Chapter 11: Computer Crime, Fraud, Ethics, and Privacy Introduction Computer Crime, Abuse, and Fraud Three Examples of Computer Crimes Preventing Computer Crime and Fraud Ethical Issues, Privacy, and Identity Theft

Computer Crime, Abuse, and Fraud High level of public interest Data on incidents is limited Sources of information Computer Security Institute (CSI) annual survey KPMG surveys Association of Certified Fraud Examiners (ACFE) survey

Computer Crime, Abuse, and Fraud Manipulation of a computer or computer data Dishonestly obtain money, acquire property, or something of value, or cause a loss Computer Abuse Unauthorized use of, or access to, a computer Against the wishes of the owner

Computer Crime Examples

Computer Crime, Abuse, and Fraud Fraudulent Financial Reporting Intentional falsification of accounting records Intend to mislead analysts, creditors, investors Misappropriation of Assets Misuse of company assets Committed by employees within an organization

Asset Misappropriation Examples

Federal Legislation of Computer Crimes Computer Fraud and Abuse Act of 1986 (CFAA) Amended in 1994 and 1996 Computer Fraud Definition An illegal act Computer technology essential for perpetration, investigation, or prosecution

CFAA Fraudulent Acts Unauthorized theft, use, access, modification, copying, or destruction of software or data Theft of money by altering computer records or the theft of computer time Intent to illegally obtain information or tangible property through the use of computers

CFAA Fraudulent Acts Use, or the conspiracy to use, computer resources to commit a felony Theft, vandalism, destruction of computer hardware Trafficking in passwords or other login information for accessing a computer Extortion that uses a computer system as a target

Federal Legislation Affecting the Use of Computers

Federal Legislation Affecting the Use of Computers

State Legislation Every state has a computer crime law State law provisions Define computer terms Define some acts as misdemeanors Declare other acts as felonies

Study Break #1 Which of the following pieces of computer legislation is probably the most important? Cyber Security Enhancement Act of 2002 Computer Security Act of 1987 The Computer Fraud and Abuse Act of 1986 Federal Privacy Act of 1974

Study Break #1 - Answer Which of the following pieces of computer legislation is probably the most important? Cyber Security Enhancement Act of 2002 Computer Security Act of 1987 The Computer Fraud and Abuse Act of 1986 Federal Privacy Act of 1974

Study Break #2 Which legislation might help discourage computer hacking? Federal Privacy Act of 1974 Computer Fraud and Abuse Act of 1986 USA Patriot act of 2001 CAN-SPAM Act of 2003

Study Break #2 - Answer Which legislation might help discourage computer hacking? Federal Privacy Act of 1974 Computer Fraud and Abuse Act of 1986 USA Patriot act of 2001 CAN-SPAM Act of 2003

Computer-Crime Statistics Limited availability of data Private companies handle abuse internally Most computer abuse is probably not discovered Growth of computer crime Exponential growth in use of computer resources Continuing lax security Availability of information about how to perpetrate computer crimes

Importance of Computer Crime and Abuse to AISs Impact on AISs Favored target due to control of financial resources Prized target for disgruntled employees Responsible for designing, selecting, and implementing controls that protect AISs Reliance on auditors to verify financial statement Additional Items Ability to mislead public if information is incomplete or inaccurate Difficulty in detecting fraudulent activities Large amount of losses

Compromising Valuable Information: The TRW Credit Data Case Summary Credit rating company Altered company credit ratings for a fee Clients relied on inaccurate information Analysis Data diddling – proprietary data Fair Credit Reporting Act – protection of consumer

Wire Fraud and Computer Hacking: Edwin Pena and Robert Moore Summary Voice over Internet Protocol (VoIP) Hacked into other provider’s network Billed those companies Analysis Growth of hacking Importance of education and prevention Utilize ethical hackers for instrusion testing

Denial of Service: The 2003 Internet Crash Summary Slammer worm Identified weakness in Microsoft SQL Server 2000 software Analysis Denial of Service (DOS) attacks Computer Viruses Computer Worms and Worm Programs Boot-sector Viruses and Trojan Horse Programs

Protecting Systems Preventing Viruses Firewalls Antivirus software Antivirus control procedures Organizational Control Procedures Discourage free exchange of computer disks or external programs Require strong passwords to limit unauthorized access Use antivirus filters

Common Types of Computer Crime and Abuse

Preventing Computer Crime and Fraud Enlist Top-Management Support Increase Employee Awareness and Education Assess Security Policies and Protect Passwords Strong passwords Social engineering Lock-out systems Dialback systems

10 Simple Steps to Safer PCs

10 Simple Steps to Safer PCs

Preventing Computer Crime and Fraud Implement Controls Identify Computer Criminals Nontechnical Backgrounds Noncriminal Backgrounds Education, Gender, and Age Don’t Forget Physical Security Employ Forensic Accountants

Occupations of Computer Abuse Offenders

Fraud Losses and Education Level of Perpetrator

Recognizing Symptoms of Employee Fraud Accounting Irregularities Internal Control Weaknesses Unreasonable Anomalies Lifestyle Changes Behavioral Changes

Study Break #3 Which of these is not helpful in attempting to thwart computer crime and abuse? Enlist the support of top management Keep employees in the dark so that they cannot perpetrate them Use strong passwords Design and test disaster recovery programs

Study Break #3 - Answer Which of these is not helpful in attempting to thwart computer crime and abuse? Enlist the support of top management Keep employees in the dark so that they cannot perpetrate them Use strong passwords Design and test disaster recovery programs

Study Break #4 Most computer criminals: Have nontechnical backgrounds Have noncriminal backgrounds Have little college education Are young and bright Have probably not been caught, so we don’t know much about them

Study Break #4 - Answer Most computer criminals: Have nontechnical backgrounds Have noncriminal backgrounds Have little college education Are young and bright Have probably not been caught, so we don’t know much about them

Ethical Issues, Privacy, and Identity Theft Ethics A set of moral principles or values Governs organizations and individuals Ethical behavior Making choices and judgments that are morally proper Acting accordingly

Ethical Issues, Privacy, and Identity Theft Ethical Issues and Professional Associations Codes of Ethics/Professional Conduct Certification programs and Ethics committees Meeting the Ethical Challenges Inform employees of importance of ethics Ethics training Lead by example Utilize reward system

Ethical Issues in Computer Usage

Ethical Issues, Privacy, and Identity Theft Company Policies with Respect to Privacy Who owns the computer and data stored on it? What purposes the computer may be used? What uses are authorized or prohibited? Identity Theft Dumpster diving Phishing Smishing

Identity Theft Methods

Study Break #5 Smishing is a form of: Dial-back system Local area network Computer worm Identity theft

Study Break #5 - Answer Smishing is a form of: Dial-back system Local area network Computer worm Identity theft

Copyright Copyright 2012 John Wiley & Sons, Inc. All rights reserved. Reproduction or translation of this work beyond that permitted in Section 117 of the 1976 United States Copyright Act without the express written permission of the copyright owner is unlawful. Request for further information should be addressed to the Permissions Department, John Wiley & Sons, Inc. The purchaser may make backup copies for his/her own use only and not for distribution or resale. The Publisher assumes no responsibility for errors, omissions, or damages, caused by the use of these programs or from the use of the information contained herein.

Chapter 11