Week 11 SECURITY AND CONTROL

Chapter 11
Security and Control
10.1 © 2006 by Prentice Hall

Management Information Systems
Chapter 10 Security and Control
OBJECTIVES
• Explain why information systems need special

protection from destruction, error, and abuse
• Assess the business value of security and

control
• Evaluate elements of an organizational and

managerial framework for security and control

OBJECTIVES (Continued)
• Evaluate the most important tools and

technologies for safeguarding information
resources
• Identify the challenges posed by information

systems security and control and management
solutions

Wesfarmers Limited Case
• Challenge: provide network and infrastructure

security to a financial services firm in a Web-enabled
high-threat environment
• Solutions: outsource to a well-known security firm
the task of providing 24 x 7 network and
infrastructure monitoring and reporting
• Real-time security monitoring 24 x 7, best practices,
online security portal, data mining of network
transactions
• Illustrates the role of system and network security in
providing customers with service and managing
corporate risk in online environments
SYSTEM VULNERABILITY AND ABUSE
Why Systems Are Vulnerable
Contemporary Security Challenges and Vulnerabilities
10.5 Figure 10-1 © 2006 by Prentice Hall

Why Systems Are Vulnerable (Continued)

Internet Vulnerabilities:
• Use of fixed Internet addresses through use of

cable modems or DSL
• Lack of encryption with most Voice over IP (VoIP)
• Widespread use of e-mail and instant messaging

(IM)

•
Treats to IS Security
Computer security threats are relentlessly inventive. Masters of disguise and manipulation, these threats
constantly evolve to find new ways to annoy, steal and harm. Arm yourself with information and
resources to safeguard against complex and growing computer security threats and stay safe online.
• ComputerVirusThreats
• Perhaps the most well known computer security threat, a computer virus is a program written to alter the
way a computer operates, without the permission or knowledge of the user. A virus replicates and
executes itself, usually doing damage to your computer in the process. Learn how to combat computer
virus threats and stay safe online.
• SpywareThreats
• A serious computer security threat, spyware is any program that monitors your online activities or installs
programs without your consent for profit or to capture personal information. We’ve amassed a wealth of
knowledge that will help you combat spyware threats and stay safe online.
• Hackers&Predators
• People, not computers, create computer security threats and malware. Hackers and predators are
programmers who victimize others for their own gain by breaking into computer systems to steal, change
or destroy information as a form of cyber-terrorism. What scams are they using lately? Learn how to
combat dangerous malware and stay safe online.
• PhishingThreats
• Masquerading as a trustworthy person or business, phishers attempt to steal sensitive financial or
personal information through fraudulent email or instant messages. How can you tell the difference
between a legitimate message and a phishing scam? Educate yourself on the latest tricks and scams.

Threats can be classified
Types of threats:
–
–
–
according to their type and
Physical damage: fire, water, pollution
Natural events: climatic, seismic, volcanic
Loss of essential services: electrical power, air conditioning, telecommunication
origin
– Compromise of information: eavesdropping, theft of media, retrieval of discarded materials
– Technical failures: equipment, software, capacity saturation,
– Compromise of functions: error in use, abuse of rights, denial of actions
Note that a threat type can have multiple origins.

•Deliberate: aiming at information asset
– spying
– illegal processing of data
•Accidental
– equipment failure
– software failure
•Environmental
– natural event
– loss of power supply
•Negligence: Known but neglected factors, compromising the network safety and sustainability
•

