Management Information Systems:

Managing the Digital Firm

Fifteenth edition

Chapter 8
Securing Information
Systems

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Learning Objectives
•
8-1 Why are information systems vulnerable to destruction, error, and abuse?
•
8-2 What is the business value of security and control?
•
8-3 What are the components of an organizational framework for security and control?
•
8-4 What are the most important tools and technologies for safeguarding information
resources?

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Video Cases
• Case 1: Stuxnet and Cyberwarfare
• Case 2: Cyberespionage: The Chinese Threat
• Instructional Video 1: Sony PlayStation Hacked;
Data Stolen from 77 Million Users
• Instructional Video 2: Meet the Hackers:
Anonymous Statement on Hacking Sony

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Hackers Attack the SWIFT Global Banking
Network (1 of 2)
• Problem
– Loose management structure
– Tempting hacker target
– Uneven security and controls

• Solutions
– Develop security policies, plan, procedures
– Firewalls
– Anti-malware
– Two-factor authentication

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Hackers Attack the SWIFT Global Banking
Network (2 of 2)
• Hackers took advantage of uneven security and
controls and loose management structure to
attack SWIFT
• Demonstrates vulnerabilities in information
technology systems
• Illustrates the some of the reasons businesses
need to pay special attention to information
system security

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Why Systems Are Vulnerable (1 of 2)
• Security
– Policies, procedures, and technical measures used to prevent
unauthorized access, alteration, theft, or physical damage to
information systems

• Controls
– Methods, policies, and organizational procedures that ensure
safety of organization’s assets; accuracy and reliability of its
accounting records; and operational adherence to management
standards

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Why Systems Are Vulnerable (2 of 2)
• Accessibility of networks
• Hardware problems (breakdowns, configuration errors,
damage from improper use or crime)
• Software problems (programming errors, installation
errors, unauthorized changes)
• Disasters
• Use of networks/computers outside of firm’s control
• Loss and theft of portable devices

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Figure 8.1: Contemporary Security
Challenges and Vulnerabilities

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Internet Vulnerabilities
– Network open to anyone
– Size of Internet means abuses can have wide impact
– Use of fixed Internet addresses with cable / DSL modems
creates fixed targets for hackers
– Unencrypted VOIP
– E-mail, P2P, IM
• Interception
• Attachments with malicious software
• Transmitting trade secrets

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Wireless Security Challenges
• Radio frequency bands easy to scan
• SSIDs (service set identifiers)
– Identify access points, broadcast multiple times, can be identified
by sniffer programs

• War driving
– Eavesdroppers drive by buildings and try to detect SSID and gain
access to network and resources
– Once access point is breached, intruder can gain access to
networked drives and files

• Rogue access points

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Figure 8.2: Wi-Fi Security Challenges

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Malicious Software: Viruses, Worms, Trojan
Horses, and Spyware (1 of 2)
• Malware (malicious software)
• Viruses
• Worms
• Worms and viruses spread by
– Downloads and drive-by downloads
– E-mail, IM attachments

• Mobile device malware

• Social network malware

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Malicious Software: Viruses, Worms, Trojan
Horses, and Spyware (2 of 2)
• Trojan horse
• SQL injection attacks
• Ransomware
• Spyware
– Key loggers
– Other types
 Reset browser home page
 Redirect search requests
 Slow computer performance by taking up memory

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Hackers and Computer Crime (1 of 3)
• Hackers vs. crackers
• Activities include:
– System intrusion
– System damage
– Cybervandalism
 Intentional disruption, defacement, destruction of website or corporate
information system

• Spoofing and sniffing

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Hackers and Computer Crime (2 of 3)
• Denial-of-service attacks (DoS)
• Distributed denial-of-service attacks (DDoS)
• Botnets
• Spam
• Computer crime
– Computer may be target of crime
– Computer may be instrument of crime

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Hackers and Computer Crime (3 of 3)
• Identity theft
– Phishing
– Evil twins
– Pharming

• Click fraud
• Cyberterrorism
• Cyberwarfare

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Internal Threats: Employees
– Security threats often originate inside an
organization
– Inside knowledge
– Sloppy security procedures
• User lack of knowledge

