Ch.5 It Security, Crime, Compliance, and Continuity Lecture 4 Ch.5 It Security, Crime, Compliance, and Continuity

5.1 Protecting Data and Business Operations IT security: the protection of data, systems, networks, and operations. Technology defenses are necessary, but they’re not suff icient because protecting data and business operations also involves: Implementing and enforcing acceptable use policies (AUPs). Complying with government regulations and laws. Making data available 24x7 while restricting access. Promoting secure and legal sharing of information.

IT Security Principles

Know Your Enemy and Your Risks IT security risks are business risks Threats range from high-tech exploits to gain acce ss to a company’s networks to non-tech tactics su ch as stealing laptops or items of value. Common examples: Malware (malicious software): viruses, worms, trojan hors es, spyware, and disruptive or destructive programs insider error or action, either intentional or unintentional. Fraud Fire, flood, or other natural disasters

IT at Work 5.1 $100 Million Data Breach May 2006: a laptop and external hard drive belo nging to the U.S. Dept of Veterans Affairs (VA) w ere stolen during a home burglary. Data on 26.5 million veterans and spouses had b een stored in plaintext. VA Secretary Jim Nicholson testified before Cong ress that it would cost at least $10 million just to inform veterans of the security breach. Total cost of data breach: $100 million

Risks Cloud computing Social networks Phishing Search engine manipulation Money laundering Organized crime Terrorist financing

IT Security Defense-in-Depth Model

5.2 IS Vulnerabilities and Threats Unintentional human error environmental hazards computer system failure Intentional hacking malware manipulation

Figure 5.4 How a computer virus can spread

Malware and Botnet Defenses Anti-virus software Firewalls Intrusion detection systems (IDS) Intrusion prevention systems (IPS)

5.4 IT and Network Security Objectives of a defense strategy Prevention and deterrence Detection Containment (minimize loses, damage control) Recovery Correction Awareness and compliance

Major categories of general controls physical controls access controls biometric controls communication network controls administrative controls application controls endpoint security and control

Figure 5.7 Intelligent agents

Figure 5.8 Three layers of network security measures

Ethical issues Implementing security programs raises many ethical iss ues. Handling the privacy versus security dilemma is tough. Ethical and legal obligations that may require compani es to “invade the privacy” of employees and monitor t heir actions. Under the doctrine of duty of care, senior managers a nd directors have a obligation to use reasonable care t o protect the company’s business operations.