1. Risks, Security, and Disaster Recovery

2. Objectives Describe the primary goals of information security
Enumerate the main types of risks to information systems
List the various types of attacks on networked systems
Describe the types of controls required to ensure the integrity of data entry and processing and uninterrupted e-commerce

3. Objectives (continued)
Describe the various kinds of security measures that can be taken to protect data and ISs
Improve the security of your personal information system and the information it stores
Recognize online scams
Outline the principles of developing a recovery plan
Explain the economic aspects of information security

4. Goals of Information Security
Protecting IT resources is a primary concern
Securing corporate ISs is becoming increasingly challenging
The major goals of information security are to:
Reduce the risk of systems ceasing operation
Maintain information confidentiality
Ensure the integrity and reliability of data resources
Ensure the uninterrupted availability of resources
Ensure compliance with policies and laws

5. Risks to Information Systems
Downtime: the period of time during which an IS is not available
Extremely expensive: average losses of:
$2,500/minute for CRM systems
$7,800/minute for e-commerce applications
$4 billion lost annually in the U.S. due to downtime

6. Risks to Hardware #1 cause of system downtime is hardware failure
Major causes of damage to hardware include:
Natural disasters
Fires, floods, earthquakes, hurricanes, tornadoes, and lightning
Blackouts and brownouts
Blackout: total loss of electricity
Brownout: partial loss of electricity
Uninterruptible power supply (UPS): backup power
Vandalism
Deliberate destruction

7. Risks to Data and Applications
Data should be a primary concern because it is often a unique resource
Data and applications are susceptible to disruption, damage, and theft
The culprit in damage to software or data is almost always human
Keystroke logging: records individual keystrokes
Social engineering: con artists pretend to be service people, and ask for passwords
Identity theft: pretending to be another person

9. Risks to Data and Applications (continued)
Risks to data include:
Alteration
Destruction
Web defacement
Deliberate alteration or destruction is often done as a prank, but has a high cost
The target may be a company’s Web site
Honeytoken: a bogus record in a networked database used to combat hackers

10. Risks to Data and Applications (continued)
Honeypot: a server containing a mirrored copy of a database or a bogus database
Educates security officers about vulnerable points
Virus: spreads from computer to computer
Worm: spreads in a network without human intervention
Antivirus software: protects against viruses
Trojan horse: a virus disguised as legitimate software

12. Risks to Data and Applications (continued)
Logic bomb: software that is programmed to cause damage at a specific time
Unintentional, nonmalicious damage can be caused by:
Human error
Lack of adherence to backup procedures
Poor training
Unauthorized downloading and installation of software may cause damage

13. Risks to Online Operations
Many hackers try daily to interrupt online businesses
Types of attacks include:
Unauthorized access
Data theft
Defacing of Web pages
Denial of service
Hijacking

14. Denial of Service
Denial of service (DoS): an attacker launches a large number of information requests
Slows down legitimate traffic to site
Distributed denial of service (DDoS): an attacker launches a DoS attack from multiple computers
Usually launched from hijacked personal computers called “zombies”
No definitive cure for this
A site can filter illegitimate traffic

15. Computer Hijacking
Hijacking: using some or all of a computer’s resources without the consent of its owner
Often done for making a DDoS attack
Done by installing a software bot on the computer
Main purpose of hijacking is usually to send spam
Bots are planted by exploiting security holes in operating systems and communications software
A bot usually installs forwarding software

16. Controls
Controls: constraints and restrictions imposed on a user or a system
Controls can be used to secure against risks
Controls are also used to ensure that nonsensical data is not entered
Controls can reduce damage caused to systems, application, and data

17. Controls (continued)

18. Application Reliability and Data Entry Controls
A reliable application is one that can resist inappropriate usage such as incorrect data entry or processing
The application should provide clear messages when errors or deliberate misuses occur
Controls also translate business policies into system features

19. Backup Backup: periodic duplication of all data
Redundant Arrays of Independent Disks (RAID): set of disks programmed to replicate stored data
Data must be routinely transported off-site as protection from a site disaster
Some companies specialize in data backup services or backup facilities for use in the event of a site disaster

20. Access Controls
Access controls: measures taken to ensure only authorized users have access to a computer, network, application, or data
Physical locks: lock the equipment in a secure facility
Software locks: determine who is authorized
Three types of access controls:
What you know: access codes, such as user ID and password
What you have: requires special devices
Who you are: unique physical characteristics

21. Access Controls (continued)
Access codes and passwords are usually stored in the OS or in a database
Security card is more secure than a password
Allows two-factor access
Biometric: uses unique physical characteristics such as fingerprints, retinal scans, or voiceprints
Up to 50% of help desk calls are from people who have forgotten their passwords
Biometrics can eliminate these kinds of calls

22. Atomic Transactions
Atomic transaction: a set of indivisible transactions
All of the transactions in the set must be completely executed, or none can be
Ensures that only full entry occurs in all the appropriate files to guarantee integrity of the data
Is also a control against malfunction and fraud

