1 / 39

MANAGEMENT 2013

MANAGEMENT 2013. Misbahuddin Azzuhri SE. MM. CPHR.  2194449  081 233 72 8899  misbah@ub.ac.id  dinoazzuhri@yahoo.co.id. Department of Management FEB UB D Building 1st Floor, Jalan Mayjen Haryono 165 B Malang 65145 Phone : +62-341 558224, Fax : +62-341 558224

ban
Download Presentation

MANAGEMENT 2013

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. MANAGEMENT2013 Misbahuddin Azzuhri SE. MM. CPHR. 2194449 081 233 72 8899 misbah@ub.ac.id  dinoazzuhri@yahoo.co.id Department of Management FEB UB D Building 1st Floor, Jalan Mayjen Haryono 165 B Malang 65145 Phone : +62-341 558224, Fax : +62-341 558224 E-mail: info@feb.ub.ac.id www.feb.ub.ac.id

  2. MIS | SECURING INFORMATION SYSTEM Misbahuddin Azzuhri SE. MM. CPHR. Department of Management FEB | UB New Face | New Hope | New Inspiration

  3. Management Information Systems Securing Information System OBJECTIVES • Explain why information systems need special protection from destruction, error, and abuse • Assess the business value of security and control • Evaluate elements of an organizational and managerial framework for security and control Department of Management FEB | UB

  4. Management Information Systems Securing Information System OBJECTIVES (Continued) • Evaluate the most important tools and technologies for safeguarding information resources • Identify the challenges posed by information systems security and control and management solutions Department of Management FEB | UB

  5. Challenge: provide network and infrastructure security to a financial services firm in a Web-enabled high-threat environment Solutions: outsource to a well-known security firm the task of providing 24 x 7 network and infrastructure monitoring and reporting Real-time security monitoring 24 x 7, best practices, online security portal, data mining of network transactions Illustrates the role of system and network security in providing customers with service and managing corporate risk in online environments Management Information Systems Securing Information System Wesfarmers Limited Case Department of Management FEB | UB

  6. Figure 10-1 Management Information Systems Securing Information System SYSTEM VULNERABILITY AND ABUSE Why Systems Are Vulnerable Contemporary Security Challenges and Vulnerabilities Department of Management FEB | UB

  7. Management Information Systems Securing Information System SYSTEM VULNERABILITY AND ABUSE Why Systems Are Vulnerable (Continued) Internet Vulnerabilities: • Use of fixed Internet addresses through use of cable modems or DSL • Lack of encryption with most Voice over IP (VoIP) • Widespread use of e-mail and instant messaging (IM) Department of Management FEB | UB

  8. Management Information Systems Securing Information System SYSTEM VULNERABILITY AND ABUSE Wireless Security Challenges: • Radio frequency bands are easy to scan • The service set identifiers (SSID)identifying the access points broadcast multiple times Department of Management FEB | UB

  9. Figure 10-2 Management Information Systems Securing Information System SYSTEM VULNERABILITY AND ABUSE Wi-Fi Security Challenges Department of Management FEB | UB

  10. Management Information Systems Securing Information System SYSTEM VULNERABILITY AND ABUSE Malicious Software: Viruses, Worms, Trojan Horses, and Spyware Hackers and Cybervandalism • Computer viruses, worms, trojan horses • Spyware • Spoofing and Sniffers • Denial of Service (DoS) Attacks • Identity theft • Cyberterrorism and Cyberwarfare • Vulnerabilities from internal threats (employees); software flaws Department of Management FEB | UB

  11. Figure 10-3 Management Information Systems Securing Information System SYSTEM VULNERABILITY AND ABUSE Worldwide Damage from Digital Attacks Department of Management FEB | UB

  12. Management Information Systems Securing Information System BUSINESS VALUE OF SECURITY AND CONTROL • Inadequate security and control may create serious legal liability. • Businesses must protect not only their own information assets but also those of customers, employees, and business partners. Failure to do so can lead to costly litigation for data exposure or theft. • A sound security and control framework that protects business information assets can thus produce a high return on investment. Department of Management FEB | UB

  13. Figure 10-4 Management Information Systems Securing Information System BUSINESS VALUE OF SECURITY AND CONTROL Security Incidents Continue to Rise Source: CERT Coordination Center, www.cert.org, accessed July 6, 2004.

  14. Management Information Systems Securing Information System BUSINESS VALUE OF SECURITY AND CONTROL Legal and Regulatory Requirements for Electronic Records Management • Electronic Records Management (ERM): Policies, procedures and tools for managing the retention, destruction, and storage of electronic records Department of Management FEB | UB

  15. Management Information Systems Securing Information System BUSINESS VALUE OF SECURITY AND CONTROL Data Security and Control Laws: • The Health Insurance Portability and Accountability Act (HIPAA) • Gramm-Leach-Bliley Act • Sarbanes-Oxley Act of 2002 Department of Management FEB | UB

  16. Management Information Systems Securing Information System BUSINESS VALUE OF SECURITY AND CONTROL Electronic Evidence and Computer Forensics • Electronic Evidence: Computer data stored on disks and drives, e-mail, instant messages, and e-commerce transactions • Computer Forensics: Scientific collection, examination, authentication, preservation, and analysis of computer data for use as evidence in a court of law Department of Management FEB | UB

  17. Management Information Systems Securing Information System ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Types of Information Systems Controls • General controls: • Software and hardware • Computer operations • Data security • Systems implementation process Department of Management FEB | UB

