Security in Computing  Privacy in Computing  Legal & Ethical Issues in Computer Security  Information Security Management and Security Controls

I.Privacy in Computing I. What is privacy A.Individual Control of personal information B.Right to declare certain information sensitive C.Privacy has a cost: giving – or not giving – certain information may have affect how we are treated D.Computerization did not invent privacy problems, nor will it solve them...

I.Privacy in Computing E.Basic qualities/dimensions/tenets of privacy 1.Consent of information collection 2.Limited use 3.Limited period of retention 4.Limited disclosure 5.Protection of collected information against inappropriate use 6.Controlled access, logging 7.Monitoring of use, logging 8.Policies cannot be weakened once data items are collected.

I.Privacy in Computing F.Anonymity, pseudonymity, multiple identities

II.Principles and Policies A.Fair information policies B.Privacy laws – which country?

III.Authentication A.Of an: 1.Individual 2.Identity 3.Attribute B.Anonymization 1.Delivering unique identities from anonymized data 2.Work of Anderson, Sweeney

IV.Data Mining A.Privacy-preserving data mining 1.Tradeoff between anonymity and identification for good purpose 2.Joining databases on common data values 3.Aggregating for study of trends, connections

V.Privacy on the Internet A.Finance 1.Web payments 2.Credit cards 3.Anonymous payments 4.Payments in cases of mutual distrust B.Retained relationships A.Cookies B.Site logins C.Impersonation D.Unannounced relationships (tracking)

V.Privacy on the Internet C.Tracking 1.Web bugs 2.Keystrokes logging 3.Spyware 4.Adware 5.hijacking

VI.Secure A.No sender assurance; little ability to track the origin of a message B.Insecure channels C.Monitoring D.Anonymous and r ers E.Spoofing, spam

VII.Emerging technologies (examples) A.RFID – Radio-frequency identification 1.Definition 2.Uses 3.Misuses B.Electronic voting 1.Far election principles 2.Contrast to fairness of paper ballot, mechanical voting techniques 3.Internet voting 4.Voice over IP

I.Legal and Ethical Issues in Computer Security I. This is a very broad topic – some topics for class discussion based on case studies are: A.Determining current and national laws concerning personal privacy and computer records, computer fraud, or hacking, given that laws change frequently B.Review recent prosecutions of computer crime cases to see what laws where used for this prosecution

I.Legal and Ethical Issues in Computer Security C.How to address the international aspect of computer crime – i.e. when a criminal in one country commits a crime against a computer in another country - Whose law is broken? whose police and courts have jurisdiction? how should the crime be investigated? - What if the transaction is passed through a third country or if the criminal uses an ISP in fourth country?

I.Information Security Management and Security Controls I. Key area relating to ISO/IEC code of practice for information security management and security controls in terms of: general principles, best practice recommendations, established guidelines and any specific issues within this area. =39612