Understanding Information Systems Security and Control: Vulnerabilities, Controls, and Quality Management

1. 16. INFORMATION SYSTEMS SECURITY & CONTROL

2. LEARNING OBJECTIVES • DEMONSTRATE WHY INFO SYSTEMS ARE VULNERABLE TO DESTRUCTION, ERROR, ABUSE, QUALITY CONTROL PROBLEMS • COMPARE GENERAL AND APPLICATION CONTROLS • SELECT FACTORS FOR DEVELOPING CONTROLS *

3. LEARNING OBJECTIVES • DESCRIBE IMPORTANT SOFTWARE QUALITY- ASSURANCE TECHNIQUES • DEMONSTRATE IMPORTANCE OF AUDITING INFO SYSTEMS & SAFEGUARDING DATA QUALITY *

4. MANAGEMENT CHALLENGES • SYSTEM VULNERABILITY & ABUSE • CREATING A CONTROL ENVIRONMENT • ENSURING SYSTEM QUALITY *

5. SYSTEM VULNERABILITY & ABUSE • WHY SYSTEMS ARE VULNERABLE • HACKERS & VIRUSES • CONCERNS FOR BUILDERS & USERS • SYSTEM QUALITY PROBLEMS *

6. THREATS TO INFORMATION SYSTEMS HARDWARE FAILURE, FIRE SOFTWARE FAILURE, ELECTRICAL PROBLEMS PERSONNEL ACTIONS, USER ERRORS ACCESS PENETRATION, PROGRAM CHANGES THEFT OF DATA, SERVICES, EQUIPMENT TELECOMMUNICATIONS PROBLEMS *

7. WHY SYSTEMS ARE VULNERABLE • SYSTEM COMPLEXITY • COMPUTERIZED PROCEDURES NOT ALWAYS READ OR AUDITED • EXTENSIVE EFFECT OF DISASTER • UNAUTHORIZED ACCESS POSSIBLE *

8. VULNERABILITIES • RADIATION:Allows recorders, bugs to tap system • CROSSTALK:Can garble data • HARDWARE:Improper connections, failure of protection circuits • SOFTWARE:Failure of protection features,access control, bounds control • FILES:Subject to theft, copying,unauthorized access *

9. VULNERABILITIES • USER:Identification, authentication, subtle software modification • PROGRAMMER:Disables protective features; reveals protective measures • MAINTENANCE STAFF: Disables hardware devices; uses stand-alone utilities • OPERATOR: Doesn’t notify supervisor, reveals protective measures *

10. HACKERS & COMPUTER VIRUSES • HACKER:Person gains access to computer for profit, criminal mischief, personal pleasure • COMPUTER VIRUS:Rouge program; difficult to detect; spreads rapidly; destroys data; disrupts processing & memory *

11. COMMON COMPUTER VIRUSES • CONCEPT: Word documents, e-mail. Deletes files • FORM: Makes clicking sound, corrupts data • ONE_HALF: Corrupts hard drive, flashes its name on screen • MONKEY: Windows won’t run • JUNKIE: Infects files, boot sector, memory conflicts • RIPPER: Randomly corrupts hard drive files *

12. ANTIVIRUS SOFTWARE • SOFTWARE TO DETECT • ELIMINATE VIRUSES • ADVANCED VERSIONS RUN IN MEMORY TO PROTECT PROCESSING, GUARD AGAINST VIRUSES ON DISKS, AND ON INCOMING NETWORK FILES *

13. CONCERNS FOR BUILDERS & USERS DISASTER BREACH OF SECURITY ERRORS *

14. DISASTER • LOSS OF HARDWARE, SOFTWARE, DATA BY FIRE, POWER FAILURE, FLOOD OR OTHER CALAMITY FAULT-TOLERANT COMPUTER SYSTEMS: BACKUP SYSTEMS TO PREVENT SYSTEM FAILURE (Particularly On-line Transaction Processing) *

15. SECURITY POLICIES, PROCEDURES, TECHNICAL MEASURES TO PREVENT UNAUTHORIZED ACCESS, ALTERATION, THEFT, PHYSICAL DAMAGE TO INFORMATION SYSTEMS *

