1. Chapter 17 Human Resources Security

2. The topic of security awareness, training, and education is mentioned prominently in a number of standards and standards- related documents, including ISO 27002 (Code of Practice for Information Security Management) and NIST Special Publication 800-100 (Information Security Handbook: A Guide for Managers).

3. Benefits to Organizations Security awareness, training, and education programs provide four major benefits to organizations: Improving employee behavior Increasing employee accountability Mitigating liability for employee behavior Complying with regulations and contractual obligations

4. Human Factors Principal problems associated with employee behavior are: Errors and omissionsFraud Actions by disgruntled employees Employee behavior is a critical concern in ensuring the security of computer systems and information assets

7. Awareness Seeks to inform and focus an employee's attention on security issues within the organization Aware of their responsibilities for maintaining security and the restrictions on their actions Users understand the importance of security for the well- being of the organization Promote enthusiasm and management buy-in Program must be tailored to the needs of the organization and target audience Must continually promote the security message to employees in a variety of ways Should provide a security awareness policy document to all employees

8. NIST SP 800-100 ( Information Security Handbook: A Guide for Managers ) describes the content of awareness programs, in general terms, as follows: “Awareness tools are used to promote information security “Awareness tools are used to promote information security and inform users of threats and vulnerabilities that impact and inform users of threats and vulnerabilities that impact their division or department and personal work environment by explaining the what but not the how of security, and communicating what is and what is not allowed. Awareness not only communicates information security policies and procedures that need to be followed, but also provides the foundation for any sanctions and disciplinary actions imposed for noncompliance. Awareness is used to explain the rules of behavior for using an agency’s information systems and information and establishes a level of expectation on the acceptable use of the information and information systems.” level of expectation on the acceptable use of the information and information systems.”

9. What people should do and how they should do it Designed to teach people the skills to perform their IS- related tasks more securely Focus is on good computer security practices General users Develop a security mindset in the developer Programmers, developers, system maintainers How to make tradeoffs involving security risks, costs, benefits Managers Risk management goals, measurement, leadership Executives

10. Education Most in depth program Most in depth program Targeted at security professionals whose jobs require expertise in security Targeted at security professionals whose jobs require expertise in security Fits into employee career development category Fits into employee career development category Often provided by outside sources Often provided by outside sources o College courses o Specialized training programs

11. Employment Practices and Policies Managing personnel with potential access is an essential part of information security Employee involvement: o Unwittingly aid in the commission of a violation by failing to follow proper procedures o Forgetting security considerations o Not realizing that they are creating a vulnerability o Knowingly violate controls or procedures

12. Security in the Hiring Process Objective: o “To ensure that employees, contractors and third party users understand their responsibilities, and are suitable for the roles they are considered for, and to reduce the risk of theft, fraud or misuse of facilities” Need appropriate background checks and screening o Investigate accuracy of details For highly sensitive positions: o Have an investigation agency do a background check o Criminal record and credit check

13. Employment Agreements Employees should agree to and sign the terms and conditions of their employment contract, which should include: I.Employee and organizational responsibilities for information security II.A confidentiality and non- disclosure agreement III.Reference to the organization's security policy IV.Acknowledgement that the employee has reviewed and agrees to abide by the policy Employees should agree to and sign the terms and conditions of their employment contract, which should include: I.Employee and organizational responsibilities for information security II.A confidentiality and non- disclosure agreement III.Reference to the organization's security policy IV.Acknowledgement that the employee has reviewed and agrees to abide by the policy

14. Ensure that employees, contractors, and third-party users are aware of information security threats and concerns and their responsibilities and liabilities with regard to information security Are equipped to support the organizational security policy in their work Reduce the risk of human error Objectives with respect to current employees: A comprehensive security policy document An ongoing awareness and training program Two essential elements of personnel security during employment are: Least privilege Separation of duties Limited reliance on key employees Security principles:

15. Termination of Employment Termination security objectives: Ensure employees, contractors, and third party users exit organization or change employment in an orderly manner The return of all equipment and the removal of all access rights are completed Critical actions: Remove name from all authorized access lists Inform guards that ex-employee general access is not allowed Remove personal access codes, change physical locks and lock combinations, reprogram access card systems Recover all assets, including employee ID, documents, data storage devices Notify by memo or email appropriate departments

16. Email and Internet Use Policies Organizations are incorporating specific e-mail and Internet use policies into their security policy document Concerns for employers: o Work time consumed in non-work-related activities o Computer and communications resources may be consumed, compromising the mission that the IS resources are designed to support o Risk of importing malware o Possibility of harm, harassment, inappropriate online conduct

