1. 8-1 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Chapter 8 Protecting People and Information Threats and Safeguards

2. 8-2 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Presentation Overview Ethics Ethics Privacy Privacy Information Information Security Security

3. 8-3 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Opening Case Study Digital Destruction Beyond All Imagination One of the lessons learned from 9/11 is that with careful and thorough protection of important information, not even a calamity like the one that occurred in New York can put you out of business. One of the lessons learned from 9/11 is that with careful and thorough protection of important information, not even a calamity like the one that occurred in New York can put you out of business. In what ways is information vulnerable and what can you do to protect important information? In what ways is information vulnerable and what can you do to protect important information?

4. 8-4 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved To handle information in a responsible way you must understand: To handle information in a responsible way you must understand:  The importance of ethics in the ownership and use of information.  The importance to people of personal privacy and the ways in which it can be compromised.  The value of information to an organization.  Threats to information and how to protect against them (security). Introduction

5. 8-5 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Introduction

6. 8-6 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Ethics Ethics - the principles and standards that guide our behavior toward other people. Ethics - the principles and standards that guide our behavior toward other people.

7. 8-7 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Ethics Two Factors That Determine How You Decide Ethical Issues 1. Your basic ethical structure, which you developed as you grew up. 2. The set of practical circumstances involved in the decision that you’re trying to make — that is, all the shades of gray in what are rarely black or white decisions.

8. 8-8 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Ethics Two Factors That Determine How You Decide Ethical Issues

9. 8-9 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Ethics Two Factors That Determine How You Decide Ethical Issues The practical circumstances surrounding decisions include: The practical circumstances surrounding decisions include: 1. Consequences - how much or how little benefit or harm will come from a particular decision? 2. Society’s opinion - what is your perception of what society really thinks of your intended action? 3. Likelihood of effect - what is the probability of the harm or benefit that will occur if you take the action?

10. 8-10 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Ethics Two Factors That Determine How You Decide Ethical Issues 4. Time to consequences - what length of time will it take for the benefit or harm to take effect? 5. Relatedness - how much do you identify with the person or persons who will receive the benefit or suffer the harm? 6. Reach of result - how many people will be affected by your action?

11. 8-11 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Ethics Guidelines for Ethical Computer System Use In the figure to the right you see the four quadrants of ethical and legal behavior. In the figure to the right you see the four quadrants of ethical and legal behavior. You’re pretty safe if you can manage to stay in quadrant I. You’re pretty safe if you can manage to stay in quadrant I.

12. 8-12 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Ethics Intellectual Property Intellectual property - intangible creative work that is embodied in physical form. Intellectual property - intangible creative work that is embodied in physical form. Copyright - the legal protection afforded an expression of an idea, such as a song, video game, and some types of proprietary documents. Copyright - the legal protection afforded an expression of an idea, such as a song, video game, and some types of proprietary documents.

13. 8-13 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Ethics Intellectual Property Fair Use Doctrine - says that you may use copyrighted material in certain situations — for example, in the creation of new work or, within certain limits, for teaching purposes. Fair Use Doctrine - says that you may use copyrighted material in certain situations — for example, in the creation of new work or, within certain limits, for teaching purposes. Pirated software - the unauthorized use, duplication, distribution or sale of copyrighted software. Pirated software - the unauthorized use, duplication, distribution or sale of copyrighted software.

14. 8-14 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Ethics Intellectual Property Counterfeit software - software that is manufactured to look like the real thing and sold as such. Counterfeit software - software that is manufactured to look like the real thing and sold as such. On Your Own Are You Careful About Your Posture? (p. 377)

15. 8-15 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy - the right to be left alone when you want to be, to have control over your own personal possessions, and not to be observed without your consent. Privacy - the right to be left alone when you want to be, to have control over your own personal possessions, and not to be observed without your consent.

