8.1 © 2007 by Prentice Hall
88ChapterChapter
Securing InformationSecuring Information
SystemsSystems
8.2 © 2007 by Prentice Hall
LEARNING OBJECTIVES
Management Information SystemsManagement Information Systems
Chapter 8 Sec...
8.3 © 2007 by Prentice Hall
Phishing: A Costly New Sport for Internet Users
• Problem: Large number of vulnerable users of...
8.4 © 2007 by Prentice Hall
SYSTEM VULNERABILITY AND ABUSE
Why Systems Are Vulnerable
Management Information SystemsManage...
8.5 © 2007 by Prentice Hall
• Use of fixed Internet addresses through use of
cable modems or DSL
• Lack of encryption with...
8.6 © 2007 by Prentice Hall
• Radio frequency bands are easy to scan
• The service set identifiers (SSID) identifying the
...
8.7 © 2007 by Prentice Hall
• Computer viruses, worms,
• Spyware
• Identity theft, phishing, pharming
• Cyberterrorism and...
8.8 © 2007 by Prentice Hall
• Inadequate security and control may create serious
legal liability.
• Businesses must protec...
8.9 © 2007 by Prentice Hall
General controls:
• Software and hardware
• Computer operations
• Data security
• Systems impl...
8.10 © 2007 by Prentice Hall
• Input
• Processing
• Output
Management Information SystemsManagement Information Systems
Ch...
8.11 © 2007 by Prentice Hall
Management Information SystemsManagement Information Systems
Chapter 10Chapter 10 Security an...
8.12 © 2007 by Prentice Hall
• Disaster recovery planning: Plans for restoration of
computing and communications disrupted...
8.13 © 2007 by Prentice Hall
Management Information SystemsManagement Information Systems
Chapter 8 Securing Information S...
8.14 © 2007 by Prentice Hall
• Firewalls: Hardware and software controlling flow of
incoming and outgoing network traffic
...
8.15 © 2007 by Prentice Hall
• Antivirus software: Software that checks computer
systems and drives for the presence of co...
8.16 © 2007 by Prentice Hall
Management Information SystemsManagement Information Systems
Chapter 10Chapter 10 Security an...
8.17 © 2007 by Prentice Hall
• Public key encryption: Uses two different keys, one
private and one public. The keys are ma...
8.18 © 2007 by Prentice Hall
• Digital signature: A digital code attached to an
electronically transmitted message that is...
8.19 © 2007 by Prentice Hall
• Secure Sockets Layer (SSL) and its successor
Transport Layer Security (TLS): protocols for ...
8.20 © 2007 by Prentice Hall
Management Information SystemsManagement Information Systems
Chapter 8 Securing Information S...
8.21 © 2007 by Prentice Hall
Worldwide Damage from Digital AttacksWorldwide Damage from Digital Attacks
Figure 8-3
This ch...
Upcoming SlideShare
Loading in …5
×

386sum08ch8 (1)

723 views
655 views

Published on

Published in: Technology, Business
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
723
On SlideShare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
83
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

386sum08ch8 (1)

