1. Security, Privacy, and Ethics
Chapter 9
Security, Privacy, and Ethics
Topics:
Computer Waste and Mistakes
Computer Crime
Privacy
Health Concerns
Please turn your cell phone off.

2. Computer Waste & Mistakes
Chapter 9.1
Computer Waste & Mistakes

3. Computer Waste Proper Management Discarded technology Unused systems
Personal use of corporate time & technology
Computer waste is widespread in the public and private sectors, and is usually caused by the improper management of information technology. Some companies discard usable hardware and software that could be used elsewhere in the company, or sold or donated. Another example of computer waste occurs when significant resources are invested in the development of an information system, and then, it is never used to it fullest extent. This happens for many reasons, but poor design and inadequate training are major causes. Employees playing computer games or surfing the Web at their desks on company time is also a source of waste, as are junk and junk faxes.

4. Computer Mistakes Proper Management Data entry or capture errors
Programming Errors/Bugs
File Management Errors
Insufficient Disaster Recovery Plan
Computer waste is widespread in the public and private sectors, and is usually caused by the improper management of information technology. Some companies discard usable hardware and software that could be used elsewhere in the company, or sold or donated. Another example of computer waste occurs when significant resources are invested in the development of an information system, and then, it is never used to it fullest extent. This happens for many reasons, but poor design and inadequate training are major causes. Employees playing computer games or surfing the Web at their desks on company time is also a source of waste, as are junk and junk faxes.

5. Preventing Computer Waste & Mistakes
Implement Preventive Policies and Procedures
Computer acquisition & use
Individual & workgroup training
Maintenance & use of computer systems
Approval for applications & systems
Preventive policies and procedures typically address the issues listed on this slide.
Procedures relating to the acquisition and use of computers can avoid both waste and mistakes. For example, procedures could ensure that computers no longer needed in one part of the company would be used in another part, rather than discarded.
Employees and groups are less likely to make mistakes using applications and technology if they have been properly trained in their use.
Many organizations require that systems or applications meeting certain criteria must be approved by a committee or the IS department before they are acquired or implemented, to ensure they are compatible with existing systems, databases, and technology, and are cost-effective.
Many organizations have established procedures to ensure that all systems, including those developed by end users, have adequate documentation.

6. Technology: The Dark Side
Identity Theft
Viruses
Hackers
Trojan Horse
Worms
Crackers
Spyware
Scams

7. Computer Crime
Even with policies in place, computer crimes can occur. Computer crime is relatively risk free, compared to crimes such as bank robbery, and can often escape detection. Furthermore, due to computer processing speed and data communications, large amounts of money can be quickly stolen or diverted with the right know-how and equipment.
Computer crime includes a wide range of categories, such as introducing viruses, stealing credit card numbers from on-line systems, and crashing Web sites.

8. Computer Crime
In 2000:
70% of companies report serious computer breaches
74% acknowledge suffering financial loss from computer security breaches
85% report virus contamination

9. Computer As A Tool to Commit Crime
Computer systems as tools to commit crimes
Used to gain access to valuable information (credit card numbers).
Two requirements
Access to the system
Knowledge of how to manipulate the system

10. Computer As A Tool to Commit Crime
Social Engineering
The practice of talking a critical computer password out of an individual
Dumpster Diving
Searching through garbage for important pieces of information that can help crack an organization’s computers of be used to convince someone at the company to give someone access to the computers
Cards for Sale:

11. Computer As A Tool to Commit Crime
Cyberterrorist: intimidates or coerces a government or organization to advance his or her political or social objectives by launching computer-based attacks against computers, networks, and the information stored on them
Identity theft: An imposter obtains key pieces of personal identification information, such as Social Security or driver’s license numbers, in order to impersonate someone else

12. Computer As The Object Of The Crime
Hacker: A person who enjoys computer technology and spends time learning and using computer systems
Cracker (criminal hacker): A computer-savvy person who attempts to gain unauthorized or illegal access to computer systems

13. Computer As The Object Of The Crime
Script bunnies: Wannabe crackers with little technical savvy who download programs-scripts-that automate the job of breaking into computers
Insider: An employee, disgruntled or otherwise, working solo on in concert with outsiders to compromise corporate systems

14. Computer As The Object Of The Crime
Virus: a computer program capable of attaching to disks or other files and replicating itself repeatedly, typically without the user’s knowledge or permission
Worm: an independent program that replicates its own program files until it interrupts the operation of networks and computer systems