16. 8-16 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Other Individuals Key logger, or key trapper, software, - a program, when installed on a computer, records every keystroke and mouse click. Key logger, or key trapper, software, - a program, when installed on a computer, records every keystroke and mouse click. Team WorkWhat Would You Do? (p. 380)

17. 8-17 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Other Individuals E-mail is completely insecure. E-mail is completely insecure. Each e-mail you send results in at least 3 or 4 copies being stored on different computers. Each e-mail you send results in at least 3 or 4 copies being stored on different computers. You can take measures to protect your e-mail. You can take measures to protect your e-mail.

18. 8-18 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Other Individuals

19. 8-19 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Employees Companies need information about their employees and customers to be effective in the marketplace. Companies need information about their employees and customers to be effective in the marketplace. In 2001, 63% of companies monitored employee Internet connections including about two-thirds of the 60 billion electronic messages sent by 40 million e-mail users. In 2001, 63% of companies monitored employee Internet connections including about two-thirds of the 60 billion electronic messages sent by 40 million e-mail users.

20. 8-20 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Employees Good reasons for seeking and storing personal information on employees. Good reasons for seeking and storing personal information on employees.  Hire the best people possible and avoid being sued for failing to adequately investigate backgrounds.  Ensure staff members are conducting themselves appropriately.  Held liable for the actions of employees.

21. 8-21 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Employees Hardware key logger - a hardware device that captures keystrokes on their journey from the keyboard to the motherboard. Hardware key logger - a hardware device that captures keystrokes on their journey from the keyboard to the motherboard.

22. 8-22 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Consumers Customers want businesses to: Customers want businesses to:  Know who they are, but they want them to leave them alone.  Provide what they want, but they don’t want businesses knowing too much about their habits and preferences.  Tell them about products and services they might like to have, but don’t want to be inundated with ads.

23. 8-23 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Consumers Cookie - a small record deposited on your hard disk by a Web site containing information about you and your Web activities. Cookie - a small record deposited on your hard disk by a Web site containing information about you and your Web activities. Adware - software to generate ads that installs itself on your computer when you download some other (usually free) program from the Web. Adware - software to generate ads that installs itself on your computer when you download some other (usually free) program from the Web. Trojan-horse software - software you don’t want hidden inside software you do want. Trojan-horse software - software you don’t want hidden inside software you do want.

24. 8-24 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Consumers Adware

25. 8-25 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Consumers Spyware (also called sneakware or stealthware) - software that comes hidden in free downloadable software and tracks your online movements, mines the information stored on your computer, or uses your computer’s CPU and storage for some task you know nothing about. Spyware (also called sneakware or stealthware) - software that comes hidden in free downloadable software and tracks your online movements, mines the information stored on your computer, or uses your computer’s CPU and storage for some task you know nothing about.

26. 8-26 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Consumers Web log - consists of one line of information for every visitor to a Web site and is usually stored on a Web server. Web log - consists of one line of information for every visitor to a Web site and is usually stored on a Web server. Clickstream - records information about you during a Web surfing session such as what Web sites you visited, how long you were there, what ads you looked at, and what you bought. Clickstream - records information about you during a Web surfing session such as what Web sites you visited, how long you were there, what ads you looked at, and what you bought. Anonymous Web browsing (AWB) services - hides your identity from the Web sites you visit. Anonymous Web browsing (AWB) services - hides your identity from the Web sites you visit.

27. 8-27 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Government Agencies Government agencies have about 2,000 databases containing personal information on individuals. Government agencies have about 2,000 databases containing personal information on individuals. The various branches of government need information to administer entitlement programs, such as social security, welfare, student loans, law enforcement, and so on. The various branches of government need information to administer entitlement programs, such as social security, welfare, student loans, law enforcement, and so on.

