Chapter 4: Relational Databases made to the data without necessitating a

change in the programs and vice versa.

Learning Objectives  Cross-Functional Analysis - Relationships
between data from various organizational
 Explain the importance and advantages of
departments can be more easily combined.
databases.
 Describe the difference between database
Database Terminology
systems and file-based legacy systems.
 Database Management System (DBMS) -
 Explain the difference between logical and
Interface between software applications
physical views of a database.
and the data in files.
 Explain fundamental concepts of database
 Database Administrator (DBA)
systems such as DBMS, schemas, the data
-Person responsible for maintaining the
dictionary, and DBMS languages.
database
 Describe what a relational database is and
 Data Dictionary
how it organizes data.
-Information about the structure of the
 Create a set of well-structured tables to
database
store data in a relational database.
Example:Field names, descriptions, uses
 Perform simple queries using the Microsoft
Access database.
Logical vs. Physical

 Field - Attributes about an entity

 Physical View - Depends on explicitly
 Record -Related group of fields
knowing:
 File - Related group of records
-How is the data actually arranged in a
 Database - Related group of files
file
- Where is the data stored
on the computer
 Logical View - A Schema separates storage
of data from use of the data
-Unnecessary to explicitly know how and
where data is stored.

Schemas - Describe the logical structure of a

Advantages of Database Systems
database.
 Data Integration - Files are logically
combined and made accessible to various - Conceptual Level
systems. - Organization wide view of the data
 Data Sharing - With data in one place it is - External Level
- Individual users view of the data
more easily accessed by authorized users.
- Each view is a subschema
 Minimizing Data Redundancy and Data
- Internal Level
Inconsistency - Eliminates the same data - Describes how data are stored and
being stored in multiple files, thus reducing accessed
inconsistency in multiple versions of the - Description of: records,
same data. definitions, addresses, and indexes.
 Data Independence - Data is separate from
the programs that access it. Changes can be
 Each row contains multiple
attributes describing an instance of the
entity. In this case, inventory.

Attributes
 Primary Key - An attribute or combination
of attributes that can be used to uniquely
identify a specific row (record) in a table.
 Foreign Key - An attribute in one table that
is a primary key in another table.
 Used to link the two
DBMS Languages tables.
Database Design Errors
 Data Definition Language (DDL) If database is not designed properly data errors
-Builds the data dictionary can occur.
-Creates the database 1. Update Anomaly
-Describes the subschema - Changes to existing data are not correctly
-Specifies record or field security recorded.
constraints  Due to multiple records
 Data Manipulation Language (DML) with the same data
- Changes the content in the database attributes
- Example: Updates, insertions, and 2. Insert Anomaly
deletions - Unable to add a record to the database.
 Data Query Language (DQL) 3. Delete Anomaly
- Enables the retrieval, sorting, and - Removing a record also removes unintended data
display of data from the database from the database.

Design Requirements for Relational Database

Relational Database 1. Every column must be single valued.
2. Primary keys must contain data (not null).
Relational data model represents the conceptual and 3. Foreign keys must contain the same data as
external level schemas as if data are stored in tables. the primary key in another table.
4. All other attributes must identify a
 Table characteristic of the table identified by the
- Each row, a tuple, contains data primary key.
about one instance of an entity.
This is equivalent to a Normalizing Relational Databases
record.  Initially, one table is used for all the data in
- Each column contains data about a database.
one attribute of an entity.  Following rules, the table is decomposed
This is equivalent to a into multiple tables related by:
field. o Primary key–foreign key
integration
 Decomposed set of tables are in third  Failure to enforce
normal form (3NF). internal control
system
 Fraudulent financial reporting
Chapter 5: Computer Fraud o “…intentional or reckless
Learning Objectives conduct, whether by act or
 Explain the threats faced by modern omission, that results in
information systems. materially misleading financial
 Define fraud and describe the process one statements” (The Treadway
follows to perpetuate a fraud. Commission).
 Discuss who perpetrates fraud and why it
occurs, including: Reasons for Fraudulent Financial
o the pressures, opportunities, and Statements
rationalizations that are present in 1. Deceive investors or creditors
most frauds. 2. Increase a company’s stock price
 Define computer fraud and discuss the 3. Meet cash flow needs
different computer fraud classifications. 4. Hide company losses or other problems
 Explain how to prevent and detect
computer fraud and abuse. Treadway Commission Actions to Reduce Fraud
1. Establish environment which supports the
Common Threats to AIS integrity of the financial reporting process.
2. Identification of factors that lead to fraud.
 Natural Disasters and Terrorist Threats 3. Assess the risk of fraud within the
 Software Errors and/or Equipment company.
Malfunction 4. Design and implement internal controls to
 Unintentional Acts (Human Error) provide assurance that fraud is being
 Intentional Acts (Computer Crimes) prevented.