Errors and omissions
Sample threat
•Errors and omissions are threats that affect data and system integrity. These errors have not only been caused by data entry users, who process a high number of
transactions a day, but they also are caused by all types of users who create and edit data. Sometimes, errors are the threats themselves, like a programming error or a
data entry error that crashes the system. Errors can occur in any phase of a life cycle of the systems. Errors in programming and development are often called
“bugs”.
Fraud and theft
•Both of fraud and theft are also information system security threats. They can be committed in ways the traditional fraud and theft were committed, while there are
also some newer methods. For instance, an employee can use the organization's information system to steal a small amount of money from different financial
accounts. The stolen money might not be checked and also is difficult to be found due to its small amount.. The authorized system users can commit computer
crimes in their system easier, because they are in a better position, as a result of their familiarity with that system and their abilities to access to the system
Employee sabotage
•Employees' deliberate actions such as mischief, and sabotaging can also cause damages for the information system, because they weaknesses of the computers and
applications. So when they have negative feeling to their organization or when they feel anxious about their employments, they can sabotage against their
organizations. The most common examples of sabotage are
•Destroying hardware or facilities,
•Destroying programs or data using planting logic bombs,
•Entering data incorrectly,
•“Crashing” the systems,
•Deleting data,
•Holding data hostage, and
•Changing data.
Loss of infrastructure that supports the system
•Usually, this kind of threats result in a system downtime, and it is often beyond the control of the owners of the information systems' resources. The loss of
supporting infrastructure occurs in circumstances, such as fire, flood, power failures, loss of communications, etc [3].
Malicious hackers
•This type of threats have rapidly become an important aspect of the information system, as a result of the development of communication networks and the Internet.
The term hacker describes an unauthorized person who tries to break down the information system security, and who then might damage the information system, let
the system unstable, change or steal data, and/or lose information
Threats to personal privacy
•Because a vast amount of electronic personal information are stored in many different databases, which belong to different organizations, they has been a huge
threat to individuals' privacy. These kinds of personal data can be used in many different undesired ways [3].

Rootkits: The job of the rootkits is to give cover to the hackers. The best or the worst part about rootkits is that they are able to
hide themselves from the antivirus software as well, due to which the user is not aware that a rootkit is present on the system.
This helps the hacker and he is able to spread malware on the system. Therefore, it is important that one opts for antivirus,
which also has a rootkit scanner, which will be able to detect the invasion.
Riskware: They are dangerous applications, who often become a part of software applications. They are often seen as a part of
development environment for malicious programs and spread to the software applications. In some cases, these applications
can also be used by hackers as additional components to gain access in the network.
Adware: The recent addition to the list of computer threats are the adware. They are actually advertising supported software. It
is not uncommon to see different advertisements or pop ups coming up on the computer, when certain applications are being
used. They may not pose a lot of threat, but often lower the speed of the computers. There are chances that the computer system
may become unstable because of these adware.
Cookies: When we visit a website, there are files due to which the website is able to remember the details of the computer.
They are more of a threat to confidentiality as opposed to the data on the computer. In most cases, cookies may be stored on the
computer without the consent of the user and data may be stored on them, which is passed back to the website server the next
time, one visits the website. The data gathered may be sold to third parties and depending on the interests, which may lead to
different advertisements flashing on the screen.
Phishing: Often people appear to get emails from trustworthy organizations, like banks. In some cases, the emails may come
from bogus sites, which may resemble the original site or it may superimposes a bogus pop up, due to which confidential data
is gathered. They are often a part of different scamming activities and often poses to the financial threats.
These were the main types of computer threats. It is important to be on the look always to ensure that the network and/or
standalone systems are protected from the threats. As soon as any of the threats are detected, measures will have to be taken to
get rid of them at the earliest, so that the data is protected.
Denial of Service
Denial-of-service is meant to disable a computer or a network and can be executed with limited resources. It is one of the most
common forms of attacks by hackers and can effectively disable the whole network of an organization. Denial of service attack
makes a computer resource unavailable to its intended user.

Threat model
People can be interested in studying all possible
threats that can:
•affect an asset
•affect a software system
•be brought by a threat agent

Threat classification
• Microsoft has proposed a threat classification
called STRIDE,from the initials of threat
categories:
• Spoofing of user identity
• Tampering
• Repudiation
• Information disclosure (privacy breach or
Data leak)
• Denial of Service (D.o.S.)
• Elevation of privilege
Threat communities
• The following threat communities are examples of the human
malicious threat landscape many organizations face:
• Internal
– Employees
– Contractors (and vendors)
– Partners
• External
– Cyber-criminals (professional hackers)
– Spies
– Non-professional hackers
– Activists
– Nation-state intelligence services (e.g., counterparts to the CIA, etc.)
– Malware (virus/worm/etc.) authors

Vulnerabilities to IS Security
• In computer security, a vulnerability is a
weakness which can be exploited by a Threat
Actor, such as an attacker, to perform
unauthorized actions within a computer system.
To exploit a vulnerability, an attacker must have
at least one applicable tool or technique that can
connect to a system weakness. In this frame,
vulnerability is also known as the attack surface.

