1 DETERRING INTERNAL INFORMATION SYSTEMS MISUSE EECS711 : Security Management and Audit Spring 2010 Presenter : Amit Dandekar Instructor : Dr. Hossein.

Slides:

Advertisements

Similar presentations

Risk Management in the Construction Industry: the relevance of Human Factors Vicknayson Thevendran.

Advertisements

Computer Fraud Chapter 5.

Computer Fraud Chapter 5.

2 Issues of the information age Computer _______ and mistakes –Preventing computer related waste & mistakes Computer crime –Computer as tool to commit.

McGraw-Hill/Irwin ©2009 The McGraw-Hill Companies, All Rights Reserved CHAPTER 4 ETHICS AND INFORMATION SECURITY Business Driven Information Systems 2e.

Overview of Joe B. Taylor CS 591 Fall Introduction  Thriving defense manufacturing firm  System administrator angered  His role diminished with.

Security Controls – What Works

Secure Data Transmission James Matheke Information Security Architect Ohio Department of Job and Family Services.

Enterprise Security Perception and the “House of Security” September 6, 2006 Professor Stuart Madnick Sloan School of Management Massachusetts.

Global Information Security Issues According to the E&Y Global Survey, Managers Say the Right Thing… –90% of 1400 companies surveyed in 66 countries say.

FORENSIC ACCOUNTING - BA124 - Spring 2005Slide 4-1 Today’s Topics n Preventing Fraud-Part II n Eliminating opportunities for fraud n Dealing with Fraud.

1 Choosing Disaster Recovery Solution for Database Systems EECS711 : Security Management and Audit Spring 2010 Presenter : Amit Dandekar Instructor : Dr.

Engineering Secure Software. Lottery Story A Threat We Can’t Ignore  Documented incidents are prevalent Carnegie Melon’s SEI has studied over 700 cybercrimes.

Computer Security Fundamentals

Factors to be taken into account when designing ICT Security Policies

Developing a Security Policy Chapter 2. Learning Objectives Understand why a security policy is an important part of a firewall implementation Determine.

 What is Code Change Management and why does it matter?  What are key code change controls and their relationship?  What are some common code change.

Introduction to Network Defense

Lecture 11 Electronic Business (MGT-485). Recap – Lecture 10 Transaction costs Network Externalities Switching costs Critical mass of customers Pricing.

INTRODUCTION Coined in 1996 by computer hackers. Hackers use to fish the internet hoping to hook users into supplying them the logins, passwords.

SEC835 Database and Web application security Information Security Architecture.

Module 02: 1 Introduction to Computer Security and Information Assurance Objectives Recognize that physical security and cyber security are related Recognize.

FRAUD Students name: Professors name: Course: Date:

Computer Security: Principles and Practice First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Chapter 1 – Overview.

INFORMATION SECURITY & RISK MANAGEMENT SZABIST – Spring 2012.

Intrusion Detection Prepared by: Mohammed Hussein Supervised by: Dr. Lo’ai Tawalbeh NYIT- winter 2007.

PRIVACY, SECURITY & ID THEFT PREVENTION - TIPS FOR THE VIGILANT BUSINESS - SMALL BUSINESS & ECONOMIC DEVELOPMENT FORUM October 21, WITH THANKS TO.

State Data Center Oregon Consumer Identity Theft Protection Act Information Forum October 31, 2007.

Unit 6b System Security Procedures and Standards Component 8 Installation and Maintenance of Health IT Systems This material was developed by Duke University,

Thoughts on Firewalls: Topologies, Application Impact, Network Management, Tech Support and more Deke Kassabian, April 2007.

Managing Data Against Insider Threats Dr. John D. Johnson, CISSP.

Kellie E. Tomeo, Esq Rampart International, LLC. AdvantageChallenge Increase existing security personnel productivity Increase existing facility personnel.

13.6 Legal Aspects Corporate IT Security Policy. Objectives Understand the need for a corporate information technology security policy and its role within.

Information Security What is Information Security?

IT Risks and Controls Revised on Content Internal Control  What is internal control?  Objectives of internal controls  Types of internal controls.

What Can Go Wrong During a Pen-test? Effectively Engaging and Managing a Pen-test.

Module 11: Designing Security for Network Perimeters.

Network Security & Accounting

Computer System and Internet Misuse at the Work Place By: Kris Dimon.

Module 12: Responding to Security Incidents. Overview Introduction to Auditing and Incident Response Designing an Audit Policy Designing an Incident Response.

©Dr. Respickius Casmir Network Security Best Practices – Session 2 By Dr. Respickius Casmir.

