Securing Information Systems Securing Information Systems
Securing Information Systems Securing Information Systems
Securing Information Systems Securing Information Systems
Systems
You’re on LinkedIn? Watch Out!
• Security:
• Policies, procedures and technical measures used to prevent
unauthorized access, alteration, theft, or physical damage to
information systems
• Controls:
• Methods, policies, and organizational procedures that ensure
safety of organization’s assets; accuracy and reliability of its
accounting records; and operational adherence to
management standards
System Vulnerability and Abuse
• Why systems are vulnerable
• Hardware problems
• Breakdowns, configuration errors, damage from improper use or
crime
• Software problems
• Programming errors, installation errors, unauthorized changes)
• Disasters
• Power failures, flood, fires, etc.
• Use of networks and computers outside of firm’s
control - . When data are available over a network, there are
even more vulnerabilities
• E.g., with domestic or offshore outsourcing vendors
System Vulnerability and Abuse
• E-mail attachments
1-10
The TJX Breach
• Factors that amplified severity of TJX security breach are:
– Personnel betrayal: An alleged FBI informant used insider information to
mastermind the attacks
– Management gaffe: Executives made conscious decisions not to upgrade
legacy systems that were vulnerable to security compromises
– Technology lapse: TJX used WEP, a insecure wireless security
technology
• failed to follow the most basic security measures like installing antivirus
software, upgrading wireless security, encrypting data, and creating and
using access controls, and establishing information system controls
(general and application).
– Procedural gaffes: TJX had received an extension on the rollout of
mechanisms that might have discovered and plugged the hole before
the hackers got in
• Also willfully violated the Payment Card Industry (PCI) Data Security
Standard by holding onto data for years
1-11
System Vulnerability and Abuse
• Malware (malicious software)
– Viruses
• Rogue software program that attaches itself to other
software programs or data files in order to be executed
– Worms
• Independent programs that copy themselves from one
computer to other computers over a network.
– Worms and viruses spread by
• Downloads (drive-by downloads)
• E-mail, IM attachments
• Downloads on Web sites and social networks
System Vulnerability and Abuse
• Malware (cont.)
– Smartphones as vulnerable as computers
• Study finds 13,000 types of smartphone malware
– Trojan horses
• Software that appears benign but does something other than
expected
• In 2004, users were enticed by a sales message from a supposed anti-
virus vendor.
• On the vendor’s site, a small program called Mitglieder was
downloaded to the user’s machine. The program
• Malware (cont.)
– Spyware
• Small programs install themselves surreptitiously on
computers to monitor user Web surfing activity and serve
up advertising
• Key loggers
– Record every keystroke on computer to steal serial numbers,
passwords, launch Internet attacks
• Other types:
– Reset browser home page
– Redirect search requests
– Slow computer performance by taking up memory
Cookies
• Cookie – a small file that contains information about you and
your Web activities, which a Web site places on your computer
• Handle cookies by using
– Web browser cookie management option
– Buy a program that manages cookies
• Not executable, cannot deliver a virus or other malicious code
• Only web server that delivered it can read it
• Your computer can store cookies from many web sites
• May be a security risk if it is implemented poorly on site that
you have shared personal information with and rely on cookies
to access it
– Anyone who can access the cookie on your hard drive can now access
that personal information
– Most reputable sites to not rely on cookies for authentication alone.
8-15
Hackers and Computer Crime
• Computer crime
• Defined as “any violations of criminal law that
involve a knowledge of computer technology for
their perpetration, investigation, or prosecution”
• Computer may be target of crime:
• Computer may be instrument of crime:
Examples of Computer Crime
• Click fraud
• Individual or computer program clicks online ad without any
intention of learning more or making a purchase
• Link farming
• a type of online advertising fraud where fraudsters attempt to
increase a page's results in organic search by creating a
series of bogus Web sites linking back to it
• Global threats - Cyberterrorism and cyberwarfare
• Concern that Internet vulnerabilities and other networks make
digital networks easy targets for digital attacks by terrorists,
foreign intelligence services, or other groups
Hackers and Computer Crime
•Spoofing
•Misrepresenting oneself by using fake e-mail addresses or
masquerading as someone else
•Redirecting Web link to address different from intended one, with site
masquerading as intended destination
•Sniffer / Packet sniffer
•Eavesdropping program that monitors information traveling over
network
•Enables hackers to steal proprietary information such as e-mail,
company files, and so on
• use your debit card information to purchase items illegally.
• steal your logon and passwords for various accounts.
• assume your identity.
System Vulnerability and Abuse
• Software vulnerability
• Commercial software contains flaws that create security
vulnerabilities
• Hidden bugs (program code defects)
• Zero defects cannot be achieved because complete testing is not
possible with large programs
• Flaws can open networks to intruders
• Patches
• Vendors release small pieces of software to repair flaws
• However, amount of software in use can mean exploits created faster
than patches be released and implemented
The cost to the U.S. economy from software flaws runs to nearly
$60 billion each year.
• Lack of security, control can lead to
• Loss of revenue
• Failed computer systems can lead to significant or total loss of business
function
• Lowered market value:
• Information assets can have tremendous value
• A security breach may cut into firm’s market value almost immediately
• Legal liability - U.S. Federal Trade Commission has sued companies for allowing hackers to
access systems and steal credit and debit card data for fraudulent purchase.
• Lowered employee productivity
• Higher operational costs
• What types of data have tremendous value or require protection? .
• individual confidential information (taxes, finances, medical records, job performance
reviews) and high-value data (trade secrets, new product development, marketing strategies,
government information).
