Security

1. Security

2. Standard Example If I get 7.5% interest on $5,349.44, how much do I get in a month? (.075/12) = .00625 * 5,349.44 = $33.434 What happens to the .004? .004+.004+.004=.012 .004 * 1,000,000 customers * 12 months = $48,000!!!!! Nice income supplement.

3. Computer Crime • Computer crime losses estimated between $15-$300 Billion annually. • “The playground bullies are learning how to type” -- Forbes Magazine.

4. BUT, crime is not the only security area! • Three main concerns: • evil (crime) • system limitations • Carelessness / Stupidity

5. The First Line of Defense - People • Organizations must enable employees, customers, and partners to access information electronically • The biggest issue surrounding information security is not a technical issue, but a people issue • 33% of security incidents originate within the organization • Insiders – legitimate users who purposely or accidentally misuse their access to the environment and cause some kind of business-affecting incident

6. The First Line of Defense - People • The first line of defense an organization should follow to help combat insider issues is to develop information security policies and an information security plan • Information security policies – identify the rules required to maintain information security • Information security plan – details how an organization will implement the information security policies

7. The First Line of Defense - People • Five steps to creating an information security plan: • Develop the information security policies • Communicate the information security policies • Identify critical information assets and risks • Firewall – hardware and/or software that guards a private network by analyzing the information leaving and entering the network • Intrusion detection software (IDS) – searches out patterns in network traffic to indicate attacks and quickly respond to prevent harm • Test and reevaluate risks • Obtain stakeholder support

8. The First Line of Defense - People • Hackers frequently use “social engineering” to obtain password • Social engineering – using one’s social skills to trick people into revealing access credentials or other information valuable to the attacker

9. The Second Line of Defense - Technology • Three primary information security areas: • Authentication and authorization • Prevention and resistance • Detection and response

10. AUTHENTICATION AND AUTHORIZATION • Authentication – a method for confirming users’ identities • The most secure type of authentication involves a combination of the following: • Something the user knows such as a user ID and password • Something the user has such as a smart card or token • Something that is part of the user such as a fingerprint or voice signature

11. Something the User Knows such as a User ID and Password • This is the most common way to identify individual users and typically contains a user ID and a password • This is also the most ineffective form of authentication • Over 50 percent of help-desk calls are password related

12. Something the User Has such as a Smart Card or Token • Smart cards and tokens are more effective than a user ID and a password • Tokens – small electronic devices that change user passwords automatically • Smart card – a device that is around the same size as a credit card, containing embedded technologies that can store information and small amounts of software to perform some limited processing

13. Something That Is Part of the User such as a Fingerprint or Voice Signature • This is by far the best and most effective way to manage authentication • Biometrics – the identification of a user based on a physical characteristic, such as a fingerprint, iris, face, voice, or handwriting • Unfortunately, this method can be costly and intrusive

14. PREVENTION AND RESISTANCE • Downtime can cost an organization anywhere from $100 to $1 million per hour • Technologies available to help prevent and build resistance to attacks include: • Content filtering • Encryption • Firewalls

15. Content Filtering • Organizations can use content filtering technologies to filter e-mail and prevent e-mails containing sensitive information from transmitting and stop spam and viruses from spreading. • Content filtering – occurs when organizations use software that filters content to prevent the transmission of unauthorized information • Spam – a form of unsolicited e-mail

16. ENCRYPTION • If there is an information security breach and the information was encrypted, the person stealing the information would be unable to read it • Encryption – scrambles information into an alternative form that requires a key or password to decrypt the information

17. SCRAMBLED MESSAGE RECIPIENT SENDER Encrypt with public key Decrypt with private key SECURITY AND THE INTERNET PUBLIC KEY ENCRYPTION

18. FIREWALLS • One of the most common defenses for preventing a security breach is a firewall • Firewall – hardware and/or software that guards a private network by analyzing the information leaving and entering the network

19. FIREWALLS • Sample firewall architecture connecting systems located in Chicago, New York, and Boston

20. DETECTION AND RESPONSE • If prevention and resistance strategies fail and there is a security breach, an organization can use detection and response technologies to mitigate the damage • Antivirus software is the most common type of detection and response technology

21. DETECTION AND RESPONSE • Some of the most damaging forms of security threats to e-business sites include: • Maliciouscode – includes a variety of threats such as viruses, worms, and Trojan horses • Hoaxes – attack computer systems by transmitting a virus hoax, with a real virus attached • Spoofing – the forging of the return address on an e-mail so that the e-mail message appears to come from someone other than the actual sender • Sniffer – a program or device that can monitor data traveling over a network

22. Providing Security - Procedural • Keep an electronic audit trail • Separate duties. • Never allow too much power to one individual. In ES, don’t allow the expert to update the knowledge base. • Continually asses threats, risks, exposures, and vulnerabilities. • Have standard procedures and documentation. • Strict authorization requirements.

23. Providing Security - Procedural • Outside audits. • “Security is everybody’s business” -- give awards, etc. • Have a disaster recovery plan. Lacked by 60% of all businesses! • Use intelligent systems capability of firm to flag problems.

24. Providing Security - Physical • All hard drives will eventually crash. This fact should be your first to consider. Everything else doesn’t count if you’ve forgotten this. • Secure systems physically. • Separate systems physically. • Have off site storage. • Backups -files more than programs. • Fault tolerance - UPS. • Don’t let your corporate knowledge get lost. This is WAY more important for DSS than TPS… should figure 2:1 on physical security procedures.