1. Security Policies

2. Threats to security and integrity  Threats to information systems include  Human error –keying errors, program errors, operator errors, Y2K  Computer crime –hacking, viruses, logic bombs  Natural disasters –fire, earthquake, hurricane, flood  War and terrorist activities –bombs, fire  Hardware failure –power failure, network failure, disk head crash

3. Risk analysis  What is the nature of the data stored in the system?  How is the data used?  Who has access to the system?  Is all software Year 2000 compliant?  How much money does the company stand to lose if the data is lost, corrupted or stolen?

4. Layers of control Personnel screening Operational security Communications security Authorisation software Terminal use controls Building security Guards, Ids, Visitors passes, sign in/out IT SYSTEMS AND DATA Locks, swipe cards, biometric measures (e.g. fingerprint recognition) Access rights (e.g. no access, read-only, read-write) Automatic callback, encryption, hand-shaking procedures Audit trails, unusual patterns of use, virus checks, backup and recovery procedures Hiring policies, separation of duties, education and training, establishing standards of honesty Espionage, fraud and theft, threats, blackmail Errors in programming, input and output procedures, operations Natural disasters and accidents Invasions of privacy, virus introduction, malicious destruction of data

5. Layers of control  Building and equipment security – locks and window grills, guards, alarms and automatic fire extinguishers, Id cards, visitor’s pass  Authorisation software – user ids and passwords  Communications security – Databases vulnerable to outside hackers. Combat illegal access with callback, handshaking, encryption  Operational security – Audit controls track what happens on a network  Audit trail – record that traces a transaction  Personnel safeguards – users and computer personnel within an organisation are more likely to breach security than outsiders

6. Corporate I.T. security policy  Awareness and education –Training  Administrative controls –screening, separation of duties  Operations controls –backups, access controls  Physical protection of data –controlled access, fire/flood alarms, UPS  Access controls to the system and information –access levels, access rights, encryption  Disaster recovery plan