  1. 1. 8.1 © 2007 by Prentice Hall 88ChapterChapter Securing InformationSecuring Information SystemsSystems
  2. 2. 8.2 © 2007 by Prentice Hall LEARNING OBJECTIVES Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems • Analyze why information systems need special protection from destruction, error, and abuse. • Assess the business value of security and control. • Design an organizational framework for security and control. • Evaluate the most important tools and technologies for safeguarding information resources.
  3. 3. 8.3 © 2007 by Prentice Hall Phishing: A Costly New Sport for Internet Users • Problem: Large number of vulnerable users of online financial services, ease of creating bogus Web sites. • Solutions: Deploy anti-phishing software and services and a multilevel authentication system to identify threats and reduce phishing attempts. • Deploying new tools, technologies, and security procedures, along with educating consumers, increases reliability and customer confidence. • Demonstrates IT’s role in combating cyber crime. • Illustrates digital technology as part of a multilevel solution as well as its limitations in overcoming discouraged consumers. Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems
  4. 4. 8.4 © 2007 by Prentice Hall SYSTEM VULNERABILITY AND ABUSE Why Systems Are Vulnerable Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems Contemporary Security Challenges and Vulnerabilities Figure 8-1
  5. 5. 8.5 © 2007 by Prentice Hall • Use of fixed Internet addresses through use of cable modems or DSL • Lack of encryption with most Voice over IP (VoIP) • Widespread use of e-mail and instant messaging (IM) Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems SYSTEM VULNERABILITY AND ABUSE Internet Vulnerabilities: Why Systems Are Vulnerable (Continued)
  6. 6. 8.6 © 2007 by Prentice Hall • Radio frequency bands are easy to scan • The service set identifiers (SSID) identifying the access points broadcast multiple times Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems SYSTEM VULNERABILITY AND ABUSE Wireless Security Challenges:
  7. 7. 8.7 © 2007 by Prentice Hall • Computer viruses, worms, • Spyware • Identity theft, phishing, pharming • Cyberterrorism and Cyberwarfare • Vulnerabilities from internal threats (employees); software flaws Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems SYSTEM VULNERABILITY AND ABUSE Malicious Software: Viruses, Worms, and Spyware Hackers and Cybervandalism
  8. 8. 8.8 © 2007 by Prentice Hall • Inadequate security and control may create serious legal liability. • Businesses must protect not only their own information assets but also those of customers, employees, and business partners. Failure to do so can lead to costly litigation for data exposure or theft. • A sound security and control framework that protects business information assets can thus produce a high return on investment. Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems BUSINESS VALUE OF SECURITY AND CONTROL
  9. 9. 8.9 © 2007 by Prentice Hall General controls: • Software and hardware • Computer operations • Data security • Systems implementation process Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Types of Information Systems Controls
  10. 10. 8.10 © 2007 by Prentice Hall • Input • Processing • Output Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Application controls:
  11. 11. 8.11 © 2007 by Prentice Hall Management Information SystemsManagement Information Systems Chapter 10Chapter 10 Security and ControlSecurity and Control ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Security Profiles for a Personnel System Figure 8-4
  12. 12. 8.12 © 2007 by Prentice Hall • Disaster recovery planning: Plans for restoration of computing and communications disrupted by an event such as an earthquake, flood, or terrorist attack • Business continuity planning: Plans for handling mission-critical functions if systems go down Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Ensuring Business Continuity
  13. 13. 8.13 © 2007 by Prentice Hall Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Access Control • Passwords Authentication: Access control: Consists of all the policies and procedures a company uses to prevent improper access to systems by unauthorized insiders and outsiders • Biometric authentication
  14. 14. 8.14 © 2007 by Prentice Hall • Firewalls: Hardware and software controlling flow of incoming and outgoing network traffic • Intrusion detection systems: Full-time monitoring tools placed at the most vulnerable points of corporate networks to detect and deter intruders Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Firewalls, Intrusion Detection Systems, and Antivirus Software
  15. 15. 8.15 © 2007 by Prentice Hall • Antivirus software: Software that checks computer systems and drives for the presence of computer viruses and can eliminate the virus from the infected area Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Firewalls, Intrusion Detection Systems, and Antivirus Software (Continued)
  16. 16. 8.16 © 2007 by Prentice Hall Management Information SystemsManagement Information Systems Chapter 10Chapter 10 Security and ContrSecurity and ContrChapter 8 Securing Information SystemsChapter 8 Securing Information Systems olol TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL A Corporate Firewall Figure 8-6
  17. 17. 8.17 © 2007 by Prentice Hall • Public key encryption: Uses two different keys, one private and one public. The keys are mathematically related so that data encrypted with one key can be decrypted using only the other key • Message integrity: The ability to be certain that the message being sent arrives at the proper destination without being copied or changed Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Encryption and Public Key Infrastructure
  18. 18. 8.18 © 2007 by Prentice Hall • Digital signature: A digital code attached to an electronically transmitted message that is used to verify the origin and contents of a message Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Encryption and Public Key Infrastructure (Continued)
  19. 19. 8.19 © 2007 by Prentice Hall • Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS): protocols for secure information transfer over the Internet; enable client and server computer encryption and decryption activities as they communicate during a secure Web session. • Secure Hypertext Transfer Protocol (S-HTTP): used for encrypting data flowing over the Internet; limited to Web documents, whereas SSL and TLS encrypt all data being passed between client and server. Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Encryption and Public Key Infrastructure (Continued)
  20. 20. 8.20 © 2007 by Prentice Hall Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Public Key Encryption Figure 8-7
  21. 21. 8.21 © 2007 by Prentice Hall Worldwide Damage from Digital AttacksWorldwide Damage from Digital Attacks Figure 8-3 This chart shows estimates of the average annual worldwide damage from hacking, malware, and spam since 1999. These data are based on figures from mi2G and the authors. Systems Vulnerability and Abuse Management Information SystemsManagement Information Systems Chapter 8 Securing Information SystemsChapter 8 Securing Information Systems

×