MIS 205 Chapter 8

Management Information Systems
MANAGING THE DIGITAL FIRM, 12TH EDITION
Chapter 8
SECURING INFORMATION
SYSTEMS

CHAPTER 8: SECURING INFORMATION SYSTEMS
Youre on Facebook? Watch Out!
Facebook worlds largest social network

Problem Identity theft and malicious software
Examples:
2009 18-month hacker scam for passwords, resulted
in Trojan horse download that stole financial data
Dec 2008 Koobface worm
May 2010 Spam campaigned aimed at stealing logins
Illustrates: Types of security attacks facing

consumers
Demonstrates: Ubiquity of hacking, malicious
software
Prentice Hall 2011

System Vulnerability and Abuse
Internet vulnerabilities
Network open to anyone
Size of Internet means abuses can have
wide impact
Use of fixed Internet addresses with
cable or DSL modems creates fixed
targets hackers
Unencrypted VOIP
E-mail, P2P, IM
Interception
Attachments with malicious software
Transmitting trade secrets
3
Prentice Hall 2011

Wireless security challenges

Radio frequency bands easy to scan
SSIDs (service set identifiers)
Identify access points
Broadcast multiple times
War driving
Eavesdroppers drive by buildings and try to detect
SSID and gain access to network and resources
WEP (Wired Equivalent Privacy)

Security standard for 802.11; use is optional
Uses shared password for both users and access
point
Users often fail to implement WEP or stronger
systems
4
Prentice Hall 2011

Malware (malicious software)

Viruses
Rogue software program that attaches itself
to other software programs or data files in
order to be executed
Worms
Independent computer programs that copy
themselves from one computer to other
computers over a network.
Trojan horses
Software program that appears to be benign
but then does something other than expected.
5
Prentice Hall 2011
Prentice Hall 2011

Malware (cont.)
Key loggers
Record every keystroke on computer to

steal serial numbers, passwords,
launch Internet attacks
Prentice Hall 2011

Hackers and computer crime

Hackers vs. crackers
Activities include
System intrusion
System damage
Cybervandalism
Intentional disruption,
defacement, destruction of Web
site or corporate information
system
8
Prentice Hall 2011

Spoofing
Redirecting Web link to address
different from intended one, with
site masquerading as intended
destination
Sniffer
Eavesdropping program that monitors
information traveling over network
Enables hackers to steal proprietary
information such as e-mail, company
files, etc.
9
Prentice Hall 2011
10
Prentice Hall 2011

Denial-of-service attacks (DoS)

Flooding server with thousands of
false requests to crash the network.
Botnets
Networks of zombie PCs infiltrated
by bot malware
Worldwide, 6 - 24 million computers
serve as zombie PCs in thousands of
botnets
11
Prentice Hall 2011
12
Prentice Hall 2011

Computer crime
Computer may be target of crime, e.g.:
Breaching confidentiality of protected
computerized data
Accessing a computer system without
authority
Computer may be instrument of crime,

e.g.:
Theft of trade secrets
Using e-mail for threats or harassment
13
Prentice Hall 2011

Phishing
Setting up fake Web sites or sending
e-mail messages that look like
legitimate businesses to ask users
for confidential personal data.
14
Prentice Hall 2011
From: Utdallas.edu Webmail Services <>

Date: July 20, 2012 2:00:44 AM CDT
To: undisclosed-recipients:;
Subject: Utdallas.edu Email Notification
This message is from utdallas.edu messaging center to all utdallas.edu email account
owners, We are removing access to all our Webmail clients.
Your email account will be upgraded to a new enhanced webmail user interface provided by
utdallas.edu.
Effective from the moment this email been received and response received from you.
Utdallas.edu will discontinue the use of our utdallas.edu Webmail and our utdallas.edu
webmail Lite interfaces.
To ensure your e-mail address book is saved in our database kindly enter your details
filled below:
Email.....
Password......
Re-confirm Password:
Date of Birth:
And send it back to us, which will enable us to transfer your contacts to our new Webmail
client database.
Yours Sincerely,
Utdallas.edu Webmail Services
Prentice Hall 2011
From: hannah muammar]

Sent: Tuesday, July 03, 2012 5:48 PM
Subject: Help From Hannah Gaddafi
I am Hannah Muammar Gaddafi a 27 years old Libyan
Medical Doctor, my late father a Colonel
Muammar Gaddafi formal President of Libya was killed
by the rebels in our hometown Sire on 20
October 2011 during the uprising in Libya. Dear
Sir/Madam, I will need your helping hands to move out
my money to any secure offshore account in overseas.
You can read more about my country Libya through the
link below,
http://www.dailymail.co.uk/ news/article222222222222222222222222
16
Prentice Hall 2011
From: On Behalf Of Citi-bank

Sent: Tuesday, February 28, 2012 5:12 AM
Subject: [purchasing] New (1) message(s)
Dear Citiclient (r)
Several failed log-in attempts were detected on your account.
To prevent any unauthorized access, we have disabled the
access.
To enable your account, please submit the attached document.
Best wishes,
Citi-bank Online Team
Note - Please do not reply to this email.
17
Prentice Hall 2011

Click fraud
Occurs when individual or computer
program fraudulently clicks on
online ad without any intention of
learning more about the advertiser
or making a purchase
18
Prentice Hall 2011

