Chapter 17 Risks, Security and Disaster Recovery Management Information Systems, 4th Edition
Learning Objectives Describe the primary goals of information security Enumerate the main types of risks to information systems List the various types of attacks on networked systems Management Information Systems, 4th Edition
Learning Objectives (Cont.) Describe the types of controls required to ensure the integrity of data entry and processing and uninterrupted e-commerce Describe the various kinds of security measures that can be taken to protect data and ISs Outline the principles of how organizations develop recovery plans Explain the economic aspects of information security Management Information Systems, 4th Edition
Goals of Information Security Reduce the risk of systems and organizations ceasing operations Maintain information confidentiality Ensure the integrity and reliability of data resources Ensure the uninterrupted availability of data resources and online operations Ensure compliance with national security laws and privacy policies and laws Management Information Systems, 4th Edition
Risks to Information Systems Risks to Hardware Natural disasters Blackouts and brownouts Vandalism Management Information Systems, 4th Edition
Risks to Information Systems (Cont.) Risks to Applications and Data Theft of information Social engineering and identity theft Data alteration, data destruction, and Web defacement Computer viruses, worms, and logic bombs Nonmalicious mishaps Management Information Systems, 4th Edition
Risks to Online Operations Denial of service Hijacking Spoofing Management Information Systems, 4th Edition
Risks to Online Operations Management Information Systems, 4th Edition
Controls Management Information Systems, 4th Edition
Controls (Cont.) Program Robustness and Data Entry Controls Backup Provide a clear and sound interface with the user Menus and limits Backup Periodic duplication of all data Access Controls Ensure that only authorized people can gain access to systems and files Access codes and passwords Management Information Systems, 4th Edition
Controls (Cont.) Management Information Systems, 4th Edition
Controls (Cont.) Atomic Transactions Audit Trails Ensures that transaction data are recorded properly in all the pertinent files to ensure integrity Audit Trails Built into an IS so that transactions can be traced to people, times, and authorization information Management Information Systems, 4th Edition
Controls (Cont.) Management Information Systems, 4th Edition
Security Measures Firewalls Defense against unauthorized access to systems over the Internet Controls communication between a trusted network and the “untrusted” Internet Proxy Server: represents another server for all information requests and acts as a buffer Management Information Systems, 4th Edition
Security Measures (Cont.) Management Information Systems, 4th Edition
Authentication and Encryption Keeps communications secret Authentication: the process of ensuring the identity of the person sending the message Encryption: coding a message into a form unreadable to an interceptor Management Information Systems, 4th Edition
Authentication and Encryption (Cont.) Management Information Systems, 4th Edition
Authentication and Encryption (Cont.) Encryption Strength Distribution Restrictions Public-key Encryptions Symmetric and asymmetric encryption Secure Sockets Layer and Secure Hypertext Transport Protocol Pretty Good Privacy Management Information Systems, 4th Edition
Authentication and Encryption (Cont.) Management Information Systems, 4th Edition
Authentication and Encryption (Cont.) Management Information Systems, 4th Edition
Digital Signatures and Digital Certificates Electronic Signatures Digital Signatures Digital Certificates Management Information Systems, 4th Edition
Digital Signatures and Digital Certificates (Cont.) Management Information Systems, 4th Edition
Digital Signatures and Digital Certificates (Cont.) Management Information Systems, 4th Edition
The business recovery plan Obtain management’s commitment to the plan Establish a planning committee Perform risk assessment and impact analysis Prioritize recovery needs: critical, vital, sensitive, noncritical Management Information Systems, 4th Edition
The business recovery plan (Cont.) Select a recovery plan Select vendors Develop and implement the plan Test the plan Continually test and evaluate Management Information Systems, 4th Edition
Recovery plan providers Companies that specialize in either disaster recovery planning or provision of alternate sites Small companies can opt for Web-based services Management Information Systems, 4th Edition
The IS Security Budget Management Information Systems, 4th Edition
The IS Security Budget (Cont.) How much security is enough security? Calculating downtime Management Information Systems, 4th Edition
The IS Security Budget (Cont.) Management Information Systems, 4th Edition
Ethical and Societal Issues Terrorism, Carnivores, and Echelons Carnivorous methods FBI developed Carnivore Device is attached to the ISP servers to monitor email Top Echelon Surveillance system Management Information Systems, 4th Edition
Summary Information Security has certain major goals There are different types of risks to information systems There are various types of attacks on networked systems There are different types of controls that ensure integrity of data and e-commerce There are various measures that can protect data and ISs Management Information Systems, 4th Edition