28. 8-28 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Government Agencies Law enforcement Law enforcement  NCIC (National Crime Information Center)  FBI’s Carnivore or DCS-1000 Carnivore or DCS-1000 Magic Lantern (software key logger) Magic Lantern (software key logger)  NSA (National Security Agency) Echelon Echelon

29. 8-29 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Government Agencies Other Federal agencies Other Federal agencies  IRS  Census bureau  Student loan services  FICA  Social security  Welfare records

30. 8-30 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and Government Agencies Team WorkWhat Are The Biggest Internet Scams? (p. 387)

31. 8-31 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and International Trade Safe-harbor principles - a set of rules to which U.S. businesses that want to trade with the European Union (EU) must adhere. Safe-harbor principles - a set of rules to which U.S. businesses that want to trade with the European Union (EU) must adhere. On Your Own What’s Your Opinion? (p. 388)

32. 8-32 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Privacy and International Trade The rights granted to EU citizens include the consumer’s right to: The rights granted to EU citizens include the consumer’s right to:  Know the marketer’s source of information.  Check personal identifiable information for accuracy.  Correct any incorrect information.  Specify that information can’t be transferred to a third party without the consumer’s consent.  Know the purpose for which the information is being collected.

33. 8-33 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Laws on Privacy The Health Insurance Portability and Accountability (HIPAA) act seeks to: The Health Insurance Portability and Accountability (HIPAA) act seeks to:  Limit release and use of health information.  Right to access your medical records.  Specify circumstances of access.  Disclosure if recipient signs protection agreement.

34. 8-34 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Privacy Laws on Privacy

35. 8-35 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Information

36. 8-36 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Information Information as Raw Material Raw materials are the components from which a product is made. Raw materials are the components from which a product is made. Wood, glue, and screws are raw materials for a chair. Wood, glue, and screws are raw materials for a chair. Almost everything you buy has information as part of the product. Almost everything you buy has information as part of the product. The most successful companies place the highest value on information. The most successful companies place the highest value on information.

37. 8-37 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Information Information as Capital Capital is the asset you use to produce a product or service. Capital is the asset you use to produce a product or service. Buildings, trucks, and machinery are assets. Buildings, trucks, and machinery are assets. Information is capital since it is used by companies to provide products and services. Information is capital since it is used by companies to provide products and services.

38. 8-38 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Security Security and Employees Most of the press reports are about outside attacks on computer systems, but actually, companies are in far more danger of losing money from employee misconduct than they are from outsiders. Most of the press reports are about outside attacks on computer systems, but actually, companies are in far more danger of losing money from employee misconduct than they are from outsiders. White-collar crime accounts for about $400 billion in losses every year. White-collar crime accounts for about $400 billion in losses every year.

39. 8-39 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Security Security and Employees

40. 8-40 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Security Security and Collaboration Partners If you use collaboration systems, representatives of other companies can gain access to your systems. If you use collaboration systems, representatives of other companies can gain access to your systems. Grid computing - harnesses far-flung computers together by way of the Internet or a virtual private network to share CPU power, databases, and database storage. Grid computing - harnesses far-flung computers together by way of the Internet or a virtual private network to share CPU power, databases, and database storage.

41. 8-41 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Security Security and Outside Threats 85% of large companies and governmental agencies were broken into during 2001. 85% of large companies and governmental agencies were broken into during 2001. Hackers - very knowledgeable computer users who use their knowledge to invade other people’s computers. Hackers - very knowledgeable computer users who use their knowledge to invade other people’s computers.

42. 8-42 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Security Security and Outside Threats

43. 8-43 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Security Security and Outside Threats Computer virus (or simply a virus) - is software that is written with malicious intent to cause annoyance or damage. Computer virus (or simply a virus) - is software that is written with malicious intent to cause annoyance or damage. Worm - a type of virus that spreads itself, not just from file to file, but from computer to computer via e-mail and other Internet traffic. Worm - a type of virus that spreads itself, not just from file to file, but from computer to computer via e-mail and other Internet traffic. Denial-of-service attack (DoS) - floods a Web site with so many requests for service that it slows down or crashes. Denial-of-service attack (DoS) - floods a Web site with so many requests for service that it slows down or crashes.

44. 8-44 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Security Security and Outside Threats

45. 8-45 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Security Security and Outside Threats Computer viruses can’t: Computer viruses can’t:  Hurt your hardware (i.e. monitors, printers, or processor.)  Hurt any files they weren’t designed to attack.  Infect files on write-protected disks.

