Power Point Slides for Chapter 8

bustlingdivisionElectronics - Devices

Nov 15, 2013 (3 years and 9 months ago)

75 views

8.
1

©

2007 by Prentice Hall

8

Chapter


Securing Information
Systems

8.
2

©

2007 by Prentice Hall

LEARNING OBJECTIVES

Management Information Systems

Chapter 8 Securing Information Systems


Analyze why information systems need special
protection from destruction, error, and abuse.


Assess the business value of security and control.


Design an organizational framework for security and
control.


Evaluate the most important tools and technologies
for safeguarding information resources.

8.
3

©

2007 by Prentice Hall

Phishing: A Costly New Sport for Internet Users


Problem:

Large number of vulnerable users of online
financial services, ease of creating bogus Web sites.


Solutions:
Deploy anti
-
phishing software and
services and a multilevel authentication system

to
identify threats and reduce phishing attempts.


Deploying new tools, technologies, and security
procedures, along with educating consumers,

increases reliability and customer confidence.


Demonstrates IT’s role in combating cyber crime.


Illustrates digital technology as part of a multilevel
solution as well as its limitations in overcoming
discouraged consumers.







Management Information Systems

Chapter 8 Securing Information Systems

8.
4

©

2007 by Prentice Hall

SYSTEM VULNERABILITY AND ABUSE


Why Systems Are Vulnerable


Management Information Systems

Chapter 8 Securing Information Systems

Contemporary Security Challenges and Vulnerabilities


Figure 8
-
1

8.
5

©

2007 by Prentice Hall


Use of fixed Internet addresses through use of
cable modems or DSL



Lack of encryption with most Voice over IP (VoIP)



Widespread use of e
-
mail and instant messaging
(IM)

Management Information Systems

Chapter 8 Securing Information Systems


SYSTEM VULNERABILITY AND ABUSE


Internet Vulnerabilities:


Why Systems Are Vulnerable

(Continued)

8.
6

©

2007 by Prentice Hall


Radio frequency bands are easy to scan



The service set identifiers (SSID)

identifying the
access points broadcast multiple times

Management Information Systems

Chapter 8 Securing Information Systems

SYSTEM VULNERABILITY AND ABUSE


Wireless Security Challenges:


8.
7

©

2007 by Prentice Hall


Computer viruses, worms,


Spyware



Identity theft, phishing, pharming



Cyberterrorism and Cyberwarfare



Vulnerabilities from internal threats (employees);
software flaws


Management Information Systems

Chapter 8 Securing Information Systems

SYSTEM VULNERABILITY AND ABUSE


Malicious Software: Viruses, Worms, and Spyware

Hackers and Cybervandalism

8.
8

©

2007 by Prentice Hall


Inadequate security and control may create serious
legal liability.



Businesses must protect not only their own information
assets but also those of customers, employees, and
business partners. Failure to do so can lead to costly
litigation for data exposure or theft.



A sound security and control framework that protects
business information assets can thus produce a high
return on investment.

Management Information Systems

Chapter 8 Securing Information Systems

BUSINESS VALUE OF SECURITY AND CONTROL


8.
9

©

2007 by Prentice Hall

General controls:



Software and hardware



Computer operations



Data security



Systems implementation process


Management Information Systems

Chapter 8 Securing Information Systems

ESTABLISHING A MANAGEMENT FRAMEWORK FOR
SECURITY AND CONTROL


Types of Information Systems Controls


8.
10

©

2007 by Prentice Hall



Input



Processing



Output




Management Information Systems

Chapter 8 Securing Information Systems

ESTABLISHING A MANAGEMENT FRAMEWORK FOR
SECURITY AND CONTROL


Application controls:

8.
11

©

2007 by Prentice Hall

Management Information Systems

Chapter 10
Security and Control


ESTABLISHING A MANAGEMENT FRAMEWORK FOR
SECURITY AND CONTROL


Security Profiles for a Personnel System


Figure 8
-
4

8.
12

©

2007 by Prentice Hall


Disaster recovery planning:

Plans for restoration of
computing and communications disrupted by an
event such as an earthquake, flood, or terrorist
attack




Business continuity planning:

Plans for handling
mission
-
critical functions if systems go down

Management Information Systems

Chapter 8 Securing Information Systems

ESTABLISHING A MANAGEMENT FRAMEWORK FOR
SECURITY AND CONTROL


Ensuring Business Continuity

8.
13

©

2007 by Prentice Hall

Management Information Systems

Chapter 8 Securing Information Systems

TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL


Access Control




Passwords

Authentication:

Access control:

Consists of all the policies and
procedures a company uses to prevent improper access
to systems by unauthorized insiders and outsiders



Biometric authentication

8.
14

©

2007 by Prentice Hall


Firewalls:

Hardware and software controlling flow of
incoming and outgoing network traffic



Intrusion detection systems:

Full
-
time monitoring
tools placed at the most vulnerable points of
corporate networks to detect and deter intruders




Management Information Systems

Chapter 8 Securing Information Systems

TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL


Firewalls, Intrusion Detection Systems, and
Antivirus Software


8.
15

©

2007 by Prentice Hall


Antivirus software:

Software that checks computer
systems and drives for the presence of computer
viruses and can eliminate the virus from the infected
area



Management Information Systems

Chapter 8 Securing Information Systems

TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL


Firewalls, Intrusion Detection Systems, and
Antivirus Software (Continued)

8.
16

©

2007 by Prentice Hall

Management Information Systems

Chapter 10
Security and
Contr
Chapter

8 Securing Information Systems

ol


TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL


A Corporate Firewall


Figure 8
-
6

8.
17

©

2007 by Prentice Hall


Public key encryption:

Uses two different keys, one
private and one public. The keys are mathematically
related so that data encrypted with one key can be
decrypted using only the other key



Message integrity:

The ability to be certain that the
message being sent arrives at the proper destination
without being copied or changed

Management Information Systems

Chapter 8 Securing Information Systems


TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL


Encryption and Public Key Infrastructure


8.
18

©

2007 by Prentice Hall


Digital signature:

A digital code attached to an
electronically transmitted message that is used to
verify the origin and contents of a message






Management Information Systems

Chapter 8 Securing Information Systems

TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL


Encryption and Public Key Infrastructure
(Continued)

8.
19

©

2007 by Prentice Hall


Secure Sockets Layer (SSL)

and its successor
Transport Layer Security (TLS):

protocols for secure
information transfer over the Internet; enable client
and server computer encryption and decryption
activities as they communicate during a secure Web
session.


Secure Hypertext Transfer Protocol (S
-
HTTP):

used for
encrypting data flowing over the Internet; limited to
Web documents, whereas SSL and TLS encrypt all
data being passed between client and server.


Management Information Systems

Chapter 8 Securing Information Systems

TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL


Encryption and Public Key Infrastructure
(Continued)

8.
20

©

2007 by Prentice Hall

Management Information Systems

Chapter 8 Securing Information Systems

TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL


Public Key Encryption


Figure 8
-
7

8.
21

©

2007 by Prentice Hall

Worldwide Damage from Digital Attacks

Figure 8
-
3

This chart shows estimates of the average annual worldwide damage from hacking, malware, and spam since 1999.
These data are based on figures from mi2G and the authors.

Systems Vulnerability and Abuse

Management Information Systems

Chapter 8 Securing Information Systems