Chapter 9 - Control in Computerized Environment ATG 383 – Spring 2002

Computer Based Controls General control - any control that relates to more than one system. Application control - a control that relates to one phase of application processing (input, processing, output).

General Controls 12 controls are discussed on pages

1. Security Plan - What are the threats?

2a. Segregation of Duties - Systems Operations Users submit input Data control groups logs and reviews. Computer operations processes. Data control groups logs output. Users receive output Librarian

2b. Segregation of Duties - Systems Development Users request programming changes. Analysts develop specifications. Programmers make changes and test. Librarian maintains programs

3a. Project Development- Systems Development Long range plan Project development plan Assign responsibility to project manager Performance evaluations Post implementation review

3b. Management of AIS- Systems Operations Data processing schedule System performance measurements

4. Physical Access Controls Goal is to prevent unauthorized people from gaining access Locked rooms Security guards and cameras Identification badges

5. Logical Access Controls Identify who are authorized users. – System must assign “rights” to users. –See access control matrix, p. 294.

I will show you some examples of hacked web sites.

6. Data Storage Controls These controls can be used to protect data in addition to physical and logical access controls: –Properly supervised file library. –Labels. –Concurrent update controls.

6. Data Storage Controls Record locking - prevents two people from accessing a file at the same time. “A” wants to increase the balance by $20. “B” wants to decrease the balance by $50. Customer’s Balance = $100 Read balance - $100 Update - $120 Write balance - $120

6. Data Storage Controls Record locking - prevents two people from accessing a file at the same time. “A” wants to increase the balance by $20. “B” wants to decrease the balance by $50. Customer’s Balance = $100 Read balance - $100 Update - $120Update - $50 Write balance - $120Write balance - $50 Customer’s Balance - $120

6. Data Storage Controls Record locking - prevents two people from accessing a file at the same time. “A” wants to increase the balance by $20. “B” wants to decrease the balance by $50. Customer’s Balance = $100 Read balance - $100 Update - $120Update - $50 Write balance - $120Write balance - $50 Customer’s Balance - $50

7. Data Transmission Controls Purpose is to detect errors in transmission and prevent theft of data during transmission

Preventing Theft of Data Encryption - –scramble plaintext and create cyphertext –transmit cyphertext or save on disk –decrypt cyphertext and return to plaintext Two types of encryption –Secret key –Public key

Rule for Secret Key Encryption MessageKeyCyphertext

Secret Key Encryption Use same key for coding and decoding. Therefore, key must be kept secret. Message Key Cyphertext Key Plaintext

Public Key Encryption Uses two keys. A public key and a private key. Use one key to encrypt. Can only use other key to decrypt.

Securing messages Cyphertext is created using private key. Since senders is only one who has private key, you know who created the message. However, this technique allows anyone to read the message.

Public Key Encryption Message Encrypt with sender's ___________ key. Decrypt with sender's ___________ key. Message

Securing messages Cyphertext is created using public key. This technique assures receiver is only one who can read message. However, this technique does not tell you who was the sender.

Public Key Encryption Message Encrypt with recipient's ___________ key. Decrypt with recipient's ___________ key. Message

What is needed Assurance that message was created by sender. Assurance that message can only be read by recipient.

Digital Signatures Plain text message Encrypt with sender’s private key Encrypt with recipient’s public key Decrypt with recipient’s private key Decrypt with sender’s public key Plain text message

Detecting Transmission Errors Send extra data that can be used to check “message” data Parity checking – add extra bit so that sum of “1” bits is always odd or even A = _ B = _ C = _ D = _ Assume even parity

Message Acknowledgement Add labels & batch numbers to the data Echoing Start Code Address Batch Number Data Parity Check End Code

9. Minimize Downtime Two approaches: Prevent down time with routine checking of hardware. Make system fault tolerant. –Install redundant hardware. If component fails, system switches to new component. –Example: UPS provides power back-up when electricity is lost.

10. Disaster Recovery Plan for duplicating computer operations after a catastrophe occurs. Data and programs recovery: –Create backup copies (data and applications) and store offsite. –Save several generations of master files and transaction files. –Checkpoint.

Backing up Batch Systems Grandfather master file + Transaction file = Father master file + Transaction File = Son master file

Hardware Backup Maintain duplicate hardware facilities in remote location Hot Site - ready to go computer site - brought live in very short time Cold Site - site that can be brought live in reasonable time

11. Personal Computers & Networks

12. Internet Controls

Firewalls Method of controlling access to / from one network to another. How this works? –Only allows messages to & from approved sites. –Allows messages to & from sites not specifically excluded.

Application Controls Input - Processing - Output

Application Controls 4 controls listed in text relate to input: –Batch totals, –Source Data Controls, –Input Validation Routines, –On-line Data Entry Controls.

Application Controls - Input Objectives –Make sure data is successfully transferred from source documents into the system. –Detect obvious errors before the data is processed.

Input Control Example Look at the sales order on page 422. How can input errors occur? What controls can be used to prevent, or detect and correct, these errors?

Application Controls - Processing Goal is to detect errors during processing –Default values –Edit checks

Application Controls - Output Goal is to detect errors in output & deliver output to correct person: –Data control group –End user review –Reconciliation –Check Ids –Passwords

Two broad categories of controls