerabilities • Hidden bugs (program code defects) • Zero defects cannot be achieved because complete testing is not possible with large programs • Flaws can open networks to intruders • Patches • Vendors release small pieces of software to repair flaws • However, amount of software in use can mean exploits created faster than patches be released and implemented

13. Business Value of Security and Control • Lack of security, control can lead to • Loss of revenue • Failed computer systems can lead to significant or total loss of business function • Lowered market value: • Information assets can have tremendous value • A security breach may cut into firm’s market value almost immediately • Legal liability • Lowered employee productivity • Higher operational costs

14. Business Value of Security and Control • Electronic evidence • Evidence for white collar crimes often found in digital form • Data stored on computer devices, e-mail, instant messages, e-commerce transactions • Proper control of data can save time, money when responding to legal discovery request • Computer forensics: • Scientific collection, examination, authentication, preservation, and analysis of data from computer storage media for use as evidence in court of law • Includes recovery of ambient and hidden data

15. Establishing a Framework for Security and Control • Information systems controls • General controls • Govern design, security, and use of computer programs and data throughout organization’s IT infrastructure • Combination of hardware, software, and manual procedures to create overall control environment • Types of general controls • Software controls • Hardware controls • Computer operations controls • Data security controls • Implementation controls • Administrative controls

16. Establishing a Framework for Security and Control • Application controls • Specific controls unique to each computerized application, such as payroll or order processing • Include both automated and manual procedures • Ensure that only authorized data are completely and accurately processed by that application • Types of application controls: • Input controls • Processing controls • Output controls

17. Technologies and Tools for Security • Antivirus and antispyware software: • Checks computers for presence of malware and can often eliminate it as well • Require continual updating • Unified threat management (UTM) • Comprehensive security management products • Tools include • Firewalls • Intrusion detection • VPNs • Web content filtering • Antispam software

18. Electronic Commerce • B2B e-commerce: New efficiencies and relationships • Electronic data interchange (EDI) • Computer-to-computer exchange of standard transactions such as invoices, purchase orders • Major industries have EDI standards that define structure and information fields of electronic documents for that industry • More companies increasingly moving away from private networks to Internet for linking to other firms • E.g., Procurement: Businesses can now use Internet to locate most low-cost supplier, search online catalogs of supplier products, negotiate with suppliers, place orders, etc.

19. Electronic Commerce Electronic Data Interchange (EDI) Companies use EDI to automate transactions for B2B e-commerce and continuous inventory replenishment. Suppliers can automatically send data about shipments to purchasing firms. The purchasing firms can use EDI to provide production and inventory requirements and payment data to suppliers. Figure 10-5

20. Electronic Commerce • Private industrial networks (private exchanges) • Large firm using extranet to link to its suppliers, distributors and other key business partners • Owned by buyer • Permits sharing of: • Product design and development • Marketing • Production scheduling and inventory management • Unstructured communication (graphics and e-mail)

21. Electronic Commerce A Private Industrial Network Figure 10-6 A private industrial network, also known as a private exchange, links a firm to its suppliers, distributors, and other key business partners for efficient supply chain management and other collaborative commerce activities.

22. Management Information Systems Chapter 10 E-Commerce: Digital Markets, Digital Goods Electronic Commerce • Net marketplaces (e-hubs) • Single market for many buyers and sellers • Industry-owned or owned by independent intermediary • Generate revenue from transaction fees, other services • Use prices established through negotiation, auction, RFQs, or fixed prices • May focus on direct or indirect goods • May support long-term contract purchasing or short-term spot purchasing • May serve vertical or horizontal marketplaces

23. Electronic Commerce A Net Marketplace Figure 10-7 Net marketplaces are online marketplaces where multiple buyers can purchase from multiple sellers.

24. Electronic Commerce • Exchanges • Independently owned third-party Net marketplaces • Connect thousands of suppliers and buyers for spot purchasing • Typically provide vertical markets for direct goods for single industry (food, electronics) • Proliferated during early years of e-commerce; many have failed • Competitive bidding drove prices down and did not offer long-term relationships with buyers or services to make lowering prices worthwhile

25. Intro to Databases • File organization concepts • Computer system organizes data in a hierarchy • Field: Group of characters as word(s) or number • Record: Group of related fields • File: Group of records of same type • Database: Group of related files • Record: Describes an entity • Entity: Person, place, thing on which we store information • Attribute: Each characteristic, or quality, describing entity • E.g., Attributes Date or Grade belong to entity COURSE

26. The Data Hierarchy A computer system organizes data in a hierarchy that starts with the bit, which represents either a 0 or a 1. Bits can be grouped to form a byte to represent one character, number, or symbol. Bytes can be grouped to form a field, and related fields can be grouped to form a record. Related records can be collected to form a file, and related files can be organized into a database. Figure 6-1

27. Problems with the traditional file environment (files maintained separately by different departments) • Data redundancy and inconsistency • Data redundancy: Presence of duplicate data in multiple files • Data inconsistency: Same attribute has different values • Program-data dependence: • When changes in program requires changes to data accessed by program • Lack of flexibility • Poor security • Lack of data sharing and availability

28. Database • Collection of data organized to serve many applications by centralizing data and controlling redundant data • Database management system • Interfaces between application programs and physical data files • Separates logical and physical views of data • Solves problems of traditional file environment • Controls redundancy • Eliminates inconsistency • Uncouples programs and data • Enables organization to central manage data and data security

29. Human Resources Database with Multiple Views A single human resources database provides many different views of data, depending on the information requirements of the user. Illustrated here are two possible views, one of interest to a benefits specialist and one of interest to a member of the company’s payroll department. Figure 6-3

30. Relational DBMS • Represent data as two-dimensional tables called relations or files • Each table contains data on entity and attributes • Table: grid of columns and rows • Rows (tuples): Records for different entities • Fields (columns): Represents attribute for entity • Key field: Field used to uniquely identify each record • Primary key: Field in table used for key fields • Foreign key: Primary key used in second table as look-up field to identify records from original table

31. Relational Database Tables A relational database organizes data in the form of two-dimensional tables. Illustrated here are tables for the entities SUPPLIER and PART showing how they represent each entity and its attributes. Supplier_Number is a primary key for the SUPPLIER table and a foreign key for the PART table. Figure 6-4A

32. Relational Database Tables (cont.) Figure 6-4B

33. Capabilities of Database Management Systems • Data definition capability: Specifies structure of database content, used to create tables and define characteristics of fields • Data dictionary: Automated or manual file storing definitions of data elements and their characteristics • Data manipulation language: Used to add, change, delete, retrieve data from database • Structured Query Language (SQL) • Microsoft Access user tools for generation SQL • Many DBMS have report generation capabilities for creating polished reports (Crystal Reports)

34. The Database Approach to Data Management Microsoft Access Data Dictionary Features Figure 6-6 Microsoft Access has a rudimentary data dictionary capability that displays information about the size, format, and other characteristics of each field in a database. Displayed here is the information maintained in the SUPPLIER table. The small key icon to the left of Supplier_Number indicates that it is a key field.

35. Complexity • A DBMS is a complex piece of software all users must fully understand it to make use of its functionalities • Cost of DBMS • The cost varies significantly depending on the environment and the functionality provided. Must take into consideration recurrent annual maintenance costs Some Drawbacks…