1. CHAPTER 8 PROTECTING PEOPLE AND INFORMATION Threats and Safeguards

2. SHE LOST $400,000 TO AN E- MAIL SCAM “419” e-mails are a popular type of scam “419” e-mails are a popular type of scam 419 scams promise you, in an e-mail, that you will get rich if you ante up a small fee 419 scams promise you, in an e-mail, that you will get rich if you ante up a small fee Janella Spears took the bait and spent $400,000 trying to collect her fortune Janella Spears took the bait and spent $400,000 trying to collect her fortune She even cashed in her husband’s retirement to get the money to send the crooks She even cashed in her husband’s retirement to get the money to send the crooks

3. INTRODUCTION Handling information responsibly means understanding the following issues Handling information responsibly means understanding the following issues Ethics Ethics Personal privacy Personal privacy Threats to information Threats to information Protection of information Protection of information

4. ETHICS Ethics – the principles and standards that guide our behavior toward other people Ethics – the principles and standards that guide our behavior toward other people Ethics are rooted in history, culture, and religion Ethics are rooted in history, culture, and religion

5. Factors the Determine How You Decide Ethical Issues Actions in ethical dilemmas determined by Actions in ethical dilemmas determined by Your basic ethical structure Your basic ethical structure The circumstances of the situation The circumstances of the situation

6. Basic Ethical Structure

7. Intellectual Property Intellectual property Intellectual property Copyright Copyright Fair Use Doctrine Fair Use Doctrine

8. Intellectual Property Pirated software Pirated software Using copyrighted software without permission violates copyright law Using copyrighted software without permission violates copyright law

9. PRIVACY Privacy – the right to left alone when you want to be, to have control over your own personal possessions, and not to be observed without your consent Privacy – the right to left alone when you want to be, to have control over your own personal possessions, and not to be observed without your consent Dimensions of privacy Dimensions of privacy Psychological: to have a sense of control Psychological: to have a sense of control Legal: to be able to protect yourself Legal: to be able to protect yourself

10. Privacy and Other Individuals Key logger (key trapper) software – a program that, when installed on a computer, records every keystroke and mouse click Key logger (key trapper) software – a program that, when installed on a computer, records every keystroke and mouse click Screen capture programs – capture screen from video card Screen capture programs – capture screen from video card Hardware key logger – hardware device that captures keystrokes moving between keyboard and motherboard. Hardware key logger – hardware device that captures keystrokes moving between keyboard and motherboard. Event Data Recorders (EDR) – located in the airbag control module and collects data from your car as you are driving. Event Data Recorders (EDR) – located in the airbag control module and collects data from your car as you are driving. E-mail is stored on many computers as it travels from sender to recipient E-mail is stored on many computers as it travels from sender to recipient

11. An E-Mail is Stored on Many Computers

12. Identity Theft Identity theft – the forging of someone’s identity for the purpose of fraud Identity theft – the forging of someone’s identity for the purpose of fraud 8-12

13. Identity Theft Phishing (carding, brand spoofing) Phishing (carding, brand spoofing) http://www.youtube.com/watch?v=7MtYVS Ge1ME http://www.youtube.com/watch?v=7MtYVS Ge1ME NEVER NEVER Reply without question to an e-mail asking for personal information Reply without question to an e-mail asking for personal information Click directly on a Web site provided in such an e-mail Click directly on a Web site provided in such an e-mail

14. Pharming Pharming - rerouting your request for a legitimate Web site Pharming - rerouting your request for a legitimate Web site sending it to a slightly different Web address sending it to a slightly different Web address or by redirecting you after you are already on the legitimate site or by redirecting you after you are already on the legitimate site Pharming is accomplished by gaining access to the giant databases that Internet providers use to route Web traffic. Pharming is accomplished by gaining access to the giant databases that Internet providers use to route Web traffic. It often works because it’s hard to spot the tiny difference in the Web site address. It often works because it’s hard to spot the tiny difference in the Web site address.

15. Privacy and Employees Companies need information about their employees to run their business effectively Companies need information about their employees to run their business effectively As of March 2005, 60% of employers monitored employee e-mails As of March 2005, 60% of employers monitored employee e-mails 70% of Web traffic occurs during work hours 70% of Web traffic occurs during work hours 78% of employers reported abuse 78% of employers reported abuse 60% employees admitted abuse 60% employees admitted abuse

16. Privacy and Employees Cyberslacking Cyberslacking Visiting inappropriate sites Visiting inappropriate sites Gaming, chatting, stock trading, etc. Gaming, chatting, stock trading, etc.