23. Atomic Transactions (continued)

24. Audit Trail
Audit trail: a series of documented facts that help detect who recorded which transactions, at what time, and under whose approval
Sometimes automatically created using data and timestamps
Certain policy and audit trail controls are required in some countries
Information systems auditor: a person whose job is to find and investigate fraudulent cases

25. Security Measures
Organizations can protect against attacks using various approaches, including:
Firewalls
Authentication
Encryption
Digital signatures
Digital certificates

26. Firewalls and Proxy Servers
Firewall: the best defense against unauthorized access over the Internet
Consists of hardware and software that blocks access to computing resources
Firewalls are now routinely integrated into routers
DMZ: demilitarized zone approach
One end of the network is connected to the trusted network, and the other end to the Internet
Proxy server: represents another server
Employs a firewall, and is usually placed between the Internet and the trusted network

28. Authentication and Encryption
Authentication: the process of ensuring that you are who you say you are
Encryption: coding a message into an unreadable form
Messages are encrypted and authenticated to ensure security
A message may be text, image, sound, or other digital information

29. Authentication and Encryption (continued)

30. Authentication and Encryption (continued)
Encryption programs scramble the transmitted information
Plaintext: the original message
Ciphertext: the encoded message
Encryption uses a mathematical algorithm and a key
Key: a unique combination of bits that will decipher the ciphertext
Public-key encryption: uses two keys, one public and one private

32. Authentication and Encryption (continued)
Symmetric encryption: when the sender and the recipient use the same key
Asymmetric encryption: both a public and a private key are used
Transport Layer Security (TLS): a protocol for transactions on the Web that uses a combination of public key and symmetric key encryption
HTTPS: the secure version of HTTP
Digital signature: a means to authenticate online messages; implemented with public keys

34. Authentication and Encryption (continued)
Message digest: unique fingerprint of file
Digital certificates: computer files that associate one’s identity with one’s public key
Issued by certificate authority
Certificate authority (CA): a trusted third party
A digital certificate contains its holder’s name, a serial number, its expiration dates, and a copy of holder’s public key
Also contains the digital signature of the CA

36. The Downside of Security Measures
Single sign-on (SSO): a user must enter his or her name/password only once
Single sign-on saves employees time
Encryption slows down communication
Every message must be encrypted and then decrypted
IT specialists must clearly explain the implications of security measures to upper management

37. Recovery Measures
Security measures may reduce mishaps, but no one can control all disasters
Preparation for uncontrolled disasters requires that recovery measures are in place
Redundancy may be used
Very expensive, especially in distributed systems
Other measures must be taken

38. The Business Recovery Plan
Business recovery plan: a plan about how to recover from a disaster
Also called disaster recovery plan, business resumption plan, or business continuity plan
Nine steps to develop a business recovery plan:
Obtain management’s commitment to the plan
Establish a planning committee
Perform risk assessment and impact analysis
Prioritize recovery needs
Mission-critical applications: those without which the business cannot conduct operations

39. The Business Recovery Plan (continued)
Nine steps to develop a business recovery plan (continued):
Select a recovery plan
Select vendors
Develop and implement the plan
Test the plan
Continually test and evaluate
The plan should include key personnel and their responsibilities

40. Recovery Planning and Hot Site Providers
Can outsource recovery plans to firms that specialize in disaster recover planning
Hot sites: alternative sites that a business can use when a disaster occurs
Backup sites provide desks, computer systems, and Internet links

41. The Economics of Information Security
Security measures should be regarded as analogous to insurance
Spending for security measures should be proportional to the potential damage
A business must assess the minimum acceptable rate of system downtime and ensure that the company can financially sustain the downtime

42. How Much Security Is Enough Security?
Two costs should be considered:
Cost of the potential damage
Cost of implementing a preventative measure
As the cost of security measures increases, the cost of potential damage decreases
Companies try to find the optimal point
The company must define what needs to be protected
Security measures should never exceed the value of protected system

43. How Much Security Is Enough Security? (continued)

44. Calculating Downtime
Businesses should try to minimize downtime, but the benefit of greater uptime must be compared to the added cost
Mission-critical systems must be connected to an alternative source of power, duplicated with a redundant system, or both
Many ISs are now interfaced with other systems
Interdependent systems have greater downtime
Redundancy reduces downtime

45. Summary
The purpose of controls and security measures is to maintain the functionality of ISs
Risks to ISs include risks to hardware, data, and networks, and natural disaster and vandalism
Risks to data and applications include theft of information, identity theft, data alteration, data destruction, defacement of Web sites, viruses, worms, logic bombs, and nonmalicious mishaps
Risks to online systems include denial of service and hijacking

46. Summary (continued) Controls are used to minimize disruption
Access controls require information to be entered before resources are made available
Atomic transactions ensure data integrity
Firewalls protect against Internet attacks
Encryption schemes scramble messages to protect them on the Internet
A key is used to encrypt and decrypt messages

47. Summary (continued)
SSL, TLS, and HTTPS are encryption standards designed for the Web
Keys and digital certificates can be purchased from a certificate authority
Many organizations have business recovery plans, which may be outsourced
Careful evaluation of the amount spent on security measures is necessary
Redundancy reduces the probability of downtime
Governments are obliged to protect citizens against crime and terrorism