COSC-100 (Elements of Computer Science) Prof. Juola Risks COSC-100 (Elements of Computer Science) Prof. Juola

Risks of Computing Basically, what can go wrong (involving computers)? Two basic problems Computers can fail to do what they are supposed to Computers can do what they are supposed to, but to public harm Problem of balancing obvious applications with negative side-effects.

Computer Crime Similar distinction : Using computers to commit crime Committing crime on computers Substantial problem : 70% of organizations surveyed had at least one “e-crime” in 2004 Impact measured in billions of dollars What’s really going on?

Examples Direct theft of information Misrepresentation and fraud Denial of service (DOS attacks) Extortion Software/media piracy Identity theft … and so forth

“Information” Is information property? Unlike a sandwich, someone cannot steal it from you BUT,… can be very expensive to make “Intellectual Property” (IP) legal term of art Patents Copyrights Trade Secrets

IP Problems Patents - used to protect physical inventions Time-limited monopoly for public disclosure Copyrights – used to protect works of art Covers only direct expression, not contents Trade secrets – used to protect “secrets” Must be handled through contracted agreement Which, if any, is appropriate for software?

Program problems Typical threat : “the wily hacker.” Plants “hostile code” on computer which does evil things to the recipient Viruses, worms, Trojan horses, the whole bestiary The real problem : software quality is low Anything a hacker can do deliberately, I can do by accident Software not adept at dealing with mistakes

Case in point : viruses Computer virus : attaches to existing pgm When program is executed, virus attaches to other accessible pgms and/or does something evil Why did you run the virus in the first place?

Mail viruses : next step Email contains executable program (along with note saying “run me!”) More subtle – email is executable program, and you have mail configured to automatically run programs. Again, why?

Reducing risks Secret is access control. Physical access important first step “Electronic” access second step Passwords Firewalls Encryption Appropriate network policies

Security vs. Privacy Sometimes cooperative – encryption keeps email secure and private Sometimes at odds – law enforcement wiretaps vs. expectations of phone privacy

Invading privacy Computers are good at mass data storage Sometimes mass data can be very personally identifiable. Business data – Giant Eagle cards – can constitute major threat to personal privacy. Cookies and browsing habits ditto Problem – the computer never forgets….

Safe surfing Don’t trust the label Set reasonable configuration options. Take security, esp. passwords, seriously If it’s sensitive, lock it up Prepare for the worst

Ethics Know the rules and the law … but don’t let them excuse you Think about worst-case scenarios Take the long view ACM provides good code of ethics (p. 465)