SECURING INFORMATION

SYSTEMS
JULIUS GICHANE
 SYSTEM VULNERABILITY
• Computer networks create the avenue that
causes the systems to be so vulnerable today,
as compared to the traditional manual forms.
• Organizations must build security and control
• Security
– Policies, procedures, and technical measures to
prevent insecurity
• Controls
– Methods, policies and procedures to ensure safety,
accuracy, reliability and adherence to expected
standards in information of the organization
 POINTS OF VULNERABILITY
1. Workstation:
– Unauthorized access
– Errors
2. Communication lines
• Tapping
• Sniffing
• Message alteration
• Theft and fraud
• Radiation
 POINTS OF VULNERABILITY
3. Corporate severs
– Hacking
– Viruses and worms
– Theft and fraud
– Vandalism
– Denial of service attack (DoS)
4. Corporate systems (and databases)
• Theft of data
• Copying data
• Alteration of data
• Hardware failure
• Software failure
 MALICIOUS SOFTWARE
• These are also called malware. They
include
1. VIRUSES
2. WORMS
3. TROJAN HORSES
4. SPYWARE
 MALICIOUS SOFTWARE
• They include

1. VIRUSES
• Malicious Program code that attaches itself to other
software. When the main software is opened, the
malicious code is executed. It then causes computer and
software to malfunction. At times it can delete documents
in the computer.
2. WORMS
• Independent program code that can copy themselves from
computer to computer over the network.
 MALICIOUS SOFTWARE

4. TROJAN HORSES
• A program or other digital item (eg. a picture, a link on a
website, etc) that appears okay, but somewhere along the
way, it starts negatively affecting computer and programs,
just like viruses. Fake games can be used as trojans.
5. SPYWARE
– Function in the background to collect certain information
from a user. Some (called keyloggers) can collect
information of key strokes – and can easily learn a
person’s username and password.
 Hacking and computer crime
• Hacking is gaining unauthorized access to a
computer system. Some hackers engage in
cybervandalism (like defacing websites).
• Means that hackers use to gain information
include:
– Spoofing – use of fake e-mail addresses that
misrepresent others as the owner of the information
they are seeking
– Sniffing – use of programs to monitor and collect
information from the internet.
 Other forms of computer crime
• Other forms of computer crime include
1. Denial of service (DoS) – User is unable to
access the computer, or to run the programs
2. Identity theft
1. using phishing (setting fake website, e-mail)
2. Evil twins (set up fake wireless network)
3. Pharming – redirects users to a bogus
website
 Other security lapses
1. Employees exposing information, sharing
information with unauthorized people, not
putting enough security measures.
2. Software vulnerabilities: due to bugs.
Bugs are incorrect codes in a program,
or a code section that creates
vulnerability. They are corrected using
patches
 SYSTEM SECURITY AND
CONTROL MEASURES
• System Application controls can be implemented
as:
– Input controls
• Controls what data or information is allowed into the system,
and also its format. Data are checked for accuracy and
completeness during data entry.
– Processing controls
• Check data accuracy and completeness during updating

– Output controls
• Ensure that processed data are accurate and complete
 SYSTEM SECURITY AND
CONTROL MEASURES
• Security policies
1. Acceptable use policy (AUP)
• An acceptable use policy defines acceptable uses
of the firm’s information resources and computing
equipment.
• This includes use of desktop and laptop
computers, wireless devices, telephones and the
internet.
• A good AUP defines acceptable and
unacceptable actions for every user and specifies
consequences for noncompliance.
 SYSTEM SECURITY AND
CONTROL MEASURES
2. Authorization policies
• These provide differing levels of access to
information assets for different levels of users
SECURITY TECHNOLOGIES AND
TOOLS
1. Access Controls
• Authentication
• A way of an authorized user identifying him/herself to a
computer or computer resource. Several methods exist:
1. Use of strong passwords – Strong password are at least 8
characters long, which are a combination of alphaneumeric
and non-alphaneumeric ones.
2. Token – A physical item (similar to an ID card) that can prove
identity of user
3. Smart card – contains a chip formatted with access
permission and other data
4. Biometric authentication – systems that can read and interpret
individual traits – eg fingerprints.
SECURITY TECHNOLOGIES AND
TOOLS
2. Firewalls:
• Often a combination of hardware and software.
Controls flow of incoming and outgoing network
traffic. Controls type of traffic allowed, or computer
addresses allowed through the firewall
• The firewall system is an interface between the
internal and the external network.
3. Intrusion detection systems
• Monitors network points to detect malicious activity
4. Antivirus software
• To handle viruses, worms, spyware.
• Antivirus software has to be updated regularly since
new malicious codes are released almost on a daily
basis
SECURITY TECHNOLOGIES AND
TOOLS
5. Encryption
– The process of transforming plain text or data into
cipher text that cannot be read by anyone other
than the sender and the intended receiver.
– Data are encrypted using a secret numerical code.
6. Public Key Infrastructure (PKI) – uses
encryption and digital signatures
7. Unified Threat Management Systems
• Not a technology. Rather, several technologies are
combined to reduce cost of protection to a user
 DISASTER RECOVERY
PLANNING
• Measures need to be put in place to protect information
from physical loss due to theft, fire and such.
• A backup is a copy of critical organizational data that is
stored separate from the production system. It is used to
restore the system after a catastrophic disaster.
• A disaster recovery plan aims at restoring the system
after a disaster
• Business continuity planning aims at restoring business
processes within the shortest time possible after a
disaster.