15. Computer As The Object Of The Crime
Trojan Horse: a program that appears to be useful but actually masks a destructive program
Logic bomb: an application or system virus designed to “explode” or execute at a specified time and date

16. Computer As The Object Of The Crime: Phishing
PayPal
   We are currently performing regular maintenance of our security measures. Your account has been selected for this maintenance, and you will now be taken through a series of identity verification pages.      Protecting the security of your PayPal account is our primary concern, and we apologize for any inconvenience this may cause.     To update your PayPal Account, you must click the link below and complete all steps from the following page as we try to verify your identity.
Click here to verify your account Thank you for using PayPal! The PayPal Team   Please do not reply to this . This mailbox is not monitored and you will not receive a response. PayPal ID: PP468
Altering or destroying corporate data damages a vital corporate asset. The most common method to change or destroy data involves the use of worms or viruses. A virus is a program that attaches itself to other programs. A worm is an independent program, that replicates itself, interrupting the functioning of networks and computers. Viruses and worms can cause networks or computers to be shut down for days, causing lost productivity and money. They can also completely destroy data and programs, which can only be restored if recent backups are available.
An application virus infects programs, such as spreadsheet of word processing programs. Since these viruses usually attach themselves to the program files, they can often be detected by checking the size of the file. A system virus infects a computer’s operating system, usually at when the computer is started. A macro virus uses an application’s own macro programming language to distribute itself and infect files. Unlike the other viruses, macro viruses affect documents, not programs.
Logic bombs are system or application viruses designed to execute at a specific event, time, or date. For example, there have been stories of disgruntled IS employees planting logic bombs in computers at work that are designed to “explode” and delete important files if the employee hasn’t logged in to the company’s computer for several months (presumably because he was fired). Logic bombs may be disguised as Trojan horse, which is a program that appears to be useful but hides a virus or worm.
Although not as great a problem as viruses themselves, virus hoaxes are another problem. Sometimes individuals warn the public of a new virus that doesn’t exist. Companies spend money and time warning employees and taking preventative action against a virus that doesn’t exist.

17. Adware & Spyware
Adware: any software application in which advertising banners are displayed while the program is running.
Spyware: On the Internet, spyware is programming that is put in someone's computer to secretly gather information about the user and relay it to advertisers or other interested parties.
Spyware can get in a computer as a software virus or as the result of installing a new program.
File-sharing users beware…
Xupiter (Wired article)
Ad-Aware (
Altering or destroying corporate data damages a vital corporate asset. The most common method to change or destroy data involves the use of worms or viruses. A virus is a program that attaches itself to other programs. A worm is an independent program, that replicates itself, interrupting the functioning of networks and computers. Viruses and worms can cause networks or computers to be shut down for days, causing lost productivity and money. They can also completely destroy data and programs, which can only be restored if recent backups are available.
An application virus infects programs, such as spreadsheet of word processing programs. Since these viruses usually attach themselves to the program files, they can often be detected by checking the size of the file. A system virus infects a computer’s operating system, usually at when the computer is started. A macro virus uses an application’s own macro programming language to distribute itself and infect files. Unlike the other viruses, macro viruses affect documents, not programs.
Logic bombs are system or application viruses designed to execute at a specific event, time, or date. For example, there have been stories of disgruntled IS employees planting logic bombs in computers at work that are designed to “explode” and delete important files if the employee hasn’t logged in to the company’s computer for several months (presumably because he was fired). Logic bombs may be disguised as Trojan horse, which is a program that appears to be useful but hides a virus or worm.
Although not as great a problem as viruses themselves, virus hoaxes are another problem. Sometimes individuals warn the public of a new virus that doesn’t exist. Companies spend money and time warning employees and taking preventative action against a virus that doesn’t exist.

18. Using AntiVirus Programs
Antivirus program: program or utility that prevents viruses and recovers from them if they infect a computer
An antivirus software should be run and updated often