What Is Fraud? SAS #99

 Gaining an unfair advantage over  Auditors responsibility to detect fraud
another person o Understand fraud
o A false statement, o Discuss risks of material
representation, or disclosure fraudulent statements
o A material fact that induces a  Among members of
person to act audit team
o An intent to deceive o Obtain information
o A justifiable reliance on the  Look for fraud risk
fraudulent fact in which a factors
person takes action o Identify, assess, and respond
o An injury or loss suffered by to risk
the victim o Evaluate the results of audit
 Individuals who commit fraud are tests
referred to as white-collar criminals.  Determine impact of
fraud on financial
Forms of Fraud statements
 Misappropriation of assets o Document and communicate
o Theft of companies’ assets. findings
o Largest factors for theft of  See Chapter 3
assets: o Incorporate a technological
 Absence of internal focus
control system
 The Fraud Triangle Conceal Convert

Commit
Pressure

Opportunity
Opportunity
Rationalization

Three conditions that are

Rationalizations
present when Fraud occurs. • Justification of illegal behavior
1. Justification
Pressure
• I am not being dishonest.
 Motivation or incentive to commit fraud
2. Attitude
Types:
• I don’t need to be honest.
1. Employee
3. Lack of personal integrity
• Financial
• Theft is valued higher
• Emotional
than honesty or integrity.
• Lifestyle
2. Financial
• Industry conditions
• Management
characteristics
Attitude
Lack of
Peronal
Justification
Integrity
Emotional
Lifestyle

Financial
Rationalization

Employee
Co
mputer Fraud
 Any illegal act in which knowledge of
Industry Mgmt
Conditions Characteristics computer technology is necessary for:
o Perpetration
o Investigation
o Prosecution
Financial
Reporting
Rise of Computer Fraud
1. Definition is not agreed on
Opportunity 2. Many go undetected
• Condition or situation that allows a person 3. High percentage is not reported
or organization to: 4. Lack of network security
1. Commit the fraud 5. Step-by-step guides are easily available
2. Conceal the fraud 6. Law enforcement is overburdened
• Lapping 7. Difficulty calculating loss
• Kiting
3. Convert the theft or
misrepresentation to personal gain

Computer Fraud Classifications

 Input Fraud - Alteration or falsifying input o Constant stream of requests made
 Processor Fraud - Unauthorized system use to a Web-server (usually via a
 Computer Instructions Fraud- Modifying Botnet) that overwhelms and shuts
software, illegal copying of software, using
down service
software in an unauthorized manner,
creating software to undergo unauthorized  Spoofing
activities. o Making an electronic
communication look as if it comes
 Data Fraud - Illegally using, copying, from a trusted official source to
browsing, searching, or harming company
lure the recipient into providing
data
information.
 Output Fraud - Stealing, copying, or Types of Spoofing
misusing computer printouts or displayed  E-mail - E-mail sender appears as if it
information. comes from a different source
 Caller-ID - Incorrect number is
Chapter 6: Computer Fraud and Abuse
displayed
Techniques
 IP address - Forged IP address to
 Learning Objectives conceal identity of sender of data over
 Compare and contrast computer attack and the Internet or to impersonate another
abuse tactics. computer system
 Explain how social engineering techniques  Address Resolution Protocol (ARP)-
are used to gain physical or logical access to Allows a computer on a LAN to
computer resources. intercept traffic meant for any other
 Describe the different types of malware computer on the LAN
used to harm computers.  SMS - Incorrect number or name
appears, similar to caller-ID but for text
Computer Attacks and Abuse messaging
 Web page - Phishing (see below)
 Hacking - Unauthorized access,  DNS - Intercepting a request for a Web
modification, or use of a computer system service and sending the request to a
or other electronic device false service.
 Social Engineering - Techniques, usually Hacking Attacks
psychological tricks, to gain access to  Cross-Site Scripting (XSS) - Unwanted code
sensitive data or information. is sent via dynamic Web pages disguised as
o Used to gain access to secure user input.
systems or locations  Buffer Overflow - Data is sent that exceeds
 Malware - Any software which can be used computer capacity causing program
to do harm. instructions to be lost and replaced with
 attacker instructions.
Types of Computer Attacks  SQL Injection (Insertion)- Malicious code is
 Botnet—Robot Network inserted in the place of query to a database
o Network of hijacked computers system.
o Hijacked computers carry out  Man-in-the-Middle - Hacker places
processes without users themselves between client and host.
knowledge
o Zombie—hijacked computer
 Denial-of-Service (DoS) Attack Additional Hacking Attacks
 Password Cracking - Penetrating system  Identity Theft- Assuming someone else’s
security to steal passwords identity
 War Dialing- Computer automatically dials  Pretexting- Inventing a scenario that will lull
phone numbers looking for modems. someone into divulging sensitive
 Phreaking- Attacks on phone systems to information
obtain free phone service.  Posing- Using a fake business to acquire
 Data Diddling- Making changes to data sensitive information
before, during, or after it is entered into a  Phishing - Posing as a legitimate company
system. asking for verification type information:
 Data Leakage- Unauthorized copying of passwords, accounts, usernames
company data.  Pharming - Redirecting Web site traffic to a
spoofed Web site.
Hacking Embezzlement Schemes  Typesquatting - Typographical errors when
 Salami Technique- Taking small amounts entering a Web site name cause an invalid
from many different accounts. site to be accessed
 Economic Espionage- Theft of information,  Tabnapping - Changing an already open
trade secrets, and intellectual property. browser tab
 Cyber-Bullying- Internet, cell phones, or  Scavenging - Looking for sensitive
other communication technologies to information in items thrown away
support deliberate, repeated, and hostile  Shoulder Surfing - Snooping over
behavior that torments, threatens, someone’s shoulder for sensitive
harasses, humiliates, embarrasses, or information.
otherwise harms another person. More Social Engineering
 Internet Terrorism - Act of disrupting  Lebanese Loping - Capturing ATM pin and
electronic commerce and harming card numbers
computers and communications.  Skimming - Double-swiping a credit card
 Internet Misinformation - Using the  Chipping - Planting a device to read credit
Internet to spread false or misleading card information in a credit card reader
information  Eavesdropping - Listening to private
communications
Hacking for Fraud Type of Malware
 Internet Misinformation - Using the  Spyware - Secretly monitors and collects
Internet to spread false or misleading personal information about users and sends
information it to someone else
 Internet Auction - Adware - Pops banner ads on a
- Using an Internet auction site to monitor, collects information about the
defraud another person user’s Web-surfing, and spending habits,
- Unfairly drive up bidding and forward it to the adware creator
- Seller delivers inferior merchandise  Key logging - Records computer activity,
or fails to deliver at all such as a user’s keystrokes, e-mails sent
- Buyer fails to make payment and received, Web sites visited, and chat
 Internet Pump-and-Dump - Using the session participation
Internet to pump up the price of a stock and  Trojan Horse- Malicious computer
then selling it. instructions in an authorized and otherwise
Social Engineering Techniques properly functioning program
-Time bombs/logic bombs
 -Idle until triggered by a specified
date or time, by a change in the system, by
a message sent to the system, or by an
event that does not occur.
More Malware
 Trap Door/Back Door
o A way into a system that bypasses
normal authorization and
authentication controls
 Packet Sniffers
o Capture data from information
packets as they travel over
networks
o Rootkit
 Used to hide the presence
of trap doors, sniffers, and
key loggers; conceal
software that originates a
denial-of-service or an e-
mail spam attack; and
access user names and
log-in information
 Superzapping
o Unauthorized use of special system
programs to bypass regular system
controls and perform illegal acts,
all without leaving an audit trail