•
Classification of Vulnerabilities
Vulnerabilities are classified according to the asset class they are related to:
• hardware
– susceptibility to humidity
– susceptibility to dust
– susceptibility to soiling
– susceptibility to unprotected storage
• software
– insufficient testing
– lack of audit trail
– design flaw
• network
– unprotected communication lines
– insecure network architecture
• personnel
– inadequate recruiting process
– inadequate security awareness
• physical site
– area subject to flood
– unreliable power source
• organizational
– lack of regular audits
– lack of continuity plans
– lack of security

Causes of Vulnerabilities to IS
•
• Security
Complexity: Large, complex systems increase the probability of flaws and unintended access points.
Familiarity: Using common, well-known code, software, operating systems, and/or hardware increases the probability an attacker has or can
find the knowledge and tools to exploit the flaw.
• Connectivity: More physical connections, privileges, ports, protocols, and services and time each of those are accessible increase vulnerability.
• Password management flaws: The computer user uses weak passwords that could be discovered by brute force. The computer user stores the
password on the computer where a program can access it. Users re-use passwords between many programs and websites.
• Fundamental operating system design flaws: The operating system designer chooses to enforce suboptimal policies on user/program
management. For example, operating systems with policies such as default permit grant every program and every user full access to the entire
computer.[This operating system flaw allows viruses and malware to execute commands on behalf of the administrator.
• Internet Website Browsing: Some internet websites may contain harmful Spyware or Adware that can be installed automatically on the
computer systems. After visiting those websites, the computer systems become infected and personal information will be collected and passed
on to third party individuals.
• Software bugs: The programmer leaves an exploitable bug in a software program. The software bug may allow an attacker to misuse an
application.
• Unchecked user input: The program assumes that all user input is safe. Programs that do not check user input can allow unintended direct
execution of commands or SQL statements (known as Buffer overflows, SQL injection or other non-validated inputs).
• Not learning from past mistakes: for example most vulnerabilities discovered in IPv4 protocol software were discovered in the new IPv6
implementations.

Examples of vulnerabilities
• Vulnerabilities are related to:
• physical environment of the system
• the personnel
• management
• administration procedures and security measures within the organization
• business operation and service delivery
• hardware
• software
• communication equipment and facilities
• and their combinations.
• It is evident that a pure technical approach cannot even protect physical assets: one should have administrative procedure to let maintenance
personnel to enter the facilities and people with adequate knowledge of the procedures, motivated to follow it with proper care.
• Four examples of vulnerability exploits:
– an attacker finds and uses an overflow weakness to install malware to export sensitive data;
– an attacker convinces a user to open an email message with attached malware;
– an insider copies a hardened, encrypted program onto a thumb drive and cracks it at home;
– a flood damages one's computer systems installed at ground floor.

•
Software vulnerabilities
Common types of software flaws that lead to vulnerabilities include:
• Memory safety violations, such as:
– Buffer overflows and over-reads
– Dangling pointers
• Input validation errors, such as:
– Code injection
– Cross-site scripting in web applications
– Directory traversal
– E-mail injection
– Format string attacks
– HTTP header injection
– HTTP response splitting
• Privilege-confusion bugs, such as:
– Clickjacking
– Cross-site request forgery in web applications
– FTP bounce attack
• Privilege escalation
• Race conditions, such as:
– Symlink races
– Time-of-check-to-time-of-use bugs
– SQL injection
• Side-channel attack
– Timing attack
• User interface failures, such as:
– Blaming the Victim prompting a user to make a security decision without giving the user enough information to answer it [31]
– Race Conditions[32][33]
– Warning fatigue[34] or user conditioning.

Other Vulnerabilities
• Code Mistakes
• Implement Prevention in Code
• Thoroughly Test
• Use Tools
• Untrained Users
– Security ignorance compromises data
– Provide the training
– Rules of Behavior
– Annual refresher training
• Insecure Configuration Settings
19

In the near future, information warfare will control
the form and future of war... Our sights must not be
National
fixed on the Vulnerability
fire-power Database
of the industrial age; rather,
they must be trained on the information warfare of the
information age.
20
Countermeasures – Programmatic
Maturity
• Establish solid policy foundation
• Manage risk (rather than seeking to eliminate it)
• Plan for failure
• Elevate security to “production quality”
• Blend technical and non-technical controls
• Do not rely on perimeter controls alone