Internal threats: employees

Security threats often originate
inside an organization
Inside knowledge
Sloppy security procedures
User lack of knowledge
19
Prentice Hall 2011

Software vulnerability
Commercial software contains flaws that
create security vulnerabilities
Hidden bugs (program code defects)
Zero defects cannot be achieved because
complete testing is not possible with large
programs
Flaws can open networks to intruders
Patches
Vendors release small pieces of software
to repair flaws
However exploits often created faster
than patches be released and implemented
20
Prentice Hall 2011

Business Value of Security and Control
Electronic evidence
Evidence for white collar crimes often in
digital form
Data on computers, e-mail, instant messages,

e-commerce transactions
Proper control of data can save time and

money when responding to legal discovery
request
Computer forensics:
Scientific collection, examination,
authentication, preservation, and analysis
of data from computer storage media for use
as evidence in court of law
21
Prentice Hall 2011
THINGS WE CAN DO TO ADDRESS

SECURITY THREATS
22
Prentice Hall 2011

Establishing a Framework for Security and Control
Security policy
Ranks information risks, identifies
acceptable security goals, and
identifies mechanisms for achieving
these goals
Drives other policies
Acceptable use policy (AUP)
Defines acceptable uses of firms information
resources and computing equipment
Authorization policies
Determine differing levels of user access to
information assets
23
Prentice Hall 2011
completely automated public turing

test to tell computers and humans
apart
24
Prentice Hall 2011
25
Prentice Hall 2011

Disaster recovery planning: Devises

plans for restoration of disrupted
services
Business continuity planning:
Focuses on restoring business
operations after disaster
Both types of plans needed to
identify firms most critical
systems
26
Prentice Hall 2011

Firewall: A Software or Hardware based

network security that controls the
incoming and outgoing network traffic by
analyzing the data packets and determining
whether they should be allowed or not
based on a predefined set of rules
Barrier between a trusted, secure,
internal network and another network
(eg.the Internet), that is not expected to
be trusted or secure.
27
Prentice Hall 2011

How Firewalls work
28
Prentice Hall 2011

Technologies and Tools for Protecting Information Resources
Antivirus and antispyware software:

Checks computers for presence of
malware and can often eliminate it
as well
Require continual updating
Unified threat management (UTM)

systems
29
Prentice Hall 2011

Securing wireless networks

WEP security can provide some security by
Assigning unique name to networks SSID
and not broadcasting SSID
Using it with VPN technology
Wi-Fi Alliance finalized WPA2
specification, replacing WEP with
stronger standards
Continually changing keys
Encrypted authentication system with
central server
30
Prentice Hall 2011

Encryption:
Transforming text or data
into cipher text that cannot
be read by unintended
recipients
31
Prentice Hall 2011

Two methods of encryption

Symmetric key encryption
Sender and receiver use single,
shared key
Public key encryption
Uses two, mathematically related
keys: Public key and private key
Sender encrypts message with
recipients public key
Recipient decrypts with private key
32
Prentice Hall 2011


PUBLIC KEY ENCRYPTION
33
Prentice Hall 2011
Public Key Encryption

Two Keys
Public key: Can Encrypt only. Available
online or provided to the sender.
Private/Secret key: Can Decrypt only.
Exclusively available to receiver
Process
1. Sender encrypts data using Public
key and sends to receiver
2. Receiver decrypts data using
Private/Secret key
Prentice Hall 2011
34

MIS 205 Chapter 8

Uploaded by

Copyright:

Available Formats

MIS 205 Chapter 8

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

MIS 205 Chapter 8

Uploaded by

Copyright:

Available Formats

Management Information Systems

MANAGING THE DIGITAL FIRM, 12TH EDITION

Management Information Systems

Youre on Facebook? Watch Out!

Facebook worlds largest social network

Illustrates: Types of security attacks facing

Prentice Hall 2011

Management Information Systems

System Vulnerability and Abuse

Prentice Hall 2011

Management Information Systems

System Vulnerability and Abuse

Wireless security challenges

WEP (Wired Equivalent Privacy)

Prentice Hall 2011

Management Information Systems

System Vulnerability and Abuse

Malware (malicious software)

Prentice Hall 2011

Management Information Systems

Prentice Hall 2011

Management Information Systems

System Vulnerability and Abuse

Record every keystroke on computer to

Prentice Hall 2011

Management Information Systems

System Vulnerability and Abuse

Hackers and computer crime

Prentice Hall 2011

Management Information Systems

System Vulnerability and Abuse

Prentice Hall 2011

Management Information Systems

Prentice Hall 2011

Management Information Systems

System Vulnerability and Abuse

Denial-of-service attacks (DoS)

Prentice Hall 2011

Management Information Systems

Prentice Hall 2011

Management Information Systems

System Vulnerability and Abuse

Computer may be instrument of crime,

Prentice Hall 2011

Management Information Systems

System Vulnerability and Abuse

Prentice Hall 2011

Management Information Systems

From: Utdallas.edu Webmail Services <>

Prentice Hall 2011

Management Information Systems

From: hannah muammar]

Prentice Hall 2011

Management Information Systems

From: On Behalf Of Citi-bank

Prentice Hall 2011

Management Information Systems

System Vulnerability and Abuse

Prentice Hall 2011