1. 1 Chpt. 12: INFORMATION SYSTEM QUALITY, SECURITY, AND CONTROL

2. 2 Why Systems are Vulnerable Digital data –Can be duplicated/changed without being detected Networks –Connected to LANs, WANS, & the Internet –Anyone from inside/outside the organization can attempt to infiltrate information systems Data is now centralized and integrated

3. 3 Different Types of Attacks Hacker –Person who gains unauthorized access to a computer network for profit, criminal mischief, or personal pleasure Cracker –A hacker with criminal intent Denial of Service (DOS) Attack –A hacker overloads a network server with a flood of requests for information, crashing network Computer virus –Many varieties, always changing Theft –Steal hardware, software, data

4. 4 Other Threats Natural disasters –Tornado, hurricane, flood etc Man-made disasters –September 11 Human error –Data entry errors & data quality problems –Software bugs & defects

5. 5 System Quality Issues Bugs –Program code defects or errors –Difficult / impossible to achieve zero bugs Maintenance –Modifying a system in production use –Can take up to 50% of IS Staff time Data Quality –Data input errors, or faulty design –Cause serious operational and financial problems

6. 6 Creating a Control Environment Controls –Methods, policies, procedures to protect assets; accuracy & reliability of records; adherence to management standards General controls –Overall controls applied to all CBIS Application controls –Controls specific to each application

7. 7 Ensuring Availability of Systems High-Availability computing –Computing environment to help firms recover quickly from a system crash Fault-tolerant computer systems –Systems that contain redundant hardware, software, etc. that can back up a system and keep it running to prevent system failure

8. 8 Techniques Load balancing –Distributing requests across multiple servers Mirroring –Duplicating all procedures and transactions on backup server Clustering –Linking two computers, so one can act as backup

9. 9 Internet Security Firewalls –Placed between internal LANs and external networks Need to write/maintain rules that dictate what comes in and what goes out. Intrusion Detection Systems –Automatically detects suspicious network traffic at most vulnerable points of network

10. 10 Security and E-Commerce What can you do? –Encryption –Authentication –Digital signature –Digital certificate –SSL (secure sockets layer) protocol –SET (secure electronic transaction) protocol

11. 11 Ensuring Software Quality Structured Methodologies –Structured Analysis –Structured Design –Structured Programming –CASE Tools

12. 12 Structured Analysis Defines system inputs, processes and outputs Represent in Data Flow Diagrams (DFD)

13. 13 Structured Design Designs systems top-down, hierarchical Uses structure charts

14. 14 Structured Programming Uses structured design to create modules

15. 15 CASE Tools Computer Aided Software Engineering Automation of software methodologies Reduces repetitive work Automated facilities for producing –Charts and diagrams –Screen and report generators –Data dictionaries –Documentation

16. 16 Other issues Resource allocation during system development –How costs, time and personnel are assigned Software metrics –Quantify system performance Testing –Test, test, and then test some more!