16. WHERE ERRORS OCCUR • DATA PREPARATION • TRANSMISSION • CONVERSION • FORM COMPLETION • ON-LINE DATA ENTRY • KEYPUNCHING; SCANNING; OTHER INPUTS *

17. WHERE ERRORS OCCUR • VALIDATION • PROCESSING / FILE MAINTENANCE • OUTPUT • TRANSMISSION • DISTRIBUTION *

18. SYSTEM QUALITY PROBLEMS • SOFTWARE & DATA • BUGS:Program code defects or errors • MAINTENANCE:Modifying a system in production use; can take up to 50% of analysts’ time • DATA QUALITY PROBLEMS:Finding, correcting errors; costly; tedious *

19. COST OF ERRORS DURING SYSTEMS DEVELOPMENT CYCLE 6.00 5.00 4.00 3.00 COSTS 2.00 1.00 ANALYSIS PROGRAMMING POSTIMPLEMENTATION & DESIGN CONVERSION

20. CREATING A CONTROL ENVIRONMENT CONTROLS:METHODS, POLICIES, PROCEDURES TO PROTECT ASSETS; ACCURACY & RELIABILITY OF RECORDS; ADHERENCE TO MANAGEMENT STANDARDS • GENERAL • APPLICATION *

21. GENERAL CONTROLS • IMPLEMENTATION:Audit system development to assure proper control, management • SOFTWARE:Ensure security, reliability of software • PHYSICAL HARDWARE:Ensure physical security, performance of computer hardware *

22. GENERAL CONTROLS • COMPUTER OPERATIONS:Ensure procedures consistently, correctly applied to data storage, processing • DATA SECURITY:Ensure data disks, tapes protected from wrongful access, change, destruction • ADMINISTRATIVE:Ensure controls properly executed, enforced SEGREGATION OF FUNCTIONS: Divide responsibility from tasks *

23. APPLICATION CONTROLS • INPUT • PROCESSING • OUTPUT *

24. INPUT CONTROLS • INPUT AUTHORIZATION:Record, monitor source documents • DATA CONVERSION:Transcribe data properly from one form to another • BATCH CONTROL TOTALS:Count transactions prior to and after processing • EDIT CHECKS:Verify input data, correct errors *

25. PROCESSING CONTROLS ESTABLISH THAT DATA IS COMPLETE, ACCURATE DURING PROCESSING • RUN CONTROL TOTALS:Generate control totals before & after processing • COMPUTER MATCHING:Match input data to master files *

26. OUTPUT CONTROLS ESTABLISH THAT RESULTS ARE ACCURATE, COMPLETE, PROPERLY DISTRIBUTED • BALANCE INPUT, PROCESSING, OUTPUT TOTALS • REVIEW PROCESSING LOGS • ENSURE ONLY AUTHORIZED RECIPIENTS GET RESULTS *

27. SECURITY AND THE INTERNET • ENCRYPTION: Coding & scrambling messages to deny unauthorized access • AUTHENTICATION: Ability to identify another party • MESSAGE INTEGRITY • DIGITAL SIGNATURE • DIGITAL CERTIFICATE *

28. SECURITY AND THE INTERNET • SECURE ELECTRONIC TRANSACTION:Standard for securing credit card transactions on Internet • ELECTRONIC CASH:Currency represented in electronic form, preserving user anonymity *

29. DEVELOPING A CONTROL STRUCTURE • COSTS:Can be expensive to build; complicated to use • BENEFITS:Reduces expensive errors, loss of time, resources, good will RISK ASSESSMENT:Determine frequency of occurrence of problem, cost, damage if it were to occur *

30. MIS AUDIT IDENTIFIES CONTROLS OF INFORMATION SYSTEMS, ASSESSES THEIR EFFECTIVENESS • TESTING: Early, regular controlled efforts to detect, reduce errors • WALKTHROUGH • DEBUGGING • DATA QUALITY AUDIT: Survey samples of files for accuracy, completeness *

31. Connect to the INTERNET PRESS LEFT MOUSE BUTTON ON ICON TO CONNECT TO LAUDON & LAUDON WEB SITE FOR MORE INFORMATION IN THIS CHAPTER

32. 16. INFORMATION SYSTEMS SECURITY & CONTROL