19. Information & Equipment Theft
To obtain illegal access, criminal hackers require identification numbers and passwords
Password sniffer
A small program hidden in a network or a computer system that records identification numbers and passwords
Theft of data and software
Theft of computer systems and equipment
Computer technology can also be the object of crime. The theft of computer systems and equipment is second only to automobile theft in the United States.
Software is intellectual property in the same way that books, movies, or music are intellectual property. Just as plagiarizing printed material or illegally duplicating videos or CDs is a crime, so is illegally duplicating software, or software piracy. When you buy software, you technically don’t own it – only the right to use it under certain conditions. Leading software companies formed the Software Publishers Association, which audits companies and checks for software licenses in the United States. Violating organizations can be fined or sued.
Internet piracy involves the use of someone else’s password or authorization number to access websites or retrieve information that requires a paid subscription. MIPs-sucking is the term used when a hacker uploads an applet to an individual’s computer while she is surfing the Web. The applet uses the processor to do calculations and sends the results back to the hacker.
The Internet has provided a new operating arena for scam artists. There have been many instances of get-rich-quick sites on the Internet. The same guidelines apply to Internet “deals” as to those you’re offered over the phone or by mail. If it sounds too good to be true, it probably is. Always investigate a business and check independent sources, such as your state attorney general and the National Fraud Information Center.
As mentioned earlier, computer crime is an international problem. In China for example, 96% of software is pirated, totaling over $3 billion in lost revenue. Since funds can be transferred electronically, there is concern that criminals use information systems to launder money. Computer and information terrorism is also an international concern.

20. Software & Internet Software Piracy
Software piracy: the act of illegally duplicating software
Internet software piracy: illegally downloading software from the Internet
Computer technology can also be the object of crime. The theft of computer systems and equipment is second only to automobile theft in the United States.
Software is intellectual property in the same way that books, movies, or music are intellectual property. Just as plagiarizing printed material or illegally duplicating videos or CDs is a crime, so is illegally duplicating software, or software piracy. When you buy software, you technically don’t own it – only the right to use it under certain conditions. Leading software companies formed the Software Publishers Association, which audits companies and checks for software licenses in the United States. Violating organizations can be fined or sued.
Internet piracy involves the use of someone else’s password or authorization number to access websites or retrieve information that requires a paid subscription. MIPs-sucking is the term used when a hacker uploads an applet to an individual’s computer while she is surfing the Web. The applet uses the processor to do calculations and sends the results back to the hacker.
The Internet has provided a new operating arena for scam artists. There have been many instances of get-rich-quick sites on the Internet. The same guidelines apply to Internet “deals” as to those you’re offered over the phone or by mail. If it sounds too good to be true, it probably is. Always investigate a business and check independent sources, such as your state attorney general and the National Fraud Information Center.
As mentioned earlier, computer crime is an international problem. In China for example, 96% of software is pirated, totaling over $3 billion in lost revenue. Since funds can be transferred electronically, there is concern that criminals use information systems to launder money. Computer and information terrorism is also an international concern.

21. Spam / Fraud Spam is unsolicited e-mail on the Internet.
Internet Fraud uses the Web & to solicit donations for illegitimate causes.
Altering or destroying corporate data damages a vital corporate asset. The most common method to change or destroy data involves the use of worms or viruses. A virus is a program that attaches itself to other programs. A worm is an independent program, that replicates itself, interrupting the functioning of networks and computers. Viruses and worms can cause networks or computers to be shut down for days, causing lost productivity and money. They can also completely destroy data and programs, which can only be restored if recent backups are available.
An application virus infects programs, such as spreadsheet of word processing programs. Since these viruses usually attach themselves to the program files, they can often be detected by checking the size of the file. A system virus infects a computer’s operating system, usually at when the computer is started. A macro virus uses an application’s own macro programming language to distribute itself and infect files. Unlike the other viruses, macro viruses affect documents, not programs.
Logic bombs are system or application viruses designed to execute at a specific event, time, or date. For example, there have been stories of disgruntled IS employees planting logic bombs in computers at work that are designed to “explode” and delete important files if the employee hasn’t logged in to the company’s computer for several months (presumably because he was fired). Logic bombs may be disguised as Trojan horse, which is a program that appears to be useful but hides a virus or worm.
Although not as great a problem as viruses themselves, virus hoaxes are another problem. Sometimes individuals warn the public of a new virus that doesn’t exist. Companies spend money and time warning employees and taking preventative action against a virus that doesn’t exist.

