MIS

CHAPTER 5

PROTECTING INFORMATION
RESOURCES
Hossein BIDGOLI

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
1
 Chapter 5 Protecting Information Resources

learning outcomes
LO1 Describe basic safeguards in computer and network
security.
LO2 Explain the major security threats.
LO3 Describe security and enforcement measures.
LO4 Summarize the guidelines for a comprehensive
security system, including business continuity
planning.

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
2
 Chapter 5 Protecting Information Resources

Is Facebook a Friend or Fiend?

• In 2010, a hacker named Kirllos was peddling 1.5 million
stolen Facebook accounts for as little as 2.5 cents per
account
• If true, that would mean that one out of every 300
Facebook users were, unbeknownst to them, on the
market
• Cyber criminals use stolen accounts to spam, scam, and
otherwise profit from unwary Facebook users, who are
likely to respond to a familiar face or name without
realizing that the friend is a fiend

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
3
 Chapter 5 Protecting Information Resources

Computer and Network Security: Basic Safeguards

• Critical for most organizations
– Especially in recent years, with “hackers” becoming
more numerous and adept at stealing and altering
private information
• Hackers use a variety of tools to break into
computers and networks
– Sniffers, password crackers, and rootkits
– Journals Phrack and 2600: The Hacker Quarterly

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
4
 Chapter 5 Protecting Information Resources

Computer and Network Security: Basic Safeguards

(cont’d.)
• Comprehensive security system
– Protects an organization’s resources
– Including information and computer and network
equipment, e-mails, invoices transferred via electronic
data interchange (EDI), new product designs,
marketing campaigns, and financial statements
• Threats
– Include sharing passwords with coworkers, leaving a
computer unattended while logged on to the network,
or even spilling coffee on a keyboard
MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
5
 Chapter 5 Protecting Information Resources

Computer and Network Security: Basic Safeguards

(cont’d.)
• Comprehensive security system
– Includes hardware, software, procedures, and
personnel that collectively protect information
resources
• Confidentiality
– System must not allow disclosing information to
anyone who isn’t authorized to access it
– Secure government agencies
– Businesses
– E-commerce
MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
6
 Chapter 5 Protecting Information Resources

Computer and Network Security: Basic Safeguards

(cont’d.)
• Integrity
– Ensures the accuracy of information resources in an
organization
– Financial transactions
• Availability
– Ensures that computers and networks are operating
– Authorized users can access the information they
need

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
7
Exhibit 5.1 The McCumber Cube

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
8
 Chapter 5 Protecting Information Resources

Computer and Network Security: Basic Safeguards

(cont’d.)
• Three levels of security
– Level 1: front-end servers
– Level 2: back-end systems
– Level 3: corporate network
• Fault-tolerant systems
– Combination of hardware and software for improving
reliability
– Uninterruptible power supply (UPS)
– Redundant array of independent disks (RAID)
– Mirror disks
MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
9
 Chapter 5 Protecting Information Resources

Security Threats: An Overview

• Some threats can be controlled completely or
partially, but some can’t be controlled
• Categories
– Unintentional
– Intentional

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
10
 Chapter 5 Protecting Information Resources

Intentional Threats
• Viruses
• Worms
• Trojan programs
• Logic bombs
• Backdoors
• Blended threats (e.g., worm launched by Trojan)
• Rootkits
• Denial-of-service attacks
• Social engineering
MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
11
 Chapter 5 Protecting Information Resources

Viruses
• Type of malware
• In 2008, the number of computer viruses in
existence exceeded one million
• Estimating the dollar amount of damage viruses
cause can be difficult
• Usually given names
– I Love You, Michelangelo
• Consists of self-propagating program code that’s
triggered by a specified time or event

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
12
 Chapter 5 Protecting Information Resources

Viruses (cont’d.)
• Seriousness of viruses varies
• Transmitted through a network and e-mail
attachments
– Bulletin or message boards
• Virus hoaxes
– Can cause as much damage as real viruses
• Indications of a computer infected by a virus
• Best measure against viruses
– Installing and updating antivirus programs