17. Business use only Policy scope Content ownership Privacy Standard of conduct Reasonable personal use Unlawful activity prohibited Security policy Company policy Company rights Disciplinary action

18. Security Incident Response Response procedures to incidents are an essential control for most organizations o Procedures need to reflect possible consequences of an incident on the organization and allow for a suitable response o Developing procedures in advance can help avoid panic Benefits of having incident response capability: o Systematic incident response o Quicker recovery to minimize loss, theft, disruption of service o Use information gained during incident handling to better prepare for future incidents o Dealing properly with legal issues that may arise during incidents

19. CSIRTs are responsible for: Rapidly detecting incidentsMinimizing loss and destructionMitigating the weaknesses that were exploitedRestoring computing services

20. “Any action that threatens one or more of the classic security services of confidentiality, integrity, availability, accountability, authenticity, and reliability in a system” Unauthorized access to a system Accessing information not authorized to see Passing information on to a person not authorized to see it Attempting to circumvent the access mechanisms Using another person’s password and user id Unauthorized modification of information on the system Attempting to corrupt information that may be of value Attempting to modify information without authority Processing information in an unauthorized manner

21. Table 17.2 Security Incident Terminology

22. Detecting Incidents Incidents may be detected by users or administration staff o Staff should be encouraged to make reports of system malfunctions or anomalous behaviors Automated tools o System integrity verification tools o Log analysis tools o Network and host intrusion detection systems (IDS) o Intrusion prevention systems

23. Goal: Ensure that all information destined for the incident handling service is channeled through a single focal point Commonly achieved by advertising the triage function as the single point of contact for the whole incident handling service Responds to incoming information by: Requesting additional information in order to categorize the incident Notifying the various parts of the enterprise or constituency about the vulnerability and shares information about how to fix or mitigate the vulnerability Identifies the incident as either new or part of an ongoing incident and passes this information on to the incident handling response function

24. Responding to Incidents Must have documented procedures to respond to incidents Procedures should: Detail how to identify the cause Describe the action taken to recover from the incident Identify typical categories of incidents and the approach taken to respond to them Identify management personnel responsible for making critical decisions and how to contact them Identify the circumstances when security breaches should be reported to third parties such as the police or relevant CERT

26. Documenting Incidents Should immediately follow a response to an incident o Identify what vulnerability led to its occurrence o How this might be addressed to prevent the incident in the future o Details of the incident and the response taken o Impact on the organization’s systems and their risk profile

27. Chapter 19 Legal and Ethical Aspects

28. “Computer crime, or cybercrime, is a term used broadly to describe criminal activity in which computers or computer networks are a tool, a target, or a place of criminal activity.” -- From the New York Law School Course on Cybercrime, Cyberterrorism, and Digital Cybercrime, Cyberterrorism, and Digital Law Enforcement Law Enforcement

29. Types of Computer Crime The U.S. Department of Justice categorizes computer crime based on the role that the computer plays in the criminal activity: Computers as targets Involves an attack on data integrity, system integrity, data confidentiality, privacy, or availability Computers as storage devices Using the computer to store stolen password lists, credit card or calling card numbers, proprietary corporate information, pornographic image files, or pirated commercial software Computers as communications tools Crimes that are committed online, such as fraud, gambling, child pornography, and the illegal sale of prescription drugs, controlled substances, alcohol, or guns

30. Table 19.1 Cybercrimes Cited in the Convention on Cybercrime Table 19.1 Cybercrimes Cited in the Convention on Cybercrime (page 1 of 2)

31. Table 19.1 Cybercrimes Cited in the Convention on Cybercrime Table 19.1 Cybercrimes Cited in the Convention on Cybercrime (page 2 of 2)

32. Table 19.2 CERT 2007 E-Crime Watch Survey Results (Table can be found on page 614 in the textbook)

33. Law Enforcement Challenges The deterrent effect of law enforcement on computer and network attacks correlates with the success rate of criminal arrest and prosecution Law enforcement agency difficulties: o Lack of investigators knowledgeable and experienced in dealing with this kind of crime o Required technology may be beyond their budget o The global nature of cybercrime o Lack of collaboration and cooperation with remote law enforcement agencies Convention on Cybercrime introduces a common terminology for crimes and a framework for harmonizing laws globally

34. Cybercriminals The lack of success in bringing them to justice has led to an increase in their numbers, boldness, and the global scale of their operations Are difficult to profile Tend to be young and very computer-savvy Range of behavioral characteristics is wide No cybercriminal databases exist that can point to likely suspects

