Higher Information Systems

1. Security Strategy Higher Information Systems

2. Security Strategy You will need to be able to explain: • Data Security • Data Integrity and • Data Privacy • Risks • Hacking • Denial of Service DOS • Policies & Procedures • Password Guidelines • Virus Protection • Prevention • Detection • Repair • Firewall • Encryption • Access Rights

3. Security Strategy Data Security Physical Loss – fire or flood Electronic problems – faulty hardware or magnetic influences. Theft – by a competitor. Malicious access, deletion or virus attack.

4. Security Strategy Data Integrity Is the data correct? When it is entered double entry can be used. Call centres ask customer to spell names and details are read back. Transmission errors can cause data errors. Viruses, hardware breakdown, viruses or computer crime can cause problems.

5. Security Strategy Data Privacy This is personal or sensitive data. Is the data safe from unauthorised people? In school we have passwords and user logons so that no one else can access your files. People within school have different levels of access, this means data can be kept more secure. E.g. Guidance have access to personal information but teachers do not.

6. Security Strategy Summary The network manager keeps the data secure. (Fire, flood, electronic outages). Integrity is how correct data is when it is first entered. Privacy is not letting other users into your personal or sensitive data.

7. Security Strategy The Risks Virus – malicious code. Designed to spread to other computers automatically. Transmitted via an e-mail attachment, downloaded or something else. Can lie dormant for some time and can be very harmful.

8. Security Strategy The Risks Hacking – Breaking into a computer system from outside the network. Breaking in is an offence but not a bad as maliciously altering or stealing information.

9. Security Strategy The Risks Denial of Service Attack (DOS Attack)– Flooding a server with surprisingly large amounts of requests for information. The server is overloaded and it ends up crashing.

10. Security Strategy Policies and Procedures Code of Conduct – set of rules that users must follow. Employees have to sign a code of conduct. Usually common sense and for the employee's protection to stop them breaking the law. The British Computer Society has a Code of Ethics which includes professional conduct, professional integrity, public interest, fidelity (trustworthiness), technical competence.

11. Security Strategy • Password Guidelines • A strong password is one that no one else can guess and would be made up entirely of random numbers and letters (lowercase and uppercase). • Users tend to choose poor passwords. The rules are: • Minimum of 8 characters • Letters and numbers and symbols • No words • Not the same as a previous password • Cannot be easily guessed http://www.passwordmeter.com/

13. Security Strategy Virus protection Computer systems are susceptible to viruses and must be protected by: Not allowing floppy disks. Not open suspicious emails and use filtering software to intercept the virus. Install anti-virussoftware that can Prevent, detect, or repair the infected file. Stops key loggers.

14. Security Strategy Firewall A firewall was originally constructed to stop fire spreading throughout a house. It could be constructed between the house and the garage. Note: it is anti-virus software that stops viruses! This metaphor has been borrowed by the computing industry to name the software/hardware that acts as a barrier between computers on a network. Without it intruders could destroy, tamper with or gain access the files on your computer.

15. Extra notes: http://www.vicomsoft.com/knowledge/reference/firewalls1.html#2 Security Strategy Firewall A firewall can be hardware or software that has filters to constantly monitor for unauthorised access to an network. It is placed between a file server and the internet connection. It also: Checks and filters externalmessages Blocks access to certain workstations/servers from an external computer. Only grants access to authorised users.

16. Security Strategy Encryption Encryption techniques are used to pass sensitive data across the internet. The most obvious place you will see this is if you use your credit card to buy goods on the internet. If the packets of data are intercepted they cannot be read because they have been scrambled using 32 bit or 64 bit encryption. The message can only be read by the person receiving it, who holds the correct key to decipher it.

17. Security Strategy Encryption In an exam you may be asked to explain how encryption works. This is public and private key encryption. • Bob encrypts the message with Alice’s Public Key. • The encrypted message is sent and cannot be read by unauthorised users. • Alice decrypts the message with her private key, no one else knows what this key is.

18. Security Strategy Access Rights Access rights are: Read Write Create Erase Modify These right can be granted or revoked by the owner of the files or by the administrator. If a file is read only you cannot write, erase or modify it in any way. You would normally give these access rights in groupings e.g. read, write, create, modify.

19. Security Strategy • Access Rights • Access rights can specifically set for the following: • Whether you have administrator rights • The amount of disk space allocated • Printers (printer credits) • E-mail • Internet • Folders • Applications

20. Security Strategy • You have learned about: • Data Security • Data Integrity and • Data Privacy • Risks • Hacking • Denial of Service DOS • Policies & Procedures • Password Guidelines • Virus Protection • Prevention • Detection • Repair • Firewall • Encryption • Access Rights

21. Question • 2008 Q17 • Lachlan is preparing for an interview for the job of network security manager at First Place Ltd. The company has 4 warehouses supplying 40 branches throughout the country. As stock control system is used to manage daily supplies to each branch. As part of the interview he will be asked about a security strategy for the company’s organisational information system. • State five areas concerning security strategies that Lachlan should be prepared to discuss in his interview. (5)

22. Question 2009 Section 2 Q17. Setting up a username and password is one task involved in the creation of a network account. Statethreeother settings associated with a network account. 3 2011 Q18 A company holds confidential personal data about its customers (a) Explain the difference between security and privacy as applied to data held in a computerised information system 2 (b) (i) Evaluate the suitability of these passwords: scotland tom100695 Hs%2 3 (ii) Apart from passwords, describe two data security measures that should be introduced as part of the security strategy. 4