17. Monitoring Technology Example of cost of misuse Example of cost of misuse Watching an online fashion show uses as much bandwidth as downloading the entire Encyclopedia Britannica Watching an online fashion show uses as much bandwidth as downloading the entire Encyclopedia Britannica Reasons for monitoring Reasons for monitoring Hire the best people possible Hire the best people possible Ensure appropriate behavior on the job Ensure appropriate behavior on the job Avoid litigation for employee misconduct Avoid litigation for employee misconduct

18. Privacy and Consumers Consumers want businesses to Consumers want businesses to Know who they are, but not to know too much Know who they are, but not to know too much Provide what they want, but not gather information on them Provide what they want, but not gather information on them Let them know about products, but not pester them with advertising Let them know about products, but not pester them with advertising

19. Other Privacy Issues Cookie Cookie Spam Spam Replying usually increases, rather than decreases, amount of spam Replying usually increases, rather than decreases, amount of spam Adware and Trojan horse software Adware and Trojan horse software Spyware (sneakware, stealthware) Spyware (sneakware, stealthware)

20. Other Privacy Issues Web log Web log Clickstream Clickstream Anonymous Web browsing (AWB) Anonymous Web browsing (AWB)

21. Privacy and Government Agencies About 2,000 government agencies have databases with information on people About 2,000 government agencies have databases with information on people Government agencies need information to operate effectively Government agencies need information to operate effectively Whenever you are in contact with government agency, you leave behind information about yourself Whenever you are in contact with government agency, you leave behind information about yourself

22. Government Agencies Storing Personal Information Law enforcement Law enforcement NCIC (National Crime Information Center) NCIC (National Crime Information Center) FBI FBI Electronic Surveillance Electronic Surveillance Carnivore or DCS-1000 Carnivore or DCS-1000 Magic Lantern (software key logger) Magic Lantern (software key logger) NSA (National Security Agency) NSA (National Security Agency) Echelon collect electronic information by satellite Echelon collect electronic information by satellite

23. Government Agencies Storing Personal Information IRS IRS Census Bureau Census Bureau Student loan services Student loan services FICA FICA Social Security Administration Social Security Administration Social service agencies Social service agencies Department of Motor Vehicles Department of Motor Vehicles

24. Laws on Privacy Health Insurance Portability and Accountability Act (HIPAA) protects personal health information Health Insurance Portability and Accountability Act (HIPAA) protects personal health information Financial Services Modernization Act requires that financial institutions protect personal customer information Financial Services Modernization Act requires that financial institutions protect personal customer information Other laws in Figure 8.6 on page 244 Other laws in Figure 8.6 on page 244

25. SECURITY AND EMPLOYEES Attacks on information and computer resources come from inside and outside the company Attacks on information and computer resources come from inside and outside the company Computer sabotage costs about $10 billion per year Computer sabotage costs about $10 billion per year In general, employee misconduct is more costly than assaults from outside In general, employee misconduct is more costly than assaults from outside

26. Security and Employees

27. Security and Outside Threats Hackers – knowledgeable computer users who use their knowledge to invade other people's computers Hackers – knowledgeable computer users who use their knowledge to invade other people's computers Computer virus (virus) – software that is written with malicious intent to cause annoyance or damage Computer virus (virus) – software that is written with malicious intent to cause annoyance or damage Worm – type of virus that spreads itself from computer to computer usually via e-mail Worm – type of virus that spreads itself from computer to computer usually via e-mail Denial-of-service (DoS) attack – floods a Web site with so many requests for service that it slows down or crashes Denial-of-service (DoS) attack – floods a Web site with so many requests for service that it slows down or crashes

28. Security Measures 1. Anti-virus software – detects and removes or quarantines computer viruses 2. Anti-spyware and anti-adware software 3. Spam protection software – identifies and marks and/or deletes Spam 4. Anti-phishing software – lets you know when phishing attempts are being made 5. Firewall – hardware and/or software that protects a computer or network from intruders

29. Security Measures 5. Anti-rootkit software – stops outsiders taking control of your machine 6. Encryption – scrambles the contents of a file so that you can’t read it without the decryption key 7. Public Key Encryption (PKE) – an encryption system with two keys: a public for everyone and a private one for the recipient 8. Biometrics – the use of physiological characteristics for identification purposes