Week 7 - Choices in Systems Acquisition and Risks, Security, and Disaster Recovery Sousa, K., & Oz, E. (2015). Management Information Systems, 7th Edition. Cengage Learning. ISBN-13: 978-1285186139 Read: · Chapter 13 · Chapter 14 Week 7 Lecture 1 - Choices in Systems Acquisition and Risks, Security Management of Information Systems Choices in Systems Acquisition and Risks, Security Systems Acquisition Options to consider when acquiring a new system are, development in-house, outsourcing, licensing, software as a service (SaaS), and having users develop the system. There are trade-offs to consider for each option. In-house development has several advantages to consider such as a good fit to organizational need and culture, dedicated maintenance, since the developers are accessible within the company, seamless interface, when the system is custom-made for an organization special requirements can be implemented to ensure that it has proper interfaces with other systems, and specialized security, special security measures can be integrated into an application. Additionally, there is a potential for strategic advantage. Some of the disadvantages of in-house development are, high cost, a long wait for development personnel, who might be busy with other projects and the application may be excessively organization specific to integrate with other systems. Outsourcing Advantages of outsourcing are improved financial planning sense outsourcing enables a client to know the exact costs of IT functions over the period of a contract. Another advantage is reduced license and maintenance fee discounts. Outsourcing gives businesses an opportunity to increase their attention to the core business by letting experts manage IT. Outsourcing also provides shorter implementation time as IT vendors can in most cases complete a new application in less time than in-house development. A reduction in personnel as another advantage as IS salaries and benefits are expensive. Outsourcing increases access to highly qualified knowledge. Clients can tap into the IT vendor’s knowledge and experience gained by working with many clients in different environments. Some of the risks of outsourcing IT services are a loss of control, a loss of experienced employees, outsourcing involves transferring organizations employees to the highest vendor, the risk of losing competitive advantage outsourcing the development of strategic systems is the same as disclosing trade secrets. Another disadvantage is high price despite careful pre-contractual calculations companies find that outsourcing cost them significantly more than if they had spent their resources on in-house development. Licensing Benefits of licensing software are immediate system availability, low price (the license fee), available support, and high quality. Immediate availability shortens the time from when a decision is made to acquire the new system and when the new system begins to be productive. The product is high qual ...

1. Week 7 - Choices in Systems Acquisition and Risks, Security,
and Disaster Recovery
Sousa, K., & Oz, E. (2015). Management Information Systems,
7th Edition. Cengage Learning.
ISBN-13: 978-1285186139
Read:
· Chapter 13
· Chapter 14
Week 7 Lecture 1 - Choices in Systems Acquisition and Risks,
Security
Management of Information Systems
Choices in Systems Acquisition and Risks, Security
Systems Acquisition
Options to consider when acquiring a new system are,
development in-house, outsourcing, licensing, software as a
service (SaaS), and having users develop the system. There are
trade-offs to consider for each option. In-house development
has several advantages to consider such as a good fit to
organizational need and culture, dedicated maintenance, since
the developers are accessible within the company, seamless
interface, when the system is custom-made for an organization
special requirements can be implemented to ensure that it has
proper interfaces with other systems, and specialized security,
special security measures can be integrated into an application.
Additionally, there is a potential for strategic advantage. Some
of the disadvantages of in-house development are, high cost, a
long wait for development personnel, who might be busy with
other projects and the application may be excessively

2. organization specific to integrate with other systems.
Outsourcing
Advantages of outsourcing are improved financial planning
sense outsourcing enables a client to know the exact costs of IT
functions over the period of a contract. Another advantage is
reduced license and maintenance fee discounts. Outsourcing
gives businesses an opportunity to increase their attention to the
core business by letting experts manage IT. Outsourcing also
provides shorter implementation time as IT vendors can in most
cases complete a new application in less time than in-house
development. A reduction in personnel as another advantage as
IS salaries and benefits are expensive. Outsourcing increases
access to highly qualified knowledge. Clients can tap into the IT
vendor’s knowledge and experience gained by working with
many clients in different environments.
Some of the risks of outsourcing IT services are a loss of
control, a loss of experienced employees, outsourcing involves
transferring organizations employees to the highest vendor, the
risk of losing competitive advantage outsourcing the
development of strategic systems is the same as disclosing trade
secrets. Another disadvantage is high price despite careful pre-
contractual calculations companies find that outsourcing cost
them significantly more than if they had spent their resources
on in-house development.
Licensing
Benefits of licensing software are immediate system
availability, low price (the license fee), available support, and
high quality. Immediate availability shortens the time from
when a decision is made to acquire the new system and when
the new system begins to be productive. The product is high
quality because the software company specializes in producing
the product. The licensing fee is small because the cost of
developing the software has been spread out among many
elements. Software support is usually included with the license.
Figure 11 Steps in licensing software © Cengage Learning 2015

