1. Security MIS 171 – Web Technologies and Innovation Paul F. Clay, Ph.D.

2. Categories of Threats Technical Unauthorized disclosure Denial of Service Spoofing & Phishing –Email or site pretending to be someone else Sniffing –Eavesdropping on network traffic Viruses & Spyware “Acts of God” Behavioral User error –Fraud Enron, WorldCom… –Retaliation Cox comm. ex. –Multiple user access work stations –Accidental loss lack of training Password Cascade

3. Threats to Security SecrecySecrecy data is disclosed to authorized personneldata is disclosed to authorized personnel IntegrityIntegrity data is modified by unauthorized party AvailabilityAvailability data assets are available to authorized party SD U Interception SD U Modification SD Interruption S: source D: destination U: unauthorized party

4. Legal Requirements HIPAA-Health Insurance Portability and Accountability Act (1996)HIPAA-Health Insurance Portability and Accountability Act (1996) –Maintain records 6 years –Ensures confidentiality of health care records Penalties for breach of privacy or unauthorized disclosure by email or unauthorized network accessPenalties for breach of privacy or unauthorized disclosure by email or unauthorized network access

5. Legal Requirements (part2) Gramm-Leach-Bliley Act(1999)Gramm-Leach-Bliley Act(1999) –Requires financial institutions to ensure security and confidentiality of customer data Security during storage and transmissionSecurity during storage and transmission Sarbanes-Oxley Act (2002)Sarbanes-Oxley Act (2002) –CEO and CFO of all publicly traded companies it the US must certify the accuracy of their financial reports Maintain all records for 7 yearsMaintain all records for 7 years Requires the creation of internal controls to ensure that all reports reflect accurate and complete dataRequires the creation of internal controls to ensure that all reports reflect accurate and complete data –IS used for the creation, storage and transmission of data and reports

6. Types of Encryption Private KeyPrivate Key –Data Encryption Standard (DES) est. 1975 Symmetric Key – One key used to encrypt and decrypt the same messageSymmetric Key – One key used to encrypt and decrypt the same message Public KeyPublic Key –RSA (Rivest, Shamir & Adleman) est. 1977 Asymmetric Key – Two different but linked keys used to encrypt and decrypt the same messageAsymmetric Key – Two different but linked keys used to encrypt and decrypt the same message RSA VidRSA VidRSA VidRSA Vid

7. Encryption and Bit Strength Bit Strength Matters Encryption Algorithms Matter – –WEP (Wired Equivalent Privacy) - very weak – –DES-weak – –RSA-better CNet News article on encryption

8. Decentralized Computing Questions?