Security and Ethical Challenges Chapter 13 McGraw-Hill/IrwinCopyright © 2011 by The McGraw-Hill Companies, Inc. All rights reserved.

13-2 Learning Objectives Identify several ethical issues regarding how the use of information technologies in business affects employment, individuality, working conditions, privacy, crime, health, and solutions to societal problems. Identify several types of security management strategies and defenses and explain how they can be used to ensure the security of business applications of information technology.

13-3 Learning Objectives Propose several ways that business managers and professionals can help lessen the harmful effects and increase the beneficial effects of the use of information technology.

13-4 Corporate Social Responsibility Theories Stockholder Theory –Managers are agents of the stockholders –Only responsible to increase profits without violating the law or fraud Social Contract Theory –Responsible to all of society Stakeholder Theory –Responsible to anyone affected by company

13-5 Principles of Technology Ethics Proportionality –Good must outweigh the harm or risk Informed Consent –Those affected should understand and accept risks Justice –Benefits and burdens distributed fairly Minimized Risk –Avoid all unnecessary risk

13-6 Hacking Obsessive use of computers Unauthorized access and use of networked computer systems Electronic Breaking and Entering –Accessing without stealing nor damaging Cracker (black hat or darkside hacker) –Maintains knowledge of vulnerabilities for private advantage Common Hacking Tactics –Figure 13.7

13-7 Cyber Theft Most involve theft of money “Inside jobs” Unauthorized activity Attacks through the Internet Most companies don’t report

13-8 Cyberterrorism Use IT to attack electronic infrastructure, exchange information or make threats Terror related –More political motivation than criminal Examples –Attempt to disrupt life support at Antarctic research station –Release of untreated sewage in Australia –Shut down of government network and banks in Estonia –Non-deliberate shut down of systems at nuclear reactor

13-9 Software Piracy Unauthorized copying of computer programs Licensing –Purchase – payment for fair use –Site license – allows a certain number of copies –Shareware – allows copies –Public Domain – not copyrighted Software industry losses –⅓ to ½ of revenues –Millions of copies in educational market –90% pirated software in China Sales negligible

13-10 Theft of Intellectual Property Intellectual Property –Copyrighted material –Music, videos, images, articles, books, software Copyright Infringement is Illegal –Easy to trade pirated intellectual property Publishers Offer Inexpensive Online Music –Illegal downloading is declining

13-11 Adware and Spyware Adware –Useful software allows ads without consent Spyware –Type of Adware –Can steal private information –Add advertising links to Web pages –Redirect affiliate payments –Change a users home page and search settings –Make modem call premium-rate numbers –Leave security holes that let Trojans in –Degrade system performance Removal often not completely successful

13-12 Computer Libel and Censorship The opposite side of the privacy debate… –Freedom of information, speech, and press Biggest battlegrounds –Bulletin boards – boxes –Online files of Internet and public networks Weapons used in this battle –Spamming –Flame mail –Libel laws –Censorship

13-13 Health Issues Cumulative Trauma Disorders (CTDs) –Disorders caused by fast-paced repetitive keystroke jobs Carpal Tunnel Syndrome –Painful, crippling ailment of the hand and wrist –Typically requires surgery to cure Ergonomics –Designing healthy work environments

13-14 Societal Solutions Use IT to solve human and social problems –Medical diagnosis –Computer-assisted instruction (CAI) –Computer based training (CBT) –Governmental program planning –Environmental quality control –Law enforcement –Job placement Detrimental effects –Actions without ethical responsibility

13-15 Denial of Service Attacks Depend on three layers of networked computer systems –The victim’s website –The victim’s Internet service provider –Zombie or slave computers commandeered by cybercriminals Defense –At Zombie Machines Set and enforce security policies Scan for vulnerabilities –At the ISP Monitor and block traffic spikes –At the Victim’s Website Create backup servers and network connections