3. Some of the risks of licensing software are that the software is a
loose fit to the needs of the organization and culture software’s
ready-made and developed for the widest common denominator
another risk is that modifications to the software can be
difficult and complicated to maintain. There is a chance that the
vendor could dissolve or stop supporting the software. Changes
in the vendor’s organization can influence the support and the
quality of software upgrades.
Software as a service (SaaS)
An application service provider (ASP) is an organization that
offers use of software over a network such as the Internet or a
private network. Applications provided by ASPs are referred to
as software as a service (SaaS). The application is not installed
on the client’s computer. However, the client can choose to save
data to their local computer. Benefits of software as a service
are, the elimination of the need to maintain application
software, elimination of reliance on experts for installation and
maintenance, there’s no need to purchase hardware for
installation, there’s a significant reduction in implementation
time, there’s no financial risk, and the support is provided by
the SaaS vendor.
Caveat emptor, buyer, beware. ASPs can disappoint
organizations by not providing the scope of services and level
of reliability expected. Before deciding on an ASP thoroughly
research its history, validate the ASP’s financial strength,
ensure that you understand the price structure, get a list of the
ASP’s infrastructure, and carefully craft a service contract. An
important aspect to check is the uptime of the ASP systems. An
appropriate uptime percentage would be 99.999%. An
inappropriate percentage would be 99.9% that allows 500
minutes per year of downtime which would be unacceptable in
most cases.
User application development
Another alternative to software development is user application
development which is sometimes appropriate when
organizations do not wish to purchase or rent an application that

4. is not very complex. User application development is performed
by nonprogrammers for their own use. These applications tend
to be fairly simple and limited in scope, and can be maintained
by the end-users. These applications are usually used for a brief
period of time and then discarded end-user should not develop
complex applications that interface with other systems. An
advantage of end-user development is sure to lead times.
Another advantages user application development is a good fit
to the organizational needs. User application development
complies with the organizational culture, and it can be an
efficient use of resources, and it also frees up information
systems staff time.
A disadvantage of user application development is that the
applications are can be poorly developed. Another disadvantage
is that an organization that relies on users development runs a
risk of creating islands of information or private databases.
Sometimes users will develop applications that are identical to
existing systems elsewhere in the organization. Security issues
could arise, particularly if the user developer is given access to
organizational databases to develop the application.
Additionally, user-developed applications tend to be poorly
documented.
Week 7 Lecture 2 - Disaster Recovery
Management of Information Systems
Disaster Recovery
Risks and Security
As companies have increased their dependency on the Internet,
the risk to information has increased. Information technology
has connected individuals and organizations, and threats have
increased proportionately. Security and data breaches associated
with information technology has eroded trust in business
organizations and government entities. Although hardware and
software are expensive investments and should be protected,
security of data is far more critical for an organization.

5. Controls
Controls are actions taken to minimize damage to or loss of
data, software, or hardware. Controls are applied in the form of
hardware, procedures, and software. A control is a constraint.
The challenge is to apply a constraint that poses minimal delay
and inconvenience to legitimate users of data, hardware, and
software.
Recovery plans
Increasingly businesses are creating business recovery plans or
business continuity plans, or business resumption plans. These
plans detail what should be done if critical systems go down.
Business recovery plans should not focus on the damage to an
organization’s assets, but to its business. The plan should
contain contingencies in the case of a disaster that would enable
resumption of business operations.
Experts have proposed nine steps to a business recovery plan.
Obtain management’s commitment to the plan
Establish a planning committee
Perform risk assessment and implement analysis
Prioritize recovery needs
Select a recovery plan
Selected vendors
Develop and implement the plan
Test the plan
Continually test and evaluate
Some companies choose not to develop fully their own recovery
plan and choose to outsource it to companies that specialize in
either disaster recovery planning or provision of alternative
sites. Some companies provide both planning and software for
disaster recovery. Duplicate databases and applications are
maintained for clients.

6. © Cengage Learning 2015
1
Figure 13.2 Advantages and disadvantages of custom-designed
applications © Cengage Learning 2015
Outsourcing meanings in the IT arena
To commission the development of an application to another
organization
To hire the services of another company to manage all or parts
of the services usually rendered by an IT unit in the
organization
May not include development of new applications
Outsouricing custom-designed (tailored) software is software,
developed by another company, specifically for the needs of an
organization
There are several advantages which are
The software is a good fit to business needs
The software is a good fit to organizational culture
There is dedicated maintenance
Seamless interfaces with other systems can be included
Specialized security
Potential for strategic advantage
Disadvantages can be
A high cost
The organization must fund all development costs
Staff may be diverted from other projects
Software is less likely to be compatible with other
organizations’ systems
Must deal with an inherent conflicts when outsourcing software
development:

7. Client wants a firm contract and set of requirements
Specific requirements may mean that no deviation is allowed if
changes are needed later as development progresses
Changes may involve hefty additional charges
Offshoring: outsourcing to other countries such as Costa Rica,
Indonesia, Columbia, etc.
1
Licensing Applications
Purchasing software usually means purchasing a license to use
the software
There is a large selection of high-quality packaged software
available
Groups of ready-made software
Relatively inexpensive software that helps in the workplace,
such as office suites
Large, costly applications that support entire organizational
functions, such as HR or financial management
© Cengage Learning 2015
2
2
Purchasing software usually means purchasing a license to use
the software
There is a large selection of high-quality packaged software
available
Groups of ready-made software
Relatively inexpensive software that helps in the workplace,
such as office suites
Large, costly applications that support entire organizational
functions, such as HR or financial management
Software licensing benefits are:
Immediate system availability
High quality

8. Low price (license fee)
And Available support
A Beta version is a prerelease version of software to be tested
by companies who want to use it
After-the-sale support often includes a period of up to one year
of free service
Large applications require installation specialists
Some software licensing risks are:
There can be a loose fit between needs and features
We must determine if the software will comply with company
needs and organizational culture
There can be difficulties in customizing the software for
company needs
The vendor may dissolve or stop supporting the software before
the company is ready and may be left without support and
maintenance
High turnover of vendor personnel may result in lowered
support expertise from vendor
If custom modifications are undertaken, vendor updates may
require, tedious “weaving” into customized system
© Cengage Learning 2015
3
Figure 13.8 Benefits and risks of Software as a Service (SaaS)
© Cengage Learning 2015
An application service provider (ASP) is an organization that
offers software through a network (the Internet or private
network)
Software as a service (SaaS) are applications available through
a network
No software is installed on a client’s computers
Files may be stored on local storage devices
ASPs may rent the software they offer

9. The benefits of renting software are:
There is no need to learn how to maintain the software
There is no large start-up fee
Storage hardware is unnecessary
Software is usually available sooner
A good option for small companies
Considered a “software on demand” approach
The risks of renting software are
The lack of control may be an issue, as the client’s data is
managed by the vendor
The vendor is unlikely to make many customized changes to the
software
Response time is impacted by traffic levels
There may be security risks through a public network
Many clients use leased lines instead of the Internet to limit
security risks
3
© Cengage Learning 2015
4
Figure 13.9 Guidelines for end-user development of information
technology applications
© Cengage Learning 2015
User application development is when a nonprogrammer users
write their own business applications
Characteristics of user-developed software are:
Simple and limited in scope software
Small applications developed for immediate or brief needs
Software is maintained by end users
Challenges of user-developed applications are:
Managing the reaction of IT professionals,

10. Providing support.,
Compatibility issues,
And managing access
Advantages of user development of applications are:
Shortened lead times
Good fit to needs
Compliance with culture
Efficient utilization of resources
Acquisition of skills
And freeing up IS staff time
Disadvantages of user-developed applications are
Poorly developed applications
Islands of information
Duplication
Security problems
and poor or no documentation
4
Goals of Information Security
Protecting IT resources is a primary concern
Securing corporate ISs is becoming increasingly challenging
Major goals of information security
Reduce the risk of systems ceasing operation
Maintain information confidentiality
Ensure the integrity and reliability of data resources
Ensure the uninterrupted availability of resources
Ensure compliance with policies and laws
© Cengage Learning 2015
5
5
Protecting IT resources is a primary concern
Securing corporate ISs is becoming increasingly challenging

11. Major goals of information security are to
Reduce the risk of systems ceasing operation,
Maintain information confidentiality,
Ensure the integrity and reliability of data resources,
Ensure the uninterrupted availability of resources,
And Ensure compliance with policies and laws
Laws passed by U.S. Congress setting standards for protecting
privacy
Health Insurance Portability and Accountability Act of 1996
(HIPAA)
Sarbanes-Oxley Act of 2002 (SOX)
CIA triad: foundational concepts of information systems
security
Confidentiality
Integrity
Availability
Risks associated with cloud computing and data storage
Downtime: the period of time during which an IS is not
available
$26 billion lost annually in the U.S. due to downtime
Costs of downtime vary depending on industry, the size of the
company, and other factors
There are also risk to hardware.
The #1 cause of system downtime is hardware failure
Major causes of hardware damage
Natural disasters
Fires, floods, earthquakes, hurricanes, tornadoes, and lightning
Blackouts and brownouts
Blackout: total loss of electricity
Brownout: partial loss of electricity
Uninterruptible power supply (UPS): backup power for a short
time
Major causes of hardware damage
Vandalism
Deliberate destruction