Technical Countermeasures
• Application security
(what next after the firewall)
• Encryption
• Interior hardening
• Security management
• Assurance testing

Wireless Security Challenges:

• Radio frequency bands are easy to scan
• The service set identifiers (SSID) identifying the

access points broadcast multiple times

Wi-Fi Security Challenges

Malicious Software: Viruses, Worms, Trojan Horses, and

Spyware
Hackers and Cybervandalism
• Computer viruses, worms, trojan horses
• Spyware
• Spoofing and Sniffers
• Denial of Service (DoS) Attacks
• Identity theft
• Cyberterrorism and Cyberwarfare
• Vulnerabilities from internal threats (employees);
10.25 software flaws © 2006 by Prentice Hall
Worldwide Damage from Digital Attacks

BUSINESS VALUE OF SECURITY AND CONTROL
• Inadequate security and control may create serious

legal liability.
• Businesses must protect not only their own information

assets but also those of customers, employees, and
business partners. Failure to do so can lead to costly
litigation for data exposure or theft.
• A sound security and control framework that protects

business information assets can thus produce a high
return on investment.

Security Incidents Continue to Rise
Source: CERT Coordination

Center, www.cert.org, accessed
July 6, 2004.
Legal and Regulatory Requirements for Electronic

Records Management
• Electronic Records Management (ERM): Policies,

procedures and tools for managing the retention,
destruction, and storage of electronic records

Data Security and Control Laws:
• The Health Insurance Portability and Accountability

Act (HIPAA)
• Gramm-Leach-Bliley Act
• Sarbanes-Oxley Act of 2002

Electronic Evidence and Computer Forensics
• Electronic Evidence: Computer data stored on disks

and drives, e-mail, instant messages, and e-
commerce transactions
• Computer Forensics: Scientific collection,

examination, authentication, preservation, and
analysis of computer data for use as evidence in a
court of law

ESTABLISHING A MANAGEMENT FRAMEWORK FOR

SECURITY AND CONTROL
Types of Information Systems Controls

General controls:
• Software and hardware
• Computer operations
• Data security
• Systems implementation process


Application controls:
• Input
• Processing
• Output


Risk Assessment:
• Determines the level of risk to the firm if a specific

activity or process is not properly controlled


Security Policy:
Policy ranking information risks, identifying acceptable

security goals, and identifying the mechanisms for
achieving these goals
• Acceptable Use Policy (AUP)
• Authorization policies


Security Profiles for a Personnel System


Ensuring Business Continuity

• Downtime: Period of time in which a system is not
operational
• Fault-tolerant computer systems: Redundant

hardware, software, and power supply components to
provide continuous, uninterrupted service
• High-availability computing: Designing to maximize

application and system availability



(Continued)
• Load balancing: Distributes access requests across
multiple servers
• Mirroring: Backup server that duplicates processes on

primary server
• Recovery-oriented computing: Designing computing

systems to recover more rapidly from mishaps



(Continued)
• Disaster recovery planning: Plans for restoration of
computing and communications disrupted by an
event such as an earthquake, flood, or terrorist
attack
• Business continuity planning: Plans for handling

mission-critical functions if systems go down


Auditing:
• MIS audit: Identifies all of the controls that govern

individual information systems and assesses their
effectiveness
• Security audits: Review technologies, procedures,

documentation, training, and personnel


Sample Auditor’s List of Control Weaknesses

TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Access Control
Access control: Consists of all the policies and

procedures a company uses to prevent improper access
to systems by unauthorized insiders and outsiders
Authentication:
• Passwords
• Tokens, smart cards

• Biometric authentication

Firewalls, Intrusion Detection Systems, and

Antivirus Software
• Firewalls: Hardware and software controlling flow of

incoming and outgoing network traffic
• Intrusion detection systems: Full-time monitoring

tools placed at the most vulnerable points of
corporate networks to detect and deter intruders

Firewalls, Intrusion Detection Systems, and

Antivirus Software (Continued)
• Antivirus software: Software that checks computer

systems and drives for the presence of computer
viruses and can eliminate the virus from the infected
area
• Wi-Fi Protected Access specification

A Corporate Firewall

Encryption and Public Key Infrastructure
• Public key encryption: Uses two different keys, one

private and one public. The keys are mathematically
related so that data encrypted with one key can be
decrypted using only the other key
• Message integrity: The ability to be certain that the

message being sent arrives at the proper destination
without being copied or changed