– Social engineering
– Both end users and information systems
specialists are sources of risk

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Software Vulnerability
• Commercial software contains flaws that create
security vulnerabilities
– Bugs (program code defects)
– Zero defects cannot be achieved because complete testing is not
possible with large programs
– Flaws can open networks to intruders

• Patches
– Small pieces of software to repair flaws
– Exploits often created faster than patches can be released and
implemented

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
What Is the Business Value of Security and
Control?
• Failed computer systems can lead to significant or
total loss of business function
• Firms now are more vulnerable than ever
– Confidential personal and financial data
– Trade secrets, new products, strategies

• A security breach may cut into a firm’s market

value almost immediately
• Inadequate security and controls also bring forth
issues of liability

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Legal and Regulatory Requirements for
Electronic Records Management
• HIPAA
– Medical security and privacy rules and procedures

• Gramm-Leach-Bliley Act
– Requires financial institutions to ensure the security and
confidentiality of customer data

• Sarbanes-Oxley Act
– Imposes responsibility on companies and their management to
safeguard the accuracy and integrity of financial information that is
used internally and released externally

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Electronic Evidence and Computer
Forensics
• Electronic evidence
– Evidence for white collar crimes often in digital form
– Proper control of data can save time and money when responding
to legal discovery request

• Computer forensics
– Scientific collection, examination, authentication, preservation,
and analysis of data from computer storage media for use as
evidence in court of law
– Recovery of ambient data

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Information Systems Controls
• May be automated or manual
• General controls
– Govern design, security, and use of computer programs and
security of data files in general throughout organization
– Software controls, hardware controls, computer operations
controls, data security controls, system development controls,
administrative controls,

• Application controls
– Controls unique to each computerized application
– Input controls, processing controls, output controls

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Interactive Session: Organizations: The
Flash Crash: A New Culprit
• Class discussion
– Identify the problem and the control weaknesses described in this
case.
– What management, organization, and technology factors
contributed to this problem? To what extent was it a technology
problem? To what extent was it a management and organizational
problem?
– To what extent was Sarao responsible? Explain your answer.
– Is there an effective solution to this problem? Can another flash
crash be prevented? Explain your answer.

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Risk Assessment
• Determines level of risk to firm if specific activity or
process is not properly controlled
• Types of threat
• Probability of occurrence during year
• Potential losses, value of threat
• Expected annual loss

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Table 8.5 Online Order Processing Risk
Assessment
EXPOSURE PROBABILITY LOSS RANGE EXPECTED
OF (AVERAGE) ($) ANNUAL LOSS
OCCURRENCE ($)
Power failure 30% $5,000 - $200,000 $30,750
($102,500)
Embezzlement 5% $1,000 - $50,000 $1275
($25,500)
User error 98% $200 - $40,000 $19,698
($20,100)

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Security Policy
• Ranks information risks, identifies acceptable
security goals, and identifies mechanisms for
achieving these goals
• Drives other policies
– Acceptable use policy (AUP)
 Defines acceptable uses of firm’s information resources and computing
equipment

• Identity management
– Identifying valid users
– Controlling access

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Figure 8.3: Access Rules for a Personnel
System

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Disaster Recovery Planning and Business
Continuity Planning
• Disaster recovery planning
– Devises plans for restoration of disrupted services

• Business continuity planning

– Focuses on restoring business operations after disaster

• Both types of plans needed to identify firm’s most

critical systems
– Business impact analysis to determine impact of an outage
– Management must determine which systems restored first

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
The Role of Auditing
• Information systems audit
– Examines firm’s overall security environment as well as controls
governing individual information systems

• Security audits
– Review technologies, procedures, documentation, training, and personnel
– May even simulate disaster to test responses

• List and rank control weaknesses and the probability of

occurrence
• Assess financial and organizational impact of each threat

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Figure 8.4: Sample Auditor’s List of Control
Weaknesses

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
What Are the Most Important Tools and
Technologies for Safeguarding Information
Systems? (1 of 3)
• Identity management software
– Automates keeping track of all users and privileges
– Authenticates users, protecting identities, controlling access

