1. COSC-100 (Elements of Computer Science) Prof. Juola
Risks
COSC-100 (Elements of Computer Science)
Prof. Juola

2. Risks of Computing Basically, what can go wrong (involving computers)?
Two basic problems
Computers can fail to do what they are supposed to
Computers can do what they are supposed to, but to public harm
Problem of balancing obvious applications with negative side-effects.

3. Computer Crime Similar distinction :
Using computers to commit crime
Committing crime on computers
Substantial problem : 70% of organizations surveyed had at least one “e-crime” in 2004
Impact measured in billions of dollars
What’s really going on?

4. Examples Direct theft of information Misrepresentation and fraud
Denial of service (DOS attacks)
Extortion
Software/media piracy
Identity theft
… and so forth

5. “Information” Is information property?
Unlike a sandwich, someone cannot steal it from you
BUT,… can be very expensive to make
“Intellectual Property” (IP) legal term of art
Patents
Copyrights
Trade Secrets

6. IP Problems Patents - used to protect physical inventions
Time-limited monopoly for public disclosure
Copyrights – used to protect works of art
Covers only direct expression, not contents
Trade secrets – used to protect “secrets”
Must be handled through contracted agreement
Which, if any, is appropriate for software?

7. Program problems Typical threat : “the wily hacker.”
Plants “hostile code” on computer which does evil things to the recipient
Viruses, worms, Trojan horses, the whole bestiary
The real problem : software quality is low
Anything a hacker can do deliberately, I can do by accident
Software not adept at dealing with mistakes

8. Case in point : viruses Computer virus : attaches to existing pgm
When program is executed, virus attaches to other accessible pgms and/or does something evil
Why did you run the virus in the first place?

9. Mail viruses : next step
contains executable program (along with note saying “run me!”)
More subtle – is executable program, and you have mail configured to automatically run programs.
Again, why?

10. Reducing risks Secret is access control.
Physical access important first step
“Electronic” access second step
Passwords
Firewalls
Encryption
Appropriate network policies

11. Security vs. Privacy
Sometimes cooperative – encryption keeps secure and private
Sometimes at odds – law enforcement wiretaps vs. expectations of phone privacy

12. Invading privacy Computers are good at mass data storage
Sometimes mass data can be very personally identifiable.
Business data – Giant Eagle cards – can constitute major threat to personal privacy.
Cookies and browsing habits ditto
Problem – the computer never forgets….

13. Safe surfing Don’t trust the label
Set reasonable configuration options.
Take security, esp. passwords, seriously
If it’s sensitive, lock it up
Prepare for the worst

14. Ethics Know the rules and the law … but don’t let them excuse you
Think about worst-case scenarios
Take the long view
ACM provides good code of ethics (p. 465)