Information system for managers

Unintentional Threats (Continued)

Environmental hazards include earthquakes,
severe storms, floods, power failures or strong
fluctuations, fires (most common hazard),
explosions, etc.

Managing Information
Resources and Security

Computer system failures can occur as the

result of poor manufacturing or defective
materials.

Threats to Information Security

Intentional Threats

A threat to an information resource is any danger to which a

system may be exposed.

Typically, criminal in nature.

The exposure of an information resources is the harm, loss

or damage that can result if a threat compromises that
resource.

Cybercrimes are fraudulent activities committed

using computers and communications networks,
particularly the Internet.

A systems vulnerability is the possibility that the system will

suffer harm by a threat.
Risk is the likelihood that a threat will occur.
Information system controls are the procedures, devices, or
software aimed at preventing a compromise to the system.

Average cybercrime involves about $600,000

according to FBI.

Unintentional Threats

Intentional Threats (Continued)

Human errors can occur in the design of the

hardware and/or information system.
Also can occur in programming, testing, data
collection, data entry, authorization and
procedures.
Contribute to more than 50% of control and
security-related problems in organizations.

Hacker. An outside person who has penetrated a

computer system, usually with no criminal intent.
Cracker. A malicious hacker.
Social engineering