12. Deliberate alteration or destruction is often done as a prank, but
has a high cost
Online vandal’s target may be a company’s website
Hacking: unauthorized access
Honeytoken: a bogus record in a networked database used to
combat hackers
Honeypot: a server containing a mirrored copy of a database or
a bogus database
Educates security officers about vulnerable points
Virus: spreads from computer to computer
Worm: spreads in a network without human intervention
Antivirus software: protects against viruses
Trojan horse: a virus disguised as legitimate software
Logic bomb: software that is programmed to cause damage at a
specific time
Unintentional, non-malicious damage can be caused by:
Poor training
Lack of adherence to backup procedures
Unauthorized downloading and installation of software may
cause damage
Human error
There are risks to online operations. Many hackers try daily to
interrupt online businesses
Some types of attacks
Unauthorized access
Data theft
Defacing of webpages
Denial of service
Hijacking computers
Denial of service (DoS): an attacker launches a large number of
information requests
Slows down legitimate traffic to site
Distributed denial of service (DDoS): an attacker launches a

13. DoS attack from multiple computers
Usually launched from hijacked personal computers called
“zombies”
There is no definitive cure for this
A site can filter illegitimate traffic
Computer Hijacking is using some or all of a computer’s
resources without the consent of its owner
Often done for making a DDoS attack
Done by installing a software bot on the computer
Main purpose of hijacking is usually to send spam
Bots are planted by exploiting security holes in operating
systems and communications software
A bot usually installs e-mail forwarding software
Security Measures
Organizations can protect against attacks using various
approaches, including:
Firewalls
Authentication
Encryption
Digital signatures
Digital certificates
© Cengage Learning 2015
6
6
Organizations can take security measures to protect against
attacks using various approaches, including:
Firewalls
Authentication
Encryption
Digital signatures

14. And Digital certificates
Firewall: hardware and software that blocks access to
computing resources
The best defense against unauthorized access over the Internet
Firewalls are now routinely integrated into routers
DMZ: demilitarized zone approach
One end of the network is connected to the trusted network, and
the other end to the Internet
Connection is established using a proxy server
Proxy server: “represents” another server for all information
requests from resources inside the trusted network
Can also be placed between the Internet and the trusted network
when there is no DMZ
Authentication: the process of ensuring that you are who you
say you are
Encryption: coding a message into an unreadable form
Messages are encrypted and authenticated to ensure security
Important when communicating confidential information, e.g.,
financial and medical records
A message may be text, image, sound, or other digital
information
Encryption programs scramble the transmitted information
Plaintext is the original message
Ciphertext is the encoded message
Encryption uses a mathematical algorithm and a key
A Key is a unique combination of bits that will decipher the
ciphertext
Public-key encryption uses two keys, one public and one private
Symmetric encryption is when the sender and the recipient use
the same key
Asymmetric encryption is when both a public and a private key
are used

15. Transport Layer Security (TLS) is a protocol for transactions on
the Web that uses a combination of public key and symmetric
key encryption
HTTPS is a the secure version of HTTP
A Digital signature is a means to authenticate online messages;
implemented with public keys
A Message digest is unique fingerprint of file
Digital certificates are computer files that associate one’s
identity with one’s public key
Issued by certificate authority
Certificate authority (CA) is a trusted third party
A digital certificate contains its holder’s name, a serial number,
its expiration dates, and a copy of holder’s public key
Also contains the digital signature of the CA
The downside of security measures are:
For Single sign-on (SSO) a user must enter his or her
name/password only once
Single sign-on saves employees time
Encryption slows down communication
Every message must be encrypted and then decrypted
IT specialists must clearly explain the implications of security
measures to upper management
Recovery Measures
Security measures may reduce mishaps, but no one can control
all disasters
Preparation for uncontrolled disasters requires that recovery
measures are in place
Redundancy may be used
Very expensive, especially in distributed systems
Other measures must be taken
© Cengage Learning 2015
7

16. 7
Security measures may reduce mishaps, but no one can control
all disasters
Recovery measures are preparation for uncontrolled disasters
that require recovery of data and information.
Redundancy may be used
It is Very expensive, especially in distributed systems
Other measures must be taken
A Business recovery plan is a detailed plan about what should
be done and by whom if critical systems go down
Also called a disaster recovery plan, business resumption plan,
or business continuity plan
To develop a business recovery plan
Obtain management’s commitment to the plan
Establish a planning committee
Perform risk assessment and impact analysis
Prioritize recovery needs
Mission-critical applications: those without which the business
cannot conduct operations
Select a recovery plan
Select vendors
Develop and implement the plan
Test the plan
Continually test and evaluate
Can outsource recovery plans to firms that specialize in disaster
recover planning
Hot sites are alternative sites that a business can use when a
disaster occurs
Backup sites provide desks, computer systems, and Internet
links
Companies that implement hot sites
IBM
Hewlett-Packard
SunGard Availability Services