(Continued)
• Digital signature: A digital code attached to an
electronically transmitted message that is used to
verify the origin and contents of a message
• Digital certificates: Data files used to establish the

identity of users and electronic assets for protection
of online transactions
• Public Key Infrastructure (PKI): Use of public key

cryptography working with a certificate authority

(Continued)
• Secure Sockets Layer (SSL) and its successor
Transport Layer Security (TLS): protocols for secure
information transfer over the Internet; enable client
and server computer encryption and decryption
activities as they communicate during a secure Web
session.
• Secure Hypertext Transfer Protocol (S-HTTP): used for
encrypting data flowing over the Internet; limited to
Web documents, whereas SSL and TLS encrypt all
data being passed between client and server.

Public Key Encryption

Digital Certificates

MANAGEMENT OPPORTUNITIES, CHALLENGES AND SOLUTIONS
Management Opportunities:
Creation of secure, reliable Web sites and

systems that can support e-commerce and
e-business strategies

Management Challenges:
• Designing systems that are neither overcontrolled

nor undercontrolled
• Implementing an effective security policy

Solution Guidelines:
• Security and control must become a more visible
and explicit priority and area of information
systems investment.
• Support and commitment from top management is

required to show that security is indeed a corporate
priority and vital to all aspects of the business.
• Security and control should be the responsibility of

everyone in the organization.

Week 11 SECURITY AND CONTROL

Uploaded by

Copyright:

Available Formats

Week 11 SECURITY AND CONTROL

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Week 11 SECURITY AND CONTROL

Uploaded by

Copyright:

Available Formats

Chapter 11

Security and Control

10.1 © 2006 by Prentice Hall

• Explain why information systems need special

• Assess the business value of security and

• Evaluate elements of an organizational and

10.2 © 2006 by Prentice Hall

• Evaluate the most important tools and

• Identify the challenges posed by information

10.3 © 2006 by Prentice Hall

Wesfarmers Limited Case

• Challenge: provide network and infrastructure

SYSTEM VULNERABILITY AND ABUSE

Why Systems Are Vulnerable

Contemporary Security Challenges and Vulnerabilities

10.5 Figure 10-1 © 2006 by Prentice Hall

SYSTEM VULNERABILITY AND ABUSE

Why Systems Are Vulnerable (Continued)

• Use of fixed Internet addresses through use of

• Lack of encryption with most Voice over IP (VoIP)

• Widespread use of e-mail and instant messaging

10.6 © 2006 by Prentice Hall

10.7 © 2006 by Prentice Hall

Note that a threat type can have multiple origins.

10.8 © 2006 by Prentice Hall

10.9 © 2006 by Prentice Hall

10.10 © 2006 by Prentice Hall

10.11 © 2006 by Prentice Hall

10.13 © 2006 by Prentice Hall

10.14 © 2006 by Prentice Hall

10.15 © 2006 by Prentice Hall

10.16 © 2006 by Prentice Hall

10.17 © 2006 by Prentice Hall

10.18 © 2006 by Prentice Hall

• Insecure Configuration Settings

10.19 © 2006 by Prentice Hall

10.21 © 2006 by Prentice Hall

10.22 © 2006 by Prentice Hall

SYSTEM VULNERABILITY AND ABUSE

Wireless Security Challenges:

• The service set identifiers (SSID) identifying the

10.23 © 2006 by Prentice Hall

SYSTEM VULNERABILITY AND ABUSE

Wi-Fi Security Challenges

10.24 Figure 10-2 © 2006 by Prentice Hall

SYSTEM VULNERABILITY AND ABUSE

Malicious Software: Viruses, Worms, Trojan Horses, and

SYSTEM VULNERABILITY AND ABUSE

Worldwide Damage from Digital Attacks

10.26 Figure 10-3 © 2006 by Prentice Hall

BUSINESS VALUE OF SECURITY AND CONTROL

• Inadequate security and control may create serious

• Businesses must protect not only their own information

• A sound security and control framework that protects

10.27 © 2006 by Prentice Hall

BUSINESS VALUE OF SECURITY AND CONTROL

Security Incidents Continue to Rise

Source: CERT Coordination

BUSINESS VALUE OF SECURITY AND CONTROL