1 / 28

Lecture IS3318

Lecture IS3318. 22/11/11. System Vulnerability and Abuse. Computer crime D efined as “any violations of criminal law that involve a knowledge of computer technology for their perpetration, investigation, or prosecution” Computer may be target of crime, e.g.:

loe
Télécharger la présentation

Lecture IS3318

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Lecture IS3318 22/11/11

  2. System Vulnerability and Abuse • Computer crime • Defined as “any violations of criminal law that involve a knowledge of computer technology for their perpetration, investigation, or prosecution” • Computer may be target of crime, e.g.: • Breaching confidentiality of protected computerized data • Accessing a computer system without authority • Computer may be instrument of crime, e.g.: • Theft of trade secrets • Using e-mail for threats or harassment

  3. System Vulnerability and Abuse • Identity theft: Theft of personal Information (social security id, driver’s license or credit card numbers) to impersonate someone else • Phishing: Setting up fake Web sites or sending e-mail messages that look like legitimate businesses to ask users for confidential personal data. • Evil twins: Wireless networks that pretend to offer trustworthy Wi-Fi connections to the Internet • Pharming: Redirects users to a bogus Web page, even when individual types correct Web page address into his or her browser

  4. System Vulnerability and Abuse • Click fraud • Individual or computer program clicks online ad without any intention of learning more or making a purchase • Global threats - Cyberterrorism and cyberwarfare • Concern that Internet vulnerabilities and other networks make digital networks easy targets for digital attacks by terrorists, foreign intelligence services, or other groups

  5. System Vulnerability and Abuse • Internal threats – Employees • Security threats often originate inside an organization • Inside knowledge • Sloppy security procedures • User lack of knowledge • Social engineering: • Tricking employees into revealing their passwords by pretending to be legitimate members of the company in need of information

  6. System Vulnerability and Abuse • Software vulnerability • Commercial software contains flaws that create security vulnerabilities • Hidden bugs (program code defects) • Zero defects cannot be achieved because complete testing is not possible with large programs • Flaws can open networks to intruders • Patches • Vendors release small pieces of software to repair flaws • However, amount of software in use can mean exploits created faster than patches be released and implemented

  7. Business Value of Security and Control • Lack of security, control can lead to • Loss of revenue • Failed computer systems can lead to significant or total loss of business function • Lowered market value: • Information assets can have tremendous value • A security breach may cut into firm’s market value almost immediately • Legal liability • Lowered employee productivity • Higher operational costs

  8. Business Value of Security and Control • Electronic evidence • Evidence for white collar crimes often found in digital form • Data stored on computer devices, e-mail, instant messages, e-commerce transactions • Proper control of data can save time, money when responding to legal discovery request • Computer forensics: • Scientific collection, examination, authentication, preservation, and analysis of data from computer storage media for use as evidence in court of law • Includes recovery of ambient and hidden data

  9. Establishing a Framework for Security and Control • Information systems controls • General controls • Govern design, security, and use of computer programs and data throughout organization’s IT infrastructure • Combination of hardware, software, and manual procedures to create overall control environment • Types of general controls • Software controls • Hardware controls • Computer operations controls • Data security controls • Implementation controls • Administrative controls

  10. Establishing a Framework for Security and Control • Application controls • Specific controls unique to each computerized application, such as payroll or order processing • Include both automated and manual procedures • Ensure that only authorized data are completely and accurately processed by that application • Types of application controls: • Input controls • Processing controls • Output controls

  11. Technologies and Tools for Security • Antivirus and antispyware software: • Checks computers for presence of malware and can often eliminate it as well • Require continual updating • Unified threat management (UTM) • Comprehensive security management products • Tools include • Firewalls • Intrusion detection • VPNs • Web content filtering • Antispam software

  12. Intro to Databases • File organization concepts • Computer system organizes data in a hierarchy • Field: Group of characters as word(s) or number • Record: Group of related fields • File: Group of records of same type • Database: Group of related files • Record: Describes an entity • Entity: Person, place, thing on which we store information • Attribute: Each characteristic, or quality, describing entity • E.g., Attributes Date or Grade belong to entity COURSE