• Authentication
– Password systems
– Tokens
– Smart cards
– Biometric authentication
– Two-factor authentication

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
What Are the Most Important Tools and
Technologies for Safeguarding Information
Systems? (2 of 3)
• Firewall
– Combination of hardware and software that prevents unauthorized
users from accessing private networks
– Technologies include:
 Packet filtering
 Stateful inspection
 Network address translation (NAT)
 Application proxy filtering

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Figure 8.5: A Corporate Firewall

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
What Are the Most Important Tools and
Technologies for Safeguarding Information
Systems? (3 of 3)
• Intrusion detection system
– Monitors hot spots on corporate networks to detect and deter
intruders

• Antivirus and antispyware software

– Checks computers for presence of malware and can often
eliminate it as well
– Requires continual updating

• Unified threat management (UTM) systems

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Securing Wireless Networks
• WEP security
– Static encryption keys are relatively easy to crack
– Improved if used in conjunction with VPN

• WPA2 specification
– Replaces WEP with stronger standards
– Continually changing, longer encryption keys

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Encryption and Public Key Infrastructure
(1 of 3)
• Encryption
– Transforming text or data into cipher text that cannot be read by
unintended recipients
– Two methods for encryption on networks
 Secure Sockets Layer (SSL) and successor Transport Layer Security (TLS)
 Secure Hypertext Transfer Protocol (S-HTTP)

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Encryption and Public Key Infrastructure
(2 of 3)
• Two methods of encryption
– Symmetric key encryption
 Sender and receiver use single, shared key
– Public key encryption
 Uses two, mathematically related keys: public key and private key
 Sender encrypts message with recipient’s public key
 Recipient decrypts with private key

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Figure 8.6: Public Key Encryption

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Encryption and Public Key Infrastructure
(3 of 3)
• Digital certificate
– Data file used to establish the identity of users and electronic
assets for protection of online transactions
– Uses a trusted third party, certification authority (CA), to validate a
user's identity
– CA verifies user’s identity, stores information in CA server, which
generates encrypted digital certificate containing owner ID
information and copy of owner’s public key

• Public key infrastructure (PKI)

– Use of public key cryptography working with certificate authority
– Widely used in e-commerce

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Figure 8.7: Digital Certificates

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Ensuring System Availability
• Online transaction processing requires 100%
availability
• Fault-tolerant computer systems
– Contain redundant hardware, software, and power supply
components that create an environment that provides continuous,
uninterrupted service

• Deep packet inspection

• Security outsourcing
– Managed security service providers (MSSPs)

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Security Issues for Cloud Computing and
the Mobile Digital Platform (1 of 2)
• Security in the cloud
– Responsibility for security resides with company owning the data
– Firms must ensure providers provide adequate protection:
 Where data are stored
 Meeting corporate requirements, legal privacy laws
 Segregation of data from other clients
 Audits and security certifications
– Service level agreements (SLAs)

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Security Issues for Cloud Computing and
the Mobile Digital Platform (2 of 2)
• Securing mobile platforms
– Security policies should include and cover any special
requirements for mobile devices
 Guidelines for use of platforms and applications
– Mobile device management tools
 Authorization
 Inventory records
 Control updates
 Lock down/erase lost devices
 Encryption
– Software for segregating corporate data on devices

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Ensuring Software Quality
• Software metrics: Objective assessments of system in
form of quantified measurements
– Number of transactions
– Online response time
– Payroll checks printed per hour
– Known bugs per hundred lines of code

• Early and regular testing

• Walkthrough: Review of specification or design document
by small group of qualified people
• Debugging: Process by which errors are eliminated

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved
Interactive Session: Technology: BYOD: A
Security Nightmare?
• Class discussion
– It has been said that a smartphone is a computer in your hand.
Discuss the security implications of this statement.
– What kinds of security problems do mobile computing devices
pose?
– What management, organizational, and technology issues must
be addressed by smartphone security?
– What steps can individuals and businesses take to make their
smartphones more secure?

Copyright © 2018, 2017, 2016 Pearson Education, Inc. All Rights Reserved