Information Systems Security Chapter 5

Describe general approaches to analyzing vulnerabilities and Learning Objective 1 Describe general approaches to analyzing vulnerabilities and threats in information systems.

Overview The information security system is the subsystem of the organization that controls the special risks associated with computer-based information systems. The information security system has the basic elements of any information system, such as hardware, databases, procedures, and reports.

The Information Security System Life Cycle Life-cycle Phase Objective Systems analysis Analyze system vulnerabilities in terms of relevant threats and their associated loss exposure. Systems design Design security measures and contingency plans to control the identified loss exposures.

The Information Security System Life Cycle Life-cycle Phase Objective Systems implementation Implement the security measures as designed. Systems operation, evaluation, and control Operate the system and assess its effectiveness and efficiency. Make changes as circumstances require.

The Information Security System in the Organization The information security system must be managed by a chief security officer (CSO). This individual should report directly to the board of directors in order to maintain complete independence.

Analyzing Vulnerabilities and Threats Different Approaches: Quantitative approach to risk assessment Qualitative approach

Analyzing Vulnerabilities and Threats Quantitative Approach: Cost of an individual loss  Likelihood of its occurrence

Analyzing Vulnerabilities and Threats Difficulties With This Approach: Identifying the relevant costs per loss and the associated likelihoods can be difficult. Estimating the likelihood of a given failure requires predicting the future, which is very difficult.

Analyzing Vulnerabilities and Threats Qualitative Approach: The system’s vulnerabilities and threats are subjectively ranked in order of their contribution to the company’s total loss exposure.

Analyzing Vulnerabilities and Threats Loss Exposure Areas: business interruption loss of software loss of data loss of hardware loss of facilities loss of service and personnel

Identify active and passive threats to information systems. Learning Objective 2 Identify active and passive threats to information systems.

Vulnerabilities and Threats What is a vulnerability? A vulnerability is a weakness in a system. What is a threat? A threat is a potential exploitation of a vulnerability.

Vulnerabilities and Threats Categories of Threats: Active threats Passive threats

Individuals Posing a Threat to the Information System Groups of individuals that could be involved in an information system’s attack: Information systems personnel Users Intruders

Individuals Posing a Threat to the Information System Information Systems Personnel: computer maintenance persons programmers network operators information systems administrative personnel data control clerks

Individuals Posing a Threat to the Information System Users are composed of heterogeneous groups of people. Their functional area does not lie in data processing. An intruder is anyone who accesses equipment, electronic data, or files without proper authorization. Who are hackers?

Individuals Posing a Threat to the Information System A hacker is an intruder who attacks a system for fun and challenge. What are other types of intruders? unnoticed intruders wiretappers piggybackers impersonating intruders eavesdroppers

Active Threats to Information Systems Input manipulation Sabotage Program alteration Misappropriation or theft of information resources Direct file alteration Data theft

Active Threats to Information Systems In most cases of computer fraud, manipulation of input is the method used. Program alteration is perhaps the least common method used to commit computer fraud.

Active Threats to Information Systems A direct file alteration occurs when individuals find ways to bypass the normal process for inputting data into computer programs. Data theft is a serious problem in business today. What are some methods of computer sabotage?

Active Threats to Information Systems Logic bomb Trojan horse Virus program Denial of service attack Defacing the company’s Web site

Active Threats to Information Systems What is a worm? It is a type of virus that spreads itself over a computer network.

Active Threats to Information Systems One type of misappropriation of computer resources exists when employees use company computers resources for their own business.

Identify key aspects of an information security system. Learning Objective 3 Identify key aspects of an information security system.

The Information System Security System Security measures focus on preventing and detecting threats. Contingency plans focus on correcting the effects of threats.

The Control Environment Management philosophy and operating style 1 Organization structure 2 Board of directors and its committees 3

The Control Environment 4 Management control activities 5 Internal audit function 6 Personnel policies and practices 7 External influences

Controls for Active Threats Layered Approach to Access Control: Site-access controls System-access controls File-access controls

Controls for Active Threats Site-Access Controls: The objective of site-access controls is to physically separate unauthorized individuals from computer resources.

Controls for Active Threats TV monitor Telephone Locked door (entrance) (opened from inside vault) Intercom to vault LOBBY Service window Data archive INNER VAULT Scanner Magnet detector

Controls for Active Threats System-Access Controls: These controls authenticate users by using such means as user IDs, passwords, IP addresses, and hardware devices. It is often desirable to withhold “administrative rights” from individual PC users.

Controls for Active Threats File-Access Controls: The most fundamental file-access control is the establishment of authorization guidelines and procedures for accessing and altering files.

Controls for Passive Threats Preventative: Fault-tolerant systems use redundant components. If one part of the system fails, a redundant part immediately takes over, and the system continues operating with little or no interruption.

Controls for Passive Threats Corrective: File Backups Full backups Incremental backups Differential backups

Internet Security Internet-related vulnerabilities may arise from weaknesses in five areas. the operating system or its configuration the Web server or its configuration the private network and its configuration various server programs general security procedures

Discuss contingency planning and other disaster risk Learning Objective 4 Discuss contingency planning and other disaster risk management practices.

Disaster Risk Management Disaster risk management is essential to ensure continuity of operations in the event of a catastrophe. Prevention planning Contingency planning

Disaster Risk Management Frequencies of Disaster Causes: Natural disaster 30% Deliberate actions 45% Human error 25% A large percentage of disasters can be mitigated or avoided.

Disaster Risk Management A disaster recovery plan must be implemented at the highest levels in the company. The first step in developing a disaster recovery plan should be obtaining the support of senior management and setting up a planning committee.

Disaster Risk Management The design of the plan should include three major components. What are these components? Assess the company’s critical needs. List priorities for recovery. Establish recovery strategies and procedures.

Disaster Risk Management A complete set of recovery strategies should take into account the following: emergency response center escalation procedures alternate processing arrangements personnel relocation and replacements plans salvage plan plan for testing and maintaining the system

End of Chapter 5