Describe the potential of IT to improve internal and external communications By Jim Green.

Monitoring Employees on Networks

Objectives  Legislation:  Understand that implementation of legislation will impact on procedures within an organisation.  Describe.

Safety and Health Program Don Ebert- Risk Manager (509)

Chapter 8 : Management of Security Lecture #1-Week 13 Dr.Khalid Dr. Mohannad Information Security CIT 460 Information Security Dr.Khalid Dr. Mohannad 1.

Information Security in Laurier Grant Li Wilfrid Laurier University.

Welcome to the ICT Department Unit 3_5 Security Policies.

Social Justice Post Survey Results May Social Justice & Technology Post-SurveyPlease answer all of the questions in the survey.: Please rate your.

Physical Security at Data Center: A survey. Objective of the Survey  1. To identify the current physical security in data centre.  2.To analyse the.

Appendix A: Designing an Acceptable Use Policy. Overview Analyzing Risks That Users Introduce Designing Security for Computer Use.

Insiders are Today’s Biggest Security Threat

CHAPTER FOUR OVERVIEW SECTION ETHICS

Responding to Intrusions

COMP3357 Managing Cyber Risk

Introduction to the Federal Defense Acquisition Regulation

Understand mechanisms to control organisational IT security

Unit 7 – Organisational Systems Security

Internet Safety and Acceptable Use Policies.

Office 365 Security Assessment Workshop

LM 8 Data Administration & Database Administration

The Privacy Cycle A Five-Step Process to Improve Your Privacy Culture

Security Measures Module 7 Section 1.

Objectives Telecommunications and Network Physical and Personnel

Understand Risks to IT Security

Managing & Monitoring Activity With Supervisory Internal Controls

Cyber security Policy development and implementation

CHAPTER FOUR OVERVIEW SECTION ETHICS

Accounting Information Systems & Computer Fraud

Basic Systems Management Employing Security Policies

Presentation transcript:

1 DETERRING INTERNAL INFORMATION SYSTEMS MISUSE EECS711 : Security Management and Audit Spring 2010 Presenter : Amit Dandekar Instructor : Dr. Hossein Saiedian

2 Contents Information system misuses by insiders Counter measures Measuring effectiveness of counter measures – Survey methodology – Survey results – Survey conclusions Conclusion

3 Information system misuse by insiders Misuses of information system (IS) resources – Largely due to intentional actions of legitimate users 70% of breaches involving loss of more than 100k are internal per a study – Result in financial loss and other negative consequences – Misuses likely to persist due to increasing user sophistication and availability of tools

4 Counter measures – Procedural controls Security policy Security awareness programs – Technical controls Computer monitoring software Preventive security software

5 Measuring effectiveness of counter measures Survey studies deterrent effect of these measures on IS misuse intentions Web based survey – 579 users from eight organizations from variety of industries – 44% companies with 10,000 or more employees Two parts of survey – Examine awareness countermeasures – Examine effects of awareness on IS misuse

6 Survey methodology Measure awareness of four security countermeasures – Measured on seven point scales one = strongly disagree, seven = strongly agree

7 Survey methodology Measure user intentions to misuse IS resources – Measures likelihood of engaging in misuse behavior

8 Survey results Respondents least aware of security awareness programs

9 Survey results Security awareness programs have most deterrent effect

10 Survey results Security awareness programs – Most deterrent effect on IS misuse Security policy – Significant deterrent effect Preventive security software – Significant deterrent effect Computer monitoring software – No significant deterrent effect

11 Survey conclusion Security awareness programs need to get larger budget than other countermeasures – Most deterrent effect but least deployed security counter measure Security policy statements and guidelines is effective deterrent – Introduce employees to policies as early as possible – Display policies prominently

12 Survey conclusion Preventive security software are significant deterrent – Increase users fear of detection – Deterrent effect is above and beyond its core functionality – Organizations should make concerted effort to alert employees of latest technological solutions protecting IS resources E.g. provide real time feedback during password construction

13 Survey conclusion Computer monitoring software is insignificant deterrent – Users do not equate monitoring to being caught – Users doubted if audit logs were monitored regularly – Users doubt if punishment will be severe

14 Conclusion Following three measures significantly deter user’s IS misuse intentions – Security awareness program – Security policy – Preventive security software Monitoring end user activities has least effect Combination of proactive and preventive approach is most effective in deterring users from IS misuse

15 References D'Arcy, J. and Hovav, A Deterring internal information systems misuse. Commun. ACM 50, 10 (Oct. 2007),