35. Cybercrime Victims Are influenced by the success of cybercriminals and the lack of success of law enforcement Many of these organizations have not invested sufficiently in technical, physical, and human-factor resources to prevent attacks Reporting rates tend to be low because of a lack of confidence in law enforcement, concern about corporate reputation, and a concern about civil liability

36. Executive management and security administrators need to look upon law enforcement as a resource and tool Management needs to: o Understand the criminal investigation process o Understand the inputs that investigators need o Understand the ways in which the victim can contribute positively to the investigation

38. Copyright Protects tangible or fixed expression of an idea but not the idea itself Creator can claim and file copyright at a national government copyright office if: o Proposed work is original o Creator has put original idea in concrete form

39. Copyright Rights Copyright owner has these exclusive rights, protected against infringement: o Reproduction right o Modification right o Distribution right o Public-performance right o Public-display right Examples include: o Literary works o Musical works o Dramatic works o Pantomimes and choreographic works o Pictorial, graphic, and sculptural works o Motion pictures and other audiovisual works o Sound recordings o Architectural works o Software-related works

40. Patent Grant a property right to the inventor “The right to exclude others from making, using, offering for sale, or selling” the invention in the United States or “importing” the invention into the United States Types: Utility Any new and useful process, machine, article of manufacture, or composition of matter Design New, original, and ornamental design for an article of manufacture Plant Discovers and asexually reproduces any distinct and new variety of plant

41. Trademark A word, name, symbol, or device Used in trade with goods Indicates source of goods Distinguishes them from goods of others Trademark rights may be used to: o Prevent others from using a confusingly similar mark o But not to prevent others from making the same goods or from selling the same goods or services under a clearly different mark

42. Intellectual Property Relevant to Network and Computer Security A number of forms of intellectual property are relevant in the context of network and computer security Examples of some of the most prominent: Software Programs produced by vendors of commercial software Shareware Proprietary software created by an organization for internal use Software produced by individuals Databases Data that is collected and organized in such a fashion that it has potential commercial value Digital content Includes audio and video files, multimedia courseware, Web site content, and any other original digital work Algorithms An example of a patentable algorithm is the RSA public- key cryptosystem

43. U.S. Digital Millennium Copyright ACT (DMCA) Signed into law in 1998 Implements WIPO treaties to strengthen protections of digital copyrighted materials Encourages copyright owners to use technological measures to protect their copyrighted works o Measures that prevent access to the work o Measures that prevent copying of the work Prohibits attempts to bypass the measures o Both criminal and civil penalties apply to attempts to circumvent

44. Certain actions are exempted from the provisions of the DMCA and other copyright laws including: Considerable concern exists that DMCA inhibits legitimate security and encryption research o Feel that innovation and academic freedom is stifled and open source software development is threatened Fair use Reverse engineering Encryption research Security testing Personal privacy

45. Digital Rights Management (DRM) Systems and procedures that ensure that holders of digital rights are clearly identified and receive stipulated payment for their works o May impose further restrictions such as inhibiting printing or prohibiting further distribution No single DRM standard or architecture Objective is to provide mechanisms for the complete content management life cycle Provide persistent content protection for a variety of digital content types/platforms/media

48. Overlaps with computer security Dramatic increase in scale of information collected and stored o Motivated by law enforcement, national security, economic incentives Individuals have become increasingly aware of access and use of personal information and private details about their lives Concerns about extent of privacy compromise have led to a variety of legal and technical approaches to reinforcing privacy rights

49. European Union (EU) Directive on Data Protection Adopted in 1998 to: o Ensure member states protect fundamental privacy rights when processing personal information o Prevent member states from restricting the free flow of personal information within EU Organized around principles of: NoticeConsentConsistencyAccess Security Onward transfer Enforcement

50. United States Privacy Initiatives Deals with personal information collected and used by federal agencies Permits individuals to determine records kept Permits individuals to forbid records being used for other purposes Permits individuals to obtain access to records and to correct and amend records as appropriate Ensures agencies properly collect, maintain, and use personal information Creates a private right of action for individuals Privacy Act of 1974 Also have a range of other privacy laws

51. “An organization’s data policy for privacy and protection of personally identifiable information should be developed and implemented. This policy should be communicated to all persons involved in the processing of personally identifiable information. Compliance with this policy and all relevant legislation and regulations concerning the protection of the privacy of people and the protection of personally identifiable information requires appropriate management structure and control. Often this is best achieved by the appointment of a person responsible, such as a privacy officer, who should provide guidance to managers, users and service providers on their individual responsibilities and the specific procedures that should be followed. Responsibility for handling personally identifiable information and ensuring awareness of the privacy principles should be dealt with in accordance with relevant legislation and regulations. Appropriate technical and organizational measures to protect personally identifiable information should be implemented.”