  13. The Data Hierarchy A computer system organizes data in a hierarchy that starts with the bit, which represents either a 0 or a 1. Bits can be grouped to form a byte to represent one character, number, or symbol. Bytes can be grouped to form a field, and related fields can be grouped to form a record. Related records can be collected to form a file, and related files can be organized into a database. Figure 6-1

  14. Problems with the traditional file environment (files maintained separately by different departments) • Data redundancy and inconsistency • Data redundancy: Presence of duplicate data in multiple files • Data inconsistency: Same attribute has different values • Program-data dependence: • When changes in program requires changes to data accessed by program • Lack of flexibility • Poor security • Lack of data sharing and availability

  15. Database • Collection of data organized to serve many applications by centralizing data and controlling redundant data • Database management system • Interfaces between application programs and physical data files • Separates logical and physical views of data • Solves problems of traditional file environment • Controls redundancy • Eliminates inconsistency • Uncouples programs and data • Enables organization to central manage data and data security

  16. Human Resources Database with Multiple Views A single human resources database provides many different views of data, depending on the information requirements of the user. Illustrated here are two possible views, one of interest to a benefits specialist and one of interest to a member of the company’s payroll department. Figure 6-3

  17. Relational DBMS • Represent data as two-dimensional tables called relations or files • Each table contains data on entity and attributes • Table: grid of columns and rows • Rows (tuples): Records for different entities • Fields (columns): Represents attribute for entity • Key field: Field used to uniquely identify each record • Primary key: Field in table used for key fields • Foreign key: Primary key used in second table as look-up field to identify records from original table

  18. Relational Database Tables A relational database organizes data in the form of two-dimensional tables. Illustrated here are tables for the entities SUPPLIER and PART showing how they represent each entity and its attributes. Supplier_Number is a primary key for the SUPPLIER table and a foreign key for the PART table. Figure 6-4A

  19. Relational Database Tables (cont.) Figure 6-4B

  20. Capabilities of Database Management Systems • Data definition capability: Specifies structure of database content, used to create tables and define characteristics of fields • Data dictionary: Automated or manual file storing definitions of data elements and their characteristics • Data manipulation language: Used to add, change, delete, retrieve data from database • Structured Query Language (SQL) • Microsoft Access user tools for generation SQL • Many DBMS have report generation capabilities for creating polished reports (Crystal Reports)

  21. The Database Approach to Data Management Microsoft Access Data Dictionary Features Figure 6-6 Microsoft Access has a rudimentary data dictionary capability that displays information about the size, format, and other characteristics of each field in a database. Displayed here is the information maintained in the SUPPLIER table. The small key icon to the left of Supplier_Number indicates that it is a key field.

  22. Some Drawbacks… • Complexity • A DBMS is a complex piece of software all users must fully understand it to make use of its functionalities • Cost of DBMS • The cost varies significantly depending on the environment and the functionality provided. Must take into consideration recurrent annual maintenance costs

  23. Continued.. • Cost of Conversion • Cost of converting existing applications to run on the new DBMS and hardware. (additional training costs) • Performance • DBMS is written for applications in general which means that some applications may run slower than before • Higher Impact of Failure • Centralization of resources increases vulnerability of the system

  24. Database Administrator • Oversees a staff of database specialists • Final recommendations for DB design • Load and maintain DB • Establish security controls • Perform backup and recovery

  25. Data Administration Data Administrator Database technology And management Database Management System Data planning and modelling technology Users

  26. Systems Analyst • Or business analyst is a systems analyst that specializes in business problem analysis and technology-independent requirements analysis. • A programmer/analyst (or analyst/programmer) includes the responsibilities of both the computer programmer and the systems analyst. • Other synonyms for systems analyst include: • Systems consultant • Systems architect • Systems engineer • Information engineer • Systems integrator

  27. Variations on the Systems Analysts Title • Other synonyms for systems analyst include: • Systems consultant • Systems architect • Systems engineer • Information engineer • Systems integrator

  28. Where Systems Analysts Work • In traditional businesses • Working in traditional information services organizations(permanent project teams) • Working in contemporary information services organizations(dynamic project teams) • In outsourcing businesses • Contracted to traditional businesses • In consulting businesses • Contracted to traditional businesses • In application software businesses • Building software products for traditional businesses

More Related