Business Value of Security and Control
• Electronic evidence
• Evidence for white collar crimes often found in digital form
• Data stored on computer devices, e-mail, instant messages, e-commerce
transactions
• Proper control of data can save time, money when responding
to legal discovery request
• Computer forensics:
• Scientific collection, examination, authentication, preservation, and analysis of
data from computer storage media for use as evidence in court of law
• Includes recovery of ambient and hidden data
• Ambient data is information that lies in areas not generally accessible to the user: file
slack, unallocated clusters, virtual memory files and other areas not allocated to
active files. This is a forensic term that describes, in general terms, data stored in
non-traditional computer storage areas and formats.
Legal Action
• In a legal action, a firm is obligated to respond to a
discovery request for access to information that may be
used as evidence,
• and the company is required by law to produce this data.
• The cost of responding to a discovery request can be
enormous if the company has trouble assembling the
required data or the data have been corrupted or
destroyed.
• Courts impose severe financial and even criminal penalties
for improper destruction of electronic documents.
Establishing a Framework for Security and Control
• Information systems controls
• General controls
• controls are methods, policies, and organizational procedures that ensure safety of
organization’s assets; accuracy and reliability of its accounting records; and
operational adherence to management standards. There are two main types of
controls, general controls and application controls
• Govern design, security, and use of computer programs and data throughout
organization’s IT infrastructure
• Combination of hardware, software, and manual procedures to create overall control
environment
• Types of general controls
• Software controls
• Hardware controls
• Computer operations controls
• Data security controls
• Implementation controls
• Administrative controls
Establishing a Framework for Security and Control
• Application controls
• Specific controls unique to each computerized application, such as
payroll or order processing
• Include both automated and manual procedures
• Ensure that only authorized data are completely and accurately
processed by that application
• Types of application controls:
• Input controls - input authorization, data conversion, data editing,
and error handling
• Processing controls - establish that data are complete and
accurate during updating
• Output controls - ensure that the results of computer processing
are accurate, complete, and properly distributed
Establishing a Framework for Security and Control
• Risk assessment
• Determines level of risk to firm if specific activity or process is not
properly controlled
• Types of threat
• Probability of occurrence during year
• Potential losses, value of threat
• Expected annual loss
• Risk cost = probability X impact
• Security policy
• Ranks information risks, identifies acceptable security goals,
and identifies mechanisms for achieving these goals
• Drives other policies
• Acceptable use policy (AUP): Defines acceptable uses
of firm’s information resources and computing equipment
• Authorization policies: Determine differing levels of user
access to information assets
2. Business impact analysis identifies all critical business functions and the effect that a specific
disaster may have upon them.
• Management must determine
• Maximum time systems can be down
• Which systems must be restored first
This chart is a
sample page from a
list of control
weaknesses that an
auditor might find in
a loan system in a
local commercial
bank. This form
helps auditors
record and evaluate
control weaknesses
and shows the
results of discussing
those weaknesses
with management,
as well as any
corrective actions
taken by
management.
Technologies and Tools for Security
• Firms with heavy e-commerce processing or for firms that depend on digital networks for
their internal operations require high-availability computing, using tools such as backup servers,
distribution of processing across multiple servers, high-capacity storage, and good disaster
recovery and business continuity plans
Hot Site
• A hot site is a commercial disaster recovery service that allows a business to
continue computer and network operations in the event of a computer or
equipment disaster.
• If an firm’s data center becomes inoperable it can move all data processing
operations to a hot site.
• A hot site is a duplicate of the original site of the organization, with full
computer systems as well as near-complete backups of user data.
– The site has all the equipment needed for the enterprise to continue
operation, including office space and furniture, telephone jacks and
computer equipment.
• Real time synchronization between the two sites may be used to completely
mirror the data environment of the original site.
• Following a disruption to the original site, the hot site exists so that the
organization can relocate with minimal losses to normal operations.
• Ideally, a hot site will be up and running within a matter of hours or even less.
• Example – Hurricane Katrina - oil company hot sites
Cold Site
• A cold site is the most inexpensive type of backup site for an
organization to operate.
• Does not include backed up copies of data and information
from the original location of the organization,
• Does not include hardware already set up.
– The lack of hardware contributes to the minimal startup costs of the
cold site,
– Requires additional time following the disaster to have the operation
running at a capacity close to that prior to the disaster.
• Typically, a business has an annual contract with a company that
offers hot and cold site services with a monthly service charge.
• Some disaster recovery services offer backup services so that all
company data is available regardless of whether a hot site or
cold site is used.
Technologies and Tools for Security
• Recovery-oriented computing
• Designing systems that recover quickly with capabilities to help operators
pinpoint and correct of faults in multi-component systems
• Controlling network traffic- enables a network to sort low-priority data packets
from high-priority ones in order to improve performance for business critical
communication
• Deep packet inspection (DPI) - enables a network to sort low-priority data
packets from high-priority ones in order to improve performance for business
critical communication.
• Security outsourcing
• Managed security service providers (MSSPs)
• Ensuring software quality
• Software Metrics: Objective assessments of system in form of
quantified measurements
• Number of transactions
• Online response time
• Payroll checks printed per hour
• Known bugs per hundred lines of code
• Testing: Early and regular testing - WalkthTesting is complex and
requires various types of tests
• rough: Review of specification or design document by small group
of qualified people
• Debugging: Process by which errors are eliminated
• Majority of testing done by IS – error free, performance: response
time, throughput, accuracy
• Some testing done by end users – does the system meet the
functional requirements as originally described in the Requirements
document