52. Privacy and Data Surveillance Demands of homeland security and counterterrorism have imposed new threats to personal privacy Law enforcement and intelligence agencies have become increasingly aggressive in using data surveillance techniques to fulfill their mission Private organizations are exploiting a number of trends to increase their ability to build detailed profiles of individuals o Spread of the Internet o Increase in electronic payment methods o Near-universal use of cellular phone communications o Ubiquitous computation o Sensor webs Both policy and technical approaches are needed to protect privacy when both government and nongovernment organizations seek to learn as much as possible about individuals

53. Ethical Issues Many potential misuses and abuses of information and electronic communication that create privacy and security problems Basic ethical principles developed by civilizations apply o Unique considerations surrounding computers and information systems o Scale of activities not possible before o Creation of new types of entities for which no agreed ethical rules have previously been formed Ethics: “A system of moral principles that relates to the benefits and harms of particular actions, and to the rightness and wrongness of motives and ends of those actions.”

55. Ethical Issues Related to Computers and Information Systems Some ethical issues from computer use: o Repositories and processors of information o Producers of new forms and types of assets o Instruments of acts o Symbols of intimidation and deception Those who understand, exploit technology, and have access permission, have power over these

56. Concern with balancing professional responsibilities with ethical or moral responsibilities Concern with balancing professional responsibilities with ethical or moral responsibilities Types of ethical areas a computing or IS professional may face: Types of ethical areas a computing or IS professional may face: o Ethical duty as a professional may come into conflict with loyalty to employer o “Blowing the whistle” o Expose a situation that can harm the public or a company’s customers o Potential conflict of interest Organizations have a duty to provide alternative, less extreme opportunities for the employee Organizations have a duty to provide alternative, less extreme opportunities for the employee o In-house ombudsperson coupled with a commitment not to penalize employees for exposing problems Professional societies should provide a mechanism whereby society members can get advice on how to proceed Professional societies should provide a mechanism whereby society members can get advice on how to proceed Professional/Ethical Responsibilities

57. Ethics are not precise laws or sets of facts Many areas may present ethical ambiguity Many professional societies have adopted ethical codes of conduct which can: 1 Be a positive stimulus and instill confidence 2 Be educational 3 Provide a measure of support 4 Be a means of deterrence and discipline 5 Enhance the profession's public image

59. Comparison of Codes of Conduct Both codes place their emphasis on the responsibility of professionals to other people Do not fully reflect the unique ethical problems related to the development and use of computer and IS technology Common themes: o Dignity and worth of other people o Personal integrity and honesty o Responsibility for work o Confidentiality of information o Public safety, health, and welfare o Participation in professional societies to improve standards of the profession o The notion that public knowledge and access to technology is equivalent to social power

60. The Rules Collaborative effort to develop a short list of guidelines on the ethics of computer systems Ad Hoc Committee on Responsible Computing o Anyone can join this committee and suggest changes to the guidelines o Moral Responsibility for Computing Artifacts Generally referred to as The Rules The Rules apply to software that is commercial, free, open source, recreational, an academic exercise or a research tool o Computing artifact Any artifact that includes an executing computer program

61. As of this writing, the rules are as follows: 1)The people who design, develop, or deploy a computing artifact are morally responsible for that artifact, and for the foreseeable effects of that artifact. This responsibility is shared with other people who design, develop, deploy or knowingly use the artifact as part of a sociotechnical system. 2)The shared responsibility of computing artifacts is not a zero-sum game. The responsibility of an individual is not reduced simply because more people become involved in designing, developing, deploying, or using the artifact. Instead, a person’s responsibility includes being answerable for the behaviors of the artifact and for the artifact’s effects after deployment, to the degree to which these effects are reasonably foreseeable by that person. 3)People who knowingly use a particular computing artifact are morally responsible for that use. 4) People who knowingly design, develop, deploy, or use a computing artifact can do so responsibly only when they make a reasonable effort to take into account the sociotechnical systems in which the artifact is embedded. 5)People who design, develop, deploy, promote, or evaluate a computing artifact should not explicitly or implicitly deceive users about the artifact or its foreseeable effects, or about the sociotechnical systems in which the artifact is embedded.

62. Revision for exam Link in class