1 / 21

Chapter

8. Chapter. Securing Information Systems. Management Information Systems Chapter 8 Securing Information Systems. LEARNING OBJECTIVES. Analyze why information systems need special protection from destruction, error, and abuse. Assess the business value of security and control.

oakley
Télécharger la présentation

Chapter

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. 8 Chapter Securing Information Systems

  2. Management Information Systems Chapter 8 Securing Information Systems LEARNING OBJECTIVES • Analyze why information systems need special protection from destruction, error, and abuse. • Assess the business value of security and control. • Design an organizational framework for security and control. • Evaluate the most important tools and technologies for safeguarding information resources.

  3. Problem:Large number of vulnerable users of online financial services, ease of creating bogus Web sites. Solutions: Deploy anti-phishing software and services and a multilevel authentication system to identify threats and reduce phishing attempts. Deploying new tools, technologies, and security procedures, along with educating consumers, increases reliability and customer confidence. Demonstrates IT’s role in combating cyber crime. Illustrates digital technology as part of a multilevel solution as well as its limitations in overcoming discouraged consumers. Management Information Systems Chapter 8 Securing Information Systems Phishing: A Costly New Sport for Internet Users

  4. Figure 8-1 Management Information Systems Chapter 8 Securing Information Systems SYSTEM VULNERABILITY AND ABUSE Why Systems Are Vulnerable Contemporary Security Challenges and Vulnerabilities

  5. Management Information Systems Chapter 8 Securing Information Systems SYSTEM VULNERABILITY AND ABUSE Why Systems Are Vulnerable (Continued) Internet Vulnerabilities: • Use of fixed Internet addresses through use of cable modems or DSL • Lack of encryption with most Voice over IP (VoIP) • Widespread use of e-mail and instant messaging (IM)

  6. Management Information Systems Chapter 8 Securing Information Systems SYSTEM VULNERABILITY AND ABUSE Wireless Security Challenges: • Radio frequency bands are easy to scan • The service set identifiers (SSID)identifying the access points broadcast multiple times

  7. Management Information Systems Chapter 8 Securing Information Systems SYSTEM VULNERABILITY AND ABUSE Malicious Software: Viruses, Worms, and Spyware Hackers and Cybervandalism • Computer viruses, worms, • Spyware • Identity theft, phishing, pharming • Cyberterrorism and Cyberwarfare • Vulnerabilities from internal threats (employees); software flaws

  8. Management Information Systems Chapter 8 Securing Information Systems BUSINESS VALUE OF SECURITY AND CONTROL • Inadequate security and control may create serious legal liability. • Businesses must protect not only their own information assets but also those of customers, employees, and business partners. Failure to do so can lead to costly litigation for data exposure or theft. • A sound security and control framework that protects business information assets can thus produce a high return on investment.

  9. Management Information Systems Chapter 8 Securing Information Systems ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Types of Information Systems Controls • General controls: • Software and hardware • Computer operations • Data security • Systems implementation process

  10. Management Information Systems Chapter 8 Securing Information Systems ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Application controls: • Input • Processing • Output

  11. Figure 8-4 Management Information Systems Chapter 10 Security and Control ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Security Profiles for a Personnel System

  12. Management Information Systems Chapter 8 Securing Information Systems ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Ensuring Business Continuity • Disaster recovery planning:Plans for restoration of computing and communications disrupted by an event such as an earthquake, flood, or terrorist attack • Business continuity planning: Plans for handling mission-critical functions if systems go down

  13. Management Information Systems Chapter 8 Securing Information Systems TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Access Control Access control: Consists of all the policies and procedures a company uses to prevent improper access to systems by unauthorized insiders and outsiders Authentication: • Passwords • Biometric authentication

  14. Management Information Systems Chapter 8 Securing Information Systems TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Firewalls, Intrusion Detection Systems, and Antivirus Software • Firewalls: Hardware and software controlling flow of incoming and outgoing network traffic • Intrusion detection systems: Full-time monitoring tools placed at the most vulnerable points of corporate networks to detect and deter intruders

  15. Management Information Systems Chapter 8 Securing Information Systems TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Firewalls, Intrusion Detection Systems, and Antivirus Software (Continued) • Antivirus software: Software that checks computer systems and drives for the presence of computer viruses and can eliminate the virus from the infected area

  16. Figure 8-6 Management Information Systems Chapter 10 Security and ContrChapter 8 Securing Information Systems ol TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL A Corporate Firewall

  17. Management Information Systems Chapter 8 Securing Information Systems TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Encryption and Public Key Infrastructure • Public key encryption: Uses two different keys, one private and one public. The keys are mathematically related so that data encrypted with one key can be decrypted using only the other key • Message integrity: The ability to be certain that the message being sent arrives at the proper destination without being copied or changed

  18. Management Information Systems Chapter 8 Securing Information Systems TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Encryption and Public Key Infrastructure (Continued) • Digital signature: A digital code attached to an electronically transmitted message that is used to verify the origin and contents of a message

  19. Management Information Systems Chapter 8 Securing Information Systems TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Encryption and Public Key Infrastructure (Continued) • Secure Sockets Layer (SSL)and its successor Transport Layer Security (TLS): protocols for secure information transfer over the Internet; enable client and server computer encryption and decryption activities as they communicate during a secure Web session. • Secure Hypertext Transfer Protocol (S-HTTP): used for encrypting data flowing over the Internet; limited to Web documents, whereas SSL and TLS encrypt all data being passed between client and server.

  20. Figure 8-7 Management Information Systems Chapter 8 Securing Information Systems TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Public Key Encryption

  21. Management Information Systems Chapter 8 Securing Information Systems Systems Vulnerability and Abuse Worldwide Damage from Digital Attacks This chart shows estimates of the average annual worldwide damage from hacking, malware, and spam since 1999. These data are based on figures from mi2G and the authors. Figure 8-3

More Related