46. 8-46 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Security Security Precautions Risk management - consists of the identification of risks or threats, the implementation of security measures, and the monitoring of those measures for effectiveness. Risk management - consists of the identification of risks or threats, the implementation of security measures, and the monitoring of those measures for effectiveness.

47. 8-47 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Security Security Precautions Risk assessment - the process of evaluating IT assets, their importance to the organization, and their susceptibility to threats, to measure the risk exposure of these assets. Risk assessment - the process of evaluating IT assets, their importance to the organization, and their susceptibility to threats, to measure the risk exposure of these assets. Risk assessment asks: Risk assessment asks:  What can go wrong?  How likely is it to go wrong?  What are the possible consequences if it does go wrong?

48. 8-48 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Security Security Precautions Backup - the process of making a copy of the information stored on a computer. Backup - the process of making a copy of the information stored on a computer. Anti-virus software - detects and removes or quarantines computer viruses. Anti-virus software - detects and removes or quarantines computer viruses. Firewall - hardware and/or software that protects computers from intruders. Firewall - hardware and/or software that protects computers from intruders.

49. 8-49 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Security Security Precautions Biometrics - the use of physical characteristics — such as your fingerprint, the blood vessels in the retina of your eye, the sound of your voice, or perhaps even your breath — to provide identification. Biometrics - the use of physical characteristics — such as your fingerprint, the blood vessels in the retina of your eye, the sound of your voice, or perhaps even your breath — to provide identification.

50. 8-50 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Security Security Precautions Encryption – scrambles the contents of a file so that you can’t read it without having the right decryption key. Encryption – scrambles the contents of a file so that you can’t read it without having the right decryption key. Public key encryption (PKE) - an encryption system that uses two keys: a public key that everyone can have and a private key for only the recipient. Public key encryption (PKE) - an encryption system that uses two keys: a public key that everyone can have and a private key for only the recipient.

51. 8-51 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Security Security Precautions Intrusion-detection software - looks for people on the network who shouldn’t be there or who are acting suspiciously. Intrusion-detection software - looks for people on the network who shouldn’t be there or who are acting suspiciously. Security auditing software - checks out your computer or network for potential weaknesses. Security auditing software - checks out your computer or network for potential weaknesses.

52. 8-52 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Closing Case Study One Protecting More than Health In a two-month period in 2001, the Cleveland Clinic detected eight security breaches. In a two-month period in 2001, the Cleveland Clinic detected eight security breaches. Why might people break into a clinic? Why might people break into a clinic? What steps could the Cleveland Clinic take to prevent these security breaches? What steps could the Cleveland Clinic take to prevent these security breaches?

53. 8-53 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Closing Case Study Two Is the Safe Harbor Safe for U.S. Businesses? European countries and Australia have passed laws protecting the privacy of name-linked information of consumers. European countries and Australia have passed laws protecting the privacy of name-linked information of consumers. Would you like to have stronger privacy laws in this country? Would you like to have stronger privacy laws in this country?

54. 8-54 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Summary Student Learning Outcomes 1. Define ethics and describe the two factors that affect how you make a decision concerning an ethical issue. 2. Define and describe intellectual property, copyright, Fair Use Doctrine, and pirated and counterfeit software. 3. Define privacy and describe the ways in which it can be threatened.

55. 8-55 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Summary Student Learning Outcomes 4. Describe the two ways that information is valuable to business. 5. Describe the ways in which information on your computer or network is vulnerable. 6. Define risk management and risk assessment and describe the seven security measures that companies can take to protect their information.

56. 8-56 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Summary Assignments & Exercises 1. Helping a friend 2. Find Anti-virus software 3. Find out what happened in the U.S. 4. Investigate monitoring systems 5. Check out the Computer Ethics Institute’s advice

57. 8-57 Management Information Systems for the Information Age Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Visit the Web to Learn More www.mhhe.com/haag Airlines Airlines Trains and busses Trains and busses Rental cars Rental cars Road conditions and maps Road conditions and maps Lodging Lodging One-stop travel sites One-stop travel sites Destination information Destination information Security and Privacy Security and Privacy