1. Securing Information Systems
Chapter 8
Securing Information Systems

2. Management Information Systems Chapter 8 Securing Information Systems
LEARNING OBJECTIVES
Analyze why information systems need special protection from destruction, error, and abuse.
Assess the business value of security and control.
Design an organizational framework for security and control.
Evaluate the most important tools and technologies for safeguarding information resources.

3. Demonstrates IT’s role in combating cyber crime.
Management Information Systems
Chapter 8 Securing Information Systems
Phishing: A Costly New Sport for Internet Users
Problem: Large number of vulnerable users of online financial services, ease of creating bogus Web sites.
Solutions: Deploy anti-phishing software and services and a multilevel authentication system to identify threats and reduce phishing attempts.
Deploying new tools, technologies, and security procedures, along with educating consumers, increases reliability and customer confidence.
Demonstrates IT’s role in combating cyber crime.
Illustrates digital technology as part of a multilevel solution as well as its limitations in overcoming discouraged consumers.

4. Why Systems Are Vulnerable
Management Information Systems
Chapter 8 Securing Information Systems
SYSTEM VULNERABILITY AND ABUSE
Why Systems Are Vulnerable
Contemporary Security Challenges and Vulnerabilities
Figure 8-1

5. Why Systems Are Vulnerable (Continued) Internet Vulnerabilities:
Management Information Systems
Chapter 8 Securing Information Systems
SYSTEM VULNERABILITY AND ABUSE
Why Systems Are Vulnerable (Continued)
Internet Vulnerabilities:
Use of fixed Internet addresses through use of cable modems or DSL
Lack of encryption with most Voice over IP (VoIP)
Widespread use of and instant messaging (IM)

6. Wireless Security Challenges:
Management Information Systems
Chapter 8 Securing Information Systems
SYSTEM VULNERABILITY AND ABUSE
Wireless Security Challenges:
Radio frequency bands are easy to scan
The service set identifiers (SSID) identifying the access points broadcast multiple times

7. Malicious Software: Viruses, Worms, and Spyware
Management Information Systems
Chapter 8 Securing Information Systems
SYSTEM VULNERABILITY AND ABUSE
Malicious Software: Viruses, Worms, and Spyware
Hackers and Cybervandalism
Computer viruses, worms,
Spyware
Identity theft, phishing, pharming
Cyberterrorism and Cyberwarfare
Vulnerabilities from internal threats (employees); software flaws

8. Inadequate security and control may create serious legal liability.
Management Information Systems
Chapter 8 Securing Information Systems
BUSINESS VALUE OF SECURITY AND CONTROL
Inadequate security and control may create serious legal liability.
Businesses must protect not only their own information assets but also those of customers, employees, and business partners. Failure to do so can lead to costly litigation for data exposure or theft.
A sound security and control framework that protects business information assets can thus produce a high return on investment.

9. Types of Information Systems Controls
Management Information Systems
Chapter 8 Securing Information Systems
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Types of Information Systems Controls
General controls:
Software and hardware
Computer operations
Data security
Systems implementation process

10. Application controls:
Management Information Systems
Chapter 8 Securing Information Systems
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Application controls:
Input
Processing
Output

11. Security Profiles for a Personnel System
Management Information Systems
Chapter 10 Security and Control
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Security Profiles for a Personnel System
Figure 8-4

12. Ensuring Business Continuity
Management Information Systems
Chapter 8 Securing Information Systems
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Ensuring Business Continuity
Disaster recovery planning: Plans for restoration of computing and communications disrupted by an event such as an earthquake, flood, or terrorist attack
Business continuity planning: Plans for handling mission-critical functions if systems go down

13. Biometric authentication
Management Information Systems
Chapter 8 Securing Information Systems
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Access Control
Access control: Consists of all the policies and procedures a company uses to prevent improper access to systems by unauthorized insiders and outsiders
Authentication:
Passwords
Biometric authentication

14. Firewalls, Intrusion Detection Systems, and Antivirus Software
Management Information Systems
Chapter 8 Securing Information Systems
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Firewalls, Intrusion Detection Systems, and Antivirus Software
Firewalls: Hardware and software controlling flow of incoming and outgoing network traffic
Intrusion detection systems: Full-time monitoring tools placed at the most vulnerable points of corporate networks to detect and deter intruders

15. Management Information Systems
Chapter 8 Securing Information Systems
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Firewalls, Intrusion Detection Systems, and Antivirus Software (Continued)
Antivirus software: Software that checks computer systems and drives for the presence of computer viruses and can eliminate the virus from the infected area

16. A Corporate Firewall Management Information Systems Figure 8-6
Chapter 10 Security and ContrChapter 8 Securing Information Systems ol
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
A Corporate Firewall
Figure 8-6

17. Encryption and Public Key Infrastructure
Management Information Systems
Chapter 8 Securing Information Systems
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Encryption and Public Key Infrastructure
Public key encryption: Uses two different keys, one private and one public. The keys are mathematically related so that data encrypted with one key can be decrypted using only the other key
Message integrity: The ability to be certain that the message being sent arrives at the proper destination without being copied or changed

18. Encryption and Public Key Infrastructure (Continued)
Management Information Systems
Chapter 8 Securing Information Systems
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Encryption and Public Key Infrastructure (Continued)
Digital signature: A digital code attached to an electronically transmitted message that is used to verify the origin and contents of a message

19. Encryption and Public Key Infrastructure (Continued)
Management Information Systems
Chapter 8 Securing Information Systems
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Encryption and Public Key Infrastructure (Continued)
Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS): protocols for secure information transfer over the Internet; enable client and server computer encryption and decryption activities as they communicate during a secure Web session.
Secure Hypertext Transfer Protocol (S-HTTP): used for encrypting data flowing over the Internet; limited to Web documents, whereas SSL and TLS encrypt all data being passed between client and server.

20. Public Key Encryption Management Information Systems Figure 8-7
Chapter 8 Securing Information Systems
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Public Key Encryption
Figure 8-7

21. Worldwide Damage from Digital Attacks
Management Information Systems
Chapter 8 Securing Information Systems
Systems Vulnerability and Abuse
Worldwide Damage from Digital Attacks
This chart shows estimates of the average annual worldwide damage from hacking, malware, and spam since These data are based on figures from mi2G and the authors.
Figure 8-3