Presentation MIS

SECURTIY &CONTROL OF
INFORMATION SYSTEM
Cyber security
Cyber security is the body of technologies,
processes and practices designed to protect
network, computer, programs and data from
atacak, damage, or unauthorized
Cyber crime
• Cyber crime encompasses any criminal act
dealing with computers and network (called
hacking). Additionally, cyber crime also
includes traditional crimes conducted through
the internet.
threats
• A threat is any potential danger to information
and systems
• 3 levels of cyber threats
- Unsturctured
- Structured
- Highly structured
Unstructured threats
• Individual/small group winth little or no
organization or funding
• Easily detectable information gathering
• Exploitations based upon documented flaws
• Targets of opportunity
• Gain control of machines
• Motivated by bragging right, thrills, access to
resources
Structured threats
• Well organized, planned and funded
• Specific targets and extensive information
gathering to choose avenue and means of attack
• Goal-data stored on machines or machines
themselves
• Exploitation may rely on insider help of unknown
flaw
• Target drives attack
• Organized crime/ black hat hackers
Highly structured threat
• Extensive organization, funding and planning over
an extended rime, with goal of having an effect
beyond the data or machine being attacked
• Stealthy information gathering
• Multiple attacks exploiting unknown flaws or
insider help
• Coordinated efforts from multiple groups
• “cyber warfare”
Categories of Cyber Crime
• The computer as a target : using a computer
to attacks other computer
Example: hacking, virus/worms attack, do’s
attack etc.
• The computer as a weapon : using a computer
to commit real world crime
Example: cyber terrorism, credit card fraud, etc
Cyber Crime Variants
• Hacking
“Hacking” is a crime, which entails cracking
systems and gaining unauthorized access to data
stored in them.
• Cyber squatting
• Cyber squatting is the act of registering a
famous domain naname and then selling it for
a fortune.
Phising
• Phising is just one of the many frauds on the
internet, trying to fool people into parting
with their money. Phising refers to receipt of
unsolicited emails by custumers of Financial
Institutions, requesting them to enter their
username, password or other personal
information to access their account for some
reason.
Cyber Stalking
• Cyber stalking is use of the internet or other
electronic means to stalk someone. This term
is used interchangeably with online
harassment and online abuse.
Vishing
• Is the criminal practice of using social
engineering and voice over IP to gain access to
private personal and financial information
from the public for the purpose of financial
reward. Vishing exploits the publics’s trust in
landline telephone service.
Classification of Information Security System
According to David Icove :

• Physical Security
• Personel Security
• Operation Security
• Data, Media and Communication Technique
Security
Based on Function
• Network Security : Focus on Information
Carriers
• Application Security : Focus on the application
itself
• Computer Security : Focus on the safety of the
computer (end system)
Access Control
• User Identification
• User Authentification
• User Authorization
Service of System Security
• Privacy/Confidentiality
Sensitive (privacy) data Protection.
Attack : Sniffer.
• Integrity
Information does not change without
permission.(tampered, altered, modified)
Attack : Spoof, Virus, Trojan Horse.
• Authentication
Ensuring the authenticity of data, data sources, people accesing data
Servers used. Facilitated by the use of digital signatures and biometrics.
Attack : Fake Password.
• Availability
Information must be available when needed.
Attack : Denial of Service (DoS)
Service of system Securtiy (Cont’d)
• Non-repudiation
Cannot deny (has made a transaction)
- Using a digital signatures
- Need to Regulate legal issues
• Access Control
- Use a Password
- Classification
System Security Examiner
• Crack
To guess or crack the password by using a
Dictionary by Brute Force Cracking
• Land & latierra
Program that can make the Windows 95 / NT
system freeze (hang, lock up), by sending a
packet that has been spoofed so as if it came
from the same machine.
• Ping-o-death
A program (ping) that can crash Windows 95 / NT
and some versions of UNIX.
• Winuke
Program for blocking windows based systems
Network Monitoring System
Network monitoring is used to detect security
holes, including : being able to detect people
who are not authorized to access the server in
the internal system, and the location of access
from other places and efforts to disable the
system by sending excessive number of
packages (Denial of Service attack – DoS).
Network Monitoring System
(Cont’d)
Examples of Network Monitoring Program:
• Etherboy (windows) , Etherman (UNIX)
• HP openview (windows)
• Packetboy (windows), packetman (UNIX)
• SNMP collector (windows)
• Webboy (windows)
• Iptraf
• Netwatch
CBIS Control Duties
Includes all phases of the life cycle, during which
the life cycle is divided into controls related to
system development, design and operation
Methods for obtaining and maintaining CBIS
control:
1. Management can exercise direct control
2. Management controls CBIS indirectly through
continuous CIO
3. Management controls CBIS indirectly
regarding the project through a third party
Development Process Control
To ensure that the implemenyted CBIS can meet
the needs of users or go according to plan.
• Planning Phase
Defining goals and constraints
• Analysis and Design Phase
Identify informations needs and determine
appearance criteria
Continue
• Implementation Phase
Define an acceptable testing program
• Operation and control phase
Ensure that the implemented CBIS can meet the
needs
System Design Controls
- The aim is to ensure that the design can
minimize errors, detect errors and correct
them.
- Control should not be applied if the costs are
greater than the benefits. Value or benefit is
the level of risk reduction s
System Design Controls
1. Transaction Origination (recording one or
more data elements in the source document)
 Beginning of sources documentation
Authority
Making computer input
Error handling
Retention of source documentation
2. Transaction Entry (convert source document
data into a form that can read by computer)
Data Entry
Data Verification ( Key Verification & Sight
Verification)
 Error Handling
Batch Balancing
3. Data Communication
 The responsibility of the network manager
by combining security measures inward
system and monitor appearance to ensure
safety has been done with well
 Data Transmission Control
 Control Channel Communication
 Overall Datacom Security Plan
4. Computer Processing (Attributed to data input
to a computer and built into programs and
databases):
 Data Handling
 Error Handling
 Database and Software Library
5. Computer Output (This subsystem component
is responsible for sending the finished product
to the user)
 Control Distribution
 User Department Balancing
 Error Handling
 Record Deviation
 Balancing Computer Operations
Control of System Operation
Control of operating the system is intended to achieve efficiency and security.
The controls that contribute to this goal can be classified into 5 areas:
• Organizational structure Information service staff are organized according
to their fields of specialization. Analysis,Programmers, and operating
personnel are usually separated and only develop skills needed for the
area of work itself.
• Library control The computer library is the same as the book library, where
there are librarians, media collectors, media storage areas and procedures
to use the media.
• Equipment Maintenance People whose job is to repair computers called
Customers Engineer (CE) / Field Engineer (FE) / Field Technicians carry out
scheduled maintenance / unscheduled.
Continue
• Environmental control and facility safety To maintain
investment conditions are needed special environments
such as computer rooms must be clean, security
facilities must be done by locking equipment and
computer rooms.
• Disaster planning
a. Emergency Plan.
b. Backup Plan.
c. Important Record Plan.
d. Recovery Plan.

Presentation MIS

Uploaded by

Copyright:

Available Formats

Presentation MIS

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Presentation MIS

Uploaded by

Copyright:

Available Formats

SECURTIY &CONTROL OF

According to David Icove :

You might also like