22. Preventing Computer-Related Crime
Crime prevention by state and federal agencies
Crime prevention by corporations
Public key infrastructure (PKI): a means to enable users of an unsecured public network such as the Internet to securely and privately exchange data through the use of a public and a private cryptographic key pair that is obtained and shared through a trusted authority
Biometrics: the measurement of one of a person’s traits, whether physical or behavioral
Although virtually all states have passed computer crime bills, they may not be effective since companies don’t always detect or report computer crime and punishments are not severe.
In 1986 Congress enacted the Computer Fraud and Abuse Act, which sets punishment based on the amount of the victim’s monetary loss. The Department of Defense supports CERT, the Computer Emergency Response Team, which responds to network security breaches and identifies potential threats.
Several states have also passed laws to outlaw spamming, the practice of sending numerous unsolicited .
The debate weighing free speech and decency on the Internet continues. U.S. courts have limited the government’s right to restrict content on the Internet. However, European countries have forced ISPs to ban newsgroups or services that violate their privacy and decency laws. Filtering software exists that parents can use to screen Internet content.
With the increasing use of the Internet, libel on the Internet has become an important legal issue. Although publishers, such as newspapers, can be held liable for statements in their publications, court rulings to date seem to indicate that on-line services, such as AOL, are more like bookstores than publishers, and therefore not liable for content posted by others.
Firewalls, as discussed in Chapter 7, can help secure an organization’s information system from unauthorized external access. It is also important for organizations to develop and enforce effective Internet security policies for all employees.
Many companies have taken steps to fight computer crime. Many encrypt data to prevent its unauthorized use. Some, particularly healthcare organizations, use biometrics, such as fingerprint, face, or retinal identification.
Since preventing computer crime requires additional controls on information systems, organizations must identify potential computer-related crime, the consequences of that crime, and the cost and complexity of the controls needed to protect against loss from the crime. Sometimes, the cost of the controls may outweigh the potential for loss.

23. Preventing Computer-Related Crime
Table 9.8: Common Methods Used to Commit Computer Crimes

24. Preventing Computer-Related Crime
Intrusion detection system (IDS): software that monitors system and network resources and notifies network security personnel when it senses a possible intrusion
Managed security service provider (MSSP): an organization that monitors, manages, and maintains network security hardware and software for its client companies
Internet laws for libel and protection of decency

25. Preventing Computer-Related Crime
Problem
Cure
Hacking
Personal Firewall: ZoneAlarm, Norton, McAfee, Black Ice.
Viruses/Worms
Caution: Don’t open attachments!
Antivirus Utility updated frequently: Norton or McAfee.
Phishing
Do not trust anything that comes to you. You go to it.
Spyware/Spyware
Caution: Read the fine print when installing software.
Utility Program: Ad-Aware available at (
Identity Theft
Use Extreme Caution with private info.
Trust No One.
Internet Fraud
Knowledge & Caution.
The Truth is Out There.
Although virtually all states have passed computer crime bills, they may not be effective since companies don’t always detect or report computer crime and punishments are not severe.
In 1986 Congress enacted the Computer Fraud and Abuse Act, which sets punishment based on the amount of the victim’s monetary loss. The Department of Defense supports CERT, the Computer Emergency Response Team, which responds to network security breaches and identifies potential threats.
Several states have also passed laws to outlaw spamming, the practice of sending numerous unsolicited .
The debate weighing free speech and decency on the Internet continues. U.S. courts have limited the government’s right to restrict content on the Internet. However, European countries have forced ISPs to ban newsgroups or services that violate their privacy and decency laws. Filtering software exists that parents can use to screen Internet content.
With the increasing use of the Internet, libel on the Internet has become an important legal issue. Although publishers, such as newspapers, can be held liable for statements in their publications, court rulings to date seem to indicate that on-line services, such as AOL, are more like bookstores than publishers, and therefore not liable for content posted by others.
Firewalls, as discussed in Chapter 7, can help secure an organization’s information system from unauthorized external access. It is also important for organizations to develop and enforce effective Internet security policies for all employees.
Many companies have taken steps to fight computer crime. Many encrypt data to prevent its unauthorized use. Some, particularly healthcare organizations, use biometrics, such as fingerprint, face, or retinal identification.
Since preventing computer crime requires additional controls on information systems, organizations must identify potential computer-related crime, the consequences of that crime, and the cost and complexity of the controls needed to protect against loss from the crime. Sometimes, the cost of the controls may outweigh the potential for loss.

26. Privacy Issue
Privacy is the right to be out of public view or to be left alone. With today’s information systems and networks, the right to privacy has become a challenge. Data is continually collected and stored about you, and often transmitted over networks without your knowledge. Data about you is stored in countless databases. The question remains – if an organization used its resources to collect that data, is it their data and can it use it anyway it wants without your knowledge or consent?
The federal government is most likely the largest data collector. Although federal legislation defines an individual’s privacy rights for data collected by federal agencies, very little such legislation exists for the private sector.
The Internet poses major privacy issues – private data about individuals is easily accessible, sometimes without charge. The European Union has enacted privacy legislation that applies to all firms doing business in Europe. Although there is legislation before the U.S. Congress addressing Internet privacy, US citizens and businesses are skeptical about government involvement. The Online Privacy Alliance, a group supported by large companies such as AT&T, Microsoft and Walt Disney, is developing a voluntary code of conduct for Internet businesses to employ.