  18. Management Information Systems Securing Information System ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Application controls: • Input • Processing • Output Department of Management FEB | UB

  19. Management Information Systems Securing Information System ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Risk Assessment: • Determines the level of risk to the firm if a specific activity or process is not properly controlled Department of Management FEB | UB

  20. Management Information Systems Securing Information System ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Security Policy: Policy ranking information risks, identifying acceptable security goals, and identifying the mechanisms for achieving these goals • Acceptable Use Policy (AUP) • Authorization policies Department of Management FEB | UB

  21. Figure 10-5 Management Information Systems Securing Information System ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Security Profiles for a Personnel System

  22. Management Information Systems Securing Information System ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Ensuring Business Continuity • Downtime: Period of time in which a system is not operational • Fault-tolerant computer systems:Redundant hardware, software, and power supply components to provide continuous, uninterrupted service • High-availability computing: Designing to maximize application and system availability Department of Management FEB | UB

  23. Management Information Systems Securing Information System ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Ensuring Business Continuity (Continued) • Load balancing:Distributes access requests across multiple servers • Mirroring:Backup server that duplicates processes on primary server • Recovery-oriented computing: Designing computing systems to recover more rapidly from mishaps Department of Management FEB | UB

  24. Management Information Systems Securing Information System ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Ensuring Business Continuity (Continued) • Disaster recovery planning:Plans for restoration of computing and communications disrupted by an event such as an earthquake, flood, or terrorist attack • Business continuity planning: Plans for handling mission-critical functions if systems go down Department of Management FEB | UB

  25. Management Information Systems Securing Information System ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Auditing: • MIS audit: Identifies all of the controls that govern individual information systems and assesses their effectiveness • Security audits: Review technologies, procedures, documentation, training, and personnel Department of Management FEB | UB

  26. Figure 10-6 Management Information Systems Securing Information System ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Sample Auditor’s List of Control Weaknesses Department of Management FEB | UB

  27. Management Information Systems Securing Information System TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Access Control Access control: Consists of all the policies and procedures a company uses to prevent improper access to systems by unauthorized insiders and outsiders Authentication: • Passwords • Tokens, smart cards • Biometric authentication Department of Management FEB | UB

  28. Management Information Systems Securing Information System TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Firewalls, Intrusion Detection Systems, and Antivirus Software • Firewalls: Hardware and software controlling flow of incoming and outgoing network traffic • Intrusion detection systems: Full-time monitoring tools placed at the most vulnerable points of corporate networks to detect and deter intruders Department of Management FEB | UB

  29. Management Information Systems Securing Information System TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Firewalls, Intrusion Detection Systems, and Antivirus Software (Continued) • Antivirus software: Software that checks computer systems and drives for the presence of computer viruses and can eliminate the virus from the infected area • Wi-Fi Protected Access specification Department of Management FEB | UB

  30. Figure 10-7 Management Information Systems Securing Information System TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL A Corporate Firewall Department of Management FEB | UB

  31. Management Information Systems Securing Information System TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Encryption and Public Key Infrastructure • Public key encryption: Uses two different keys, one private and one public. The keys are mathematically related so that data encrypted with one key can be decrypted using only the other key • Message integrity: The ability to be certain that the message being sent arrives at the proper destination without being copied or changed Department of Management FEB | UB

  32. Management Information Systems Securing Information System TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Encryption and Public Key Infrastructure (Continued) • Digital signature: A digital code attached to an electronically transmitted message that is used to verify the origin and contents of a message • Digital certificates: Data files used to establish the identity of users and electronic assets for protection of online transactions • Public Key Infrastructure (PKI): Use of public key cryptography working with a certificate authority

  33. Management Information Systems Securing Information System TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Encryption and Public Key Infrastructure (Continued) • Secure Sockets Layer (SSL)and its successor Transport Layer Security (TLS): protocols for secure information transfer over the Internet; enable client and server computer encryption and decryption activities as they communicate during a secure Web session. • Secure Hypertext Transfer Protocol (S-HTTP): used for encrypting data flowing over the Internet; limited to Web documents, whereas SSL and TLS encrypt all data being passed between client and server. Department of Management FEB | UB

  34. Figure 10-8 Management Information Systems Securing Information System TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Public Key Encryption Department of Management FEB | UB

  35. Figure 10-9 Management Information Systems Securing Information System TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Digital Certificates

  36. Management Information Systems Securing Information System MANAGEMENT OPPORTUNITIES, CHALLENGES AND SOLUTIONS Management Opportunities: Creation of secure, reliable Web sites and systems that can support e-commerce and e-business strategies Department of Management FEB | UB

  37. Management Information Systems Securing Information System MANAGEMENT OPPORTUNITIES, CHALLENGES AND SOLUTIONS Management Challenges: • Designing systems that are neither overcontrolled nor undercontrolled • Implementing an effective security policy Department of Management FEB | UB

  38. Management Information Systems Securing Information System MANAGEMENT OPPORTUNITIES, CHALLENGES AND SOLUTIONS Solution Guidelines: • Security and control must become a more visible and explicit priority and area of information systems investment. • Support and commitment from top management is required to show that security is indeed a corporate priority and vital to all aspects of the business. • Security and control should be the responsibility of everyone in the organization.

  39. NEXT | ENHANCING DECISION MAKING Misbahuddin Azzuhri SE. MM. CPHR. Department of Management FEB | UB New Face | New Hope | New Inspiration

More Related