Chapter 8 Securing Information Systems 8 1 2007

  • Slides: 12
Download presentation
Chapter 8 Securing Information Systems 8. 1 © 2007 by Prentice Hall

Chapter 8 Securing Information Systems 8. 1 © 2007 by Prentice Hall

Management Information Systems Chapter 8 Securing Information Systems LEARNING OBJECTIVES • Analyze why information

Management Information Systems Chapter 8 Securing Information Systems LEARNING OBJECTIVES • Analyze why information systems need special protection from destruction, error, and abuse. • Assess the business value of security and control. • Design an organizational framework for security and control. • Evaluate the most important tools and technologies for safeguarding information resources. 8. 2 © 2007 by Prentice Hall

Management Information Systems Chapter 8 Securing Information Systems Phishing: A Costly New Sport for

Management Information Systems Chapter 8 Securing Information Systems Phishing: A Costly New Sport for Internet Users • Problem: Large number of vulnerable users of online • • 8. 3 financial services, ease of creating bogus Web sites. Solutions: Deploy anti-phishing software and services and a multilevel authentication system to identify threats and reduce phishing attempts. Deploying new tools, technologies, and security procedures, along with educating consumers, increases reliability and customer confidence. Demonstrates IT’s role in combating cyber crime. Illustrates digital technology as part of a multilevel solution as well as its limitations in overcoming discouraged consumers. © 2007 by Prentice Hall

Management Information Systems Chapter 8 Securing Information Systems Vulnerability and Abuse • Why systems

Management Information Systems Chapter 8 Securing Information Systems Vulnerability and Abuse • Why systems are vulnerable • Internet vulnerabilities • Wireless security challenges • Malicious software: Viruses, worms, Trojan horses, and spyware • Hackers and cybervandalism • Spoofing and sniffing • Denial-of-service attacks 8. 4 © 2007 by Prentice Hall

Management Information Systems Chapter 8 Securing Information Systems Vulnerability and Abuse Contemporary Security Challenges

Management Information Systems Chapter 8 Securing Information Systems Vulnerability and Abuse Contemporary Security Challenges and Vulnerabilities The architecture of a Web-based application typically includes a Web client, a server, and corporate information systems linked to databases. Each of these components presents security challenges and vulnerabilities. Floods, fires, power failures, and other electrical problems can cause disruptions at any point in the network. Figure 8 -1 8. 5 © 2007 by Prentice Hall

Management Information Systems Chapter 8 Securing Information Systems Vulnerability and Abuse Worldwide Damage from

Management Information Systems Chapter 8 Securing Information Systems Vulnerability and Abuse Worldwide Damage from Digital Attacks This chart shows estimates of the average annual worldwide damage from hacking, malware, and spam since 1999. These data are based on figures from mi 2 G and the authors. Figure 8 -3 8. 6 © 2007 by Prentice Hall

Management Information Systems Chapter 8 Securing Information Systems Vulnerability and Abuse • Computer crime

Management Information Systems Chapter 8 Securing Information Systems Vulnerability and Abuse • Computer crime and cyberterrorism • Identity theft • Phishing • Evil twins • Pharming • Click fraud • Cyberterrorism and cyberwarfare • Internal threats: Employees • Software vulnerability 8. 7 © 2007 by Prentice Hall

Management Information Systems Chapter 8 Securing Information Systems Business Value of Security and Control

Management Information Systems Chapter 8 Securing Information Systems Business Value of Security and Control • Legal and regulatory requirements for electronic records management • • ERM HIPAA Gramm-Leach-Bliley Sarbanes-Oxley • Electronic evidence and computer forensics 8. 8 © 2007 by Prentice Hall

Management Information Systems Chapter 8 Securing Information Systems Establishing a Framework for Security and

Management Information Systems Chapter 8 Securing Information Systems Establishing a Framework for Security and Control • Risk Assessment • Security policy • Ensuring business continuity • Disaster recovery planning and business continuity planning • Security outsourcing • The role of auditing 8. 9 © 2007 by Prentice Hall

Management Information Systems Chapter 8 Securing Information Systems Technologies and Tools for Security •

Management Information Systems Chapter 8 Securing Information Systems Technologies and Tools for Security • Access control • Firewalls, intrusion detection systems, and antivirus software • Securing wireless networks • Encryption and public key infrastructure 8. 10 © 2007 by Prentice Hall

Management Information Systems Chapter 8 Securing Information Systems Technologies and Tools for Security A

Management Information Systems Chapter 8 Securing Information Systems Technologies and Tools for Security A Corporate Firewall The firewall is placed between the firm’s private network and the public Internet or another distrusted network to protect against unauthorized traffic. Figure 8 -6 8. 11 © 2007 by Prentice Hall

Management Information Systems Chapter 8 Securing Information Systems Technologies and Tools for Security Public

Management Information Systems Chapter 8 Securing Information Systems Technologies and Tools for Security Public Key Encryption A public key encryption system can be viewed as a series of public and private keys that lock data when they are transmitted and unlock the data when they are received. The sender locates the recipient’s public key in a directory and uses it to encrypt a message. The message is sent in encrypted form over the Internet or a private network. When the encrypted message arrives, the recipient uses his or her private key to decrypt the data and read the message. Figure 8 -7 8. 12 © 2007 by Prentice Hall