Information Systems Security

1. Information Systems Security Chapter 5

2. Describe general approaches to analyzing vulnerabilities and threats in information systems. Learning Objective 1

3. Overview The information security system is the subsystem of the organization that controls the special risks associated with computer-based information systems. The information security system has the basic elements of any information system, such as hardware, databases, procedures, and reports.

4. Life-cycle Phase Objective Systems analysis Analyze system vulnerabilities in terms of relevant threats and their associated loss exposure. Systems design Design security measures and contingency plans to control the identified loss exposures. The Information SecuritySystem Life Cycle

5. Systems operation, evaluation, and control Operate the system and assess its effectiveness and efficiency. Make changes as circumstances require. The Information SecuritySystem Life Cycle Life-cycle Phase Objective Systems implementation Implement the security measures as designed.

6. The Information SecuritySystem in the Organization The information security system must be managed by a chief security officer (CSO). This individual should report directly to the board of directors in order to maintain complete independence.

7. Analyzing Vulnerabilitiesand Threats Different Approaches: Quantitative approach to risk assessment Qualitative approach

8. Analyzing Vulnerabilitiesand Threats Quantitative Approach: Cost of an individual loss  Likelihood of its occurrence

9. Analyzing Vulnerabilitiesand Threats Difficulties With This Approach: Identifying the relevant costs per loss and the associated likelihoods can be difficult. Estimating the likelihood of a given failure requires predicting the future, which is very difficult.

10. Analyzing Vulnerabilitiesand Threats Qualitative Approach: The system’s vulnerabilities and threats are subjectively ranked in order of their contribution to the company’s total loss exposure.

11. Analyzing Vulnerabilitiesand Threats Loss Exposure Areas: • business interruption • loss of software • loss of data • loss of hardware • loss of facilities • loss of service and personnel

12. Identify active and passive threats to information systems. Learning Objective 2

13. Vulnerabilities and Threats What is a vulnerability? A vulnerability is a weakness in a system. What is a threat? A threat is a potential exploitation of a vulnerability.

14. Vulnerabilities and Threats Categories of Threats: Active threats Passive threats

15. Individuals Posing a Threatto the Information System Groups of individuals that could be involved in an information system’s attack: Information systems personnel Users Intruders

16. Individuals Posing a Threatto the Information System Information Systems Personnel: • computer maintenance persons • programmers • network operators • information systems administrative personnel • data control clerks

17. Individuals Posing a Threatto the Information System Users are composed of heterogeneous groups of people. Their functional area does not lie in data processing. An intruder is anyone who accesses equipment, electronic data, or files without proper authorization. Who are hackers?

18. Individuals Posing a Threatto the Information System A hacker is an intruder who attacks a system for fun and challenge. What are other types of intruders? • unnoticed intruders • wiretappers • piggybackers • impersonating intruders • eavesdroppers

19. Active Threats toInformation Systems Input manipulation Sabotage Program alteration Misappropriation or theft of information resources Direct file alteration Data theft

20. Active Threats toInformation Systems In most cases of computer fraud, manipulation of input is the method used. Program alteration is perhaps the least common method used to commit computer fraud.

21. Active Threats toInformation Systems A direct file alteration occurs when individuals find ways to bypass the normal process for inputting data into computer programs. Data theft is a serious problem in business today. What are some methods of computer sabotage?

22. Active Threats toInformation Systems Logic bomb Trojan horse Virus program Denial of service attack Defacing the company’s Web site

23. Active Threats toInformation Systems What is aworm? It is a type of virus that spreads itself over a computer network.

24. Active Threats toInformation Systems One type of misappropriation of computer resources exists when employees use company computers resources for their own business.

25. Identify key aspects of an information security system. Learning Objective 3

26. The Information SystemSecurity System Security measures focus on preventing and detecting threats. Contingency plans focus on correcting the effects of threats.

27. Management philosophy and operating style 1 2 Organization structure Board of directors and its committees 3 The Control Environment

28. 5 Internal audit function 6 Personnel policies and practices 7 External influences The Control Environment 4 Management control activities

29. Controls for Active Threats Layered Approach to Access Control: Site-access controls System-access controls File-access controls

30. Controls for Active Threats Site-Access Controls: The objective of site-access controls is to physically separate unauthorized individuals from computer resources.

31. Telephone TV monitor Locked door Locked door (opened from inside vault) LOBBY Service window Locked door (entrance) Intercom to vault Data archive Magnet detector INNER VAULT Scanner Controls for Active Threats

32. Controls for Active Threats System-Access Controls: These controls authenticate users by using such means as user IDs, passwords, IP addresses, and hardware devices. It is often desirable to withhold “administrative rights” from individual PC users.

33. Controls for Active Threats File-Access Controls: The most fundamental file-access control is the establishment of authorization guidelines and procedures for accessing and altering files.

34. Controls for Passive Threats Preventative: Fault-tolerant systems use redundant components. If one part of the system fails, a redundant part immediately takes over, and the system continues operating with little or no interruption.

35. Controls for Passive Threats Corrective: File Backups Full backups Incremental backups Differential backups

36. Internet Security Internet-related vulnerabilities may arise from weaknesses in five areas. • the operating system or its configuration • the Web server or its configuration • the private network and its configuration • various server programs • general security procedures

37. Discuss contingency planning and other disaster risk management practices. Learning Objective 4

38. Prevention planning Contingency planning Disaster Risk Management Disaster risk management is essential to ensure continuity of operations in the event of a catastrophe.

39. Disaster Risk Management Frequencies of Disaster Causes: Natural disaster 30% Deliberate actions 45% Human error 25% A large percentage of disasters can be mitigated or avoided.

40. Disaster Risk Management A disaster recovery plan must be implemented at the highest levels in the company. The first step in developing a disaster recovery plan should be obtaining the support of senior management and setting up a planning committee.

41. Disaster Risk Management The design of the plan should include three major components. What are these components? • Assess the company’s critical needs. • List priorities for recovery. • Establish recovery strategies and procedures.

42. Disaster Risk Management A complete set of recovery strategies should take into account the following: • emergency response center • escalation procedures • alternate processing arrangements • personnel relocation and replacements plans • salvage plan • plan for testing and maintaining the system

43. End of Chapter 5