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
13
 Chapter 5 Protecting Information Resources

Worms
• Travel from computer to computer in a network
– Do not usually erase data
• Independent programs that can spread
themselves without having to be attached to a
host program
• Replicate into a full-blown version that eats up
computing resources
• Well-known worms
– Code Red, Melissa, and Sasser

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
14
 Chapter 5 Protecting Information Resources

Trojan Programs
• Named after the Trojan horse the Greeks used
to enter Troy during the Trojan Wars
• Contains code intended to disrupt a computer,
network, or Web site
• Usually hidden inside a popular program

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
15
 Chapter 5 Protecting Information Resources

Logic Bombs
• Type of Trojan program used to release a virus,
worm, or other destructive code
• Triggered at a certain time or by an event

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
16
 Chapter 5 Protecting Information Resources

Backdoors
• Programming routine built into a system by its
designer or programmer
• Enable the designer or programmer to bypass
system security and sneak back into the system
later to access programs or files
• System users aren’t aware a backdoor has been
activated

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
17
 Chapter 5 Protecting Information Resources

Blended Threats
• Combine the characteristics of computer viruses,
worms, and other malicious codes with
vulnerabilities found on public and private
networks
• Main goal is not just to start and transmit an
attack, but also to spread it
• Multi-layer security system could guard against
blended threats

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
18
 Chapter 5 Protecting Information Resources

Denial-of-Service Attacks
• Flood a network or server with service requests
– Prevent legitimate users’ access to the system
• Target Internet servers
• Distributed denial-of-service (DDoS) attack
– Hundreds or thousands of computers work together
to bombard a Web site with thousands of requests for
information in a short period
– Difficult to trace

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
19
 Chapter 5 Protecting Information Resources

Social Engineering
• Using “people skills” to trick others into revealing
private information
– Takes advantage of the human element of security
systems
• Use the private information they’ve gathered to
break into servers and networks and steal data
• Commonly used social-engineering techniques
– “Dumpster diving” and “shoulder surfing”

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
20
 Chapter 5 Protecting Information Resources

Protecting Against Data Theft and Data Loss

• Portable storage media
– Theft or loss of media
– Stealing company data
• Guidelines to protect against these risks

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
21
 Chapter 5 Protecting Information Resources

Security Measures and Enforcement: An Overview

• Biometric security measures
• Nonbiometric security measures
• Physical security measures
• Access controls
• Virtual private networks
• Data encryption
• E-commerce transaction security measures
• Computer Emergency Response Team

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
22
 Chapter 5 Protecting Information Resources

Biometric Security Measures

• Use a physiological element to enhance security
measures
• Devices and measures
– Facial recognition – Vein analysis
– Fingerprints – Voice recognition
– Hand geometry
– Iris analysis
– Palmprints
– Retinal scanning
– Signature analysis
MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
23
 Chapter 5 Protecting Information Resources

Biometrics at Phoebe Putney Memorial Hospital

• Phoebe Putney Memorial Hospital switched to

fingerprint scanners, which, along with a single
sign-on application, made the electronic health
record system both easier to use and more
secure

• Another advantage of fingerprint scanners: They

don’t tend to get lost, like smart cards

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
24
Exhibit 5.2 Examples of Biometric Devices

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
25
 Chapter 5 Protecting Information Resources

Nonbiometric Security Measures

• Main security measures:
– Callback modems
– Firewalls
– Intrusion detection systems

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
26
 Chapter 5 Protecting Information Resources

Callback Modems
• Verify whether a user’s access is valid by:
– Logging the user off
– Calling the user back at a predetermined number
• Useful in organizations with many employees
who work off-site

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
27
 Chapter 5 Protecting Information Resources

Firewalls
• Combination of hardware and software
• Act as a filter or barrier between a private
network and external computers or networks
• Network administrator defines rules for access
• Examine data passing into or out of a private
network
– Decide whether to allow the transmission based on
users’ IDs, the transmission’s origin and destination,
and the transmission’s contents