27. Privacy Issues Privacy and the Federal Government Privacy at work
Privacy Act of 1974: This national guideline provides knowledge, and limited control (notice and consent) over your fed records.
Privacy at work
privacy
Florida Sunshine Law
Companies want to know more about their employees and technology is available to help them. Keystrokes can be monitored, as can times the keyboard is not in use. This can be used to extrapolate such things as how long an employee takes for lunch or a break.
It is legal for employers to monitor sent & received by employees, as well as retrieve deleted messages.
In 1999 consumer groups were concerned about the processor serial number on Intel Pentium III chips that could possibly be used to track an individual on the Internet. Intel discontinued the practice in 2000.
Microsoft applications, such as Word and Excel, automatically record the creator of electronic documents and the computer on which the document was created. A hidden unique identifier is inserted into a document that identifies the Ethernet network adapter card of the computer on which the document was created. Thus, documents could be traced back to their creators. That ID is also sent to Microsoft when the owner registers Windows 98 online, so Microsoft knows your computer’s ID, and could trace documents you create. Microsoft responded to customers and bad publicity by releasing patches to remove the ID function.
The challenges to privacy from the Internet have been mentioned before. When buying products or giving personal information on the Internet, it is important to read the merchant’s privacy policy to understand what the website can do with the information you provide. Many sites provide consumers the option of requesting that their data not be given to other companies.

28. Privacy Issues: Privacy & the Internet
Platform for Privacy Preferences (P3P)
A screening technology that shields users from Web sites that don’t provide the level of privacy protection they desire
P3P
Companies want to know more about their employees and technology is available to help them. Keystrokes can be monitored, as can times the keyboard is not in use. This can be used to extrapolate such things as how long an employee takes for lunch or a break.
It is legal for employers to monitor sent & received by employees, as well as retrieve deleted messages.
In 1999 consumer groups were concerned about the processor serial number on Intel Pentium III chips that could possibly be used to track an individual on the Internet. Intel discontinued the practice in 2000.
Microsoft applications, such as Word and Excel, automatically record the creator of electronic documents and the computer on which the document was created. A hidden unique identifier is inserted into a document that identifies the Ethernet network adapter card of the computer on which the document was created. Thus, documents could be traced back to their creators. That ID is also sent to Microsoft when the owner registers Windows 98 online, so Microsoft knows your computer’s ID, and could trace documents you create. Microsoft responded to customers and bad publicity by releasing patches to remove the ID function.
The challenges to privacy from the Internet have been mentioned before. When buying products or giving personal information on the Internet, it is important to read the merchant’s privacy policy to understand what the website can do with the information you provide. Many sites provide consumers the option of requesting that their data not be given to other companies.

29. Ethical Issues in Information Systems
“Old contract” of business: the only responsibility of business is to its stockholders and owners
“Social contract” of business: businesses are responsible to society
Continued work using computer keyboards, mice, or other equipment can lead to repetitive stress disorder and carpal tunnel syndrome, both resulting in pain in the fingers, wrist, or hand. Workers’ compensation claims for these disorders has been costly for some companies.
There is contradictory evidence about other health effects, such as ozone released by improperly maintained laser printers and the relationship of emissions from computer displays and cancer.
Ergonomics is the study of designing and positioning equipment to enhance employee safety and health. Ergonomics has suggested that furniture can be designed to decrease fatigue, strain, or injury from working with computers. The positioning of keyboards and display screens, as well as lighting, is also important.

30. The AITP Code of Ethics Obligation to management
Obligation to fellow AITP members
Obligation to society
Obligation to college or university
Obligation to the employer
Obligation to country

31. The ACM Code of Professional Conduct
Strive to achieve the highest quality, effectiveness, and dignity in both the process and products of professional work
Acquire and maintain professional competence
Know and respect existing laws pertaining to professional work
Accept and provide appropriate professional review
Give comprehensive and thorough evaluations of computer systems and their impact, including analysis of possible risks

32. The ACM Code of Professional Conduct
Honor contracts, agreements, and assigned responsibilities
Improve public understanding of computing and its consequences
Access computing and communication resources only when authorized to do so

33. Shameless Plug
PC Security and Maintenance
Taught by yours truly!

34. ? ?
Questions? ? ? ?