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
28
Exhibit 5.3 A Basic Firewall Configuration

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
29
 Chapter 5 Protecting Information Resources

Firewalls (cont’d.)
• Possible actions after examining packet
– Reject the incoming packet
– Send a warning to the network administrator
– Send a message to the packet’s sender that the
attempt failed
– Allow the packet to enter (or leave) the private
network

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
30
 Chapter 5 Protecting Information Resources

Firewalls (cont’d.)
• Main types of firewalls
– Packet-filtering firewalls
– Application-filtering firewalls
– Proxy servers

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
31
Exhibit 5.4 A Proxy Server

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
32
 Chapter 5 Protecting Information Resources

Intrusion Detection Systems

• Protect against both external and internal access
• Placed in front of a firewall
• Prevent against DoS attacks
• Monitor network traffic
• “Prevent, detect, and react” approach
• Require a lot of processing power and can affect
network performance

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
33
 Chapter 5 Protecting Information Resources

Physical Security Measures

• Primarily control access to computers and
networks
• Include:
– Cable shielding
– Corner bolts
– Electronic trackers
– Identification (ID) badges
– Proximity-release door openers
– Room shielding
– Steel encasements
MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
34
 Chapter 5 Protecting Information Resources

Lost and Stolen Laptops

• Recommendations:
– Install cable locks and use biometric measures
– Only store confidential data when necessary
– Use passwords
– Encrypt data
– Install security chips

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
35
 Chapter 5 Protecting Information Resources

Access Controls
• Terminal resource security
– Software feature that erases the screen and signs the
user off automatically after a specified length of
inactivity
• Password
– Combination of numbers, characters, and symbols
that’s entered to allow access to a system
– Length and complexity determine its vulnerability to
discovery
– Guidelines for strong passwords

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
36
 Chapter 5 Protecting Information Resources

Virtual Private Networks

• Provide a secure “tunnel” through the Internet
– For transmitting messages and data via a private
network
• Remote users have a secure connection to the
organization’s network
• Low cost
• Slow transmission speeds

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
37
 Chapter 5 Protecting Information Resources

Data Encryption
• Transforms data, called “plaintext” or
“cleartext,” into a scrambled form called
“ciphertext”
• Rules for encryption determine how simple or
complex the transformation process should be
– Known as the “encryption algorithm”
• Protocols:
– Secure Sockets Layer (SSL)
– Transport Layer Security (TLS)

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
38
 Chapter 5 Protecting Information Resources

Data Encryption (cont’d.)

• Key size
– Between 32 and 168 bits
• Main types of encryption
– Asymmetric also called “public key encryption”
– Symmetric

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
39
Exhibit 5.7 Using Encryption

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
40
 Chapter 5 Protecting Information Resources

E-commerce Transaction Security Measures

• Three factors are critical for security:
– Authentication
– Confirmation
– Nonrepudiation
• Transaction security
– Confidentiality
– Authentication
– Integrity
– Nonrepudiation of origin
– Nonrepudiation of receipt
MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
41
 Chapter 5 Protecting Information Resources

Computer Emergency Response Team

• Developed by the Defense Advanced Research
Projects Agency
• Focuses on security breaches and DoS attacks
• Offers guidelines on handling and preventing
these incidents
• Cyber Incident Response Capability
– CIRC, http://www.doecirc.energy.gov/aboutus.html

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
42
 Chapter 5 Protecting Information Resources

Guidelines for Comprehensive Security System

• Train employees
• Guidelines and steps involved:
– People
– Procedures
– Equipment and technology

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
43
 Chapter 5 Protecting Information Resources

Business Continuity Planning

• Outlines procedures for keeping an organization
operational
• Prepare for disaster
• Plan steps for resuming normal operations as
soon as possible

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
44
 Chapter 5 Protecting Information Resources

Summary
• Types of threat
• Basic safeguards
– Biometric
– Nonbiometric
• Fault tolerance
• Establish comprehensive security system and
business continuity plan

MIS, Chapter 5
©2011 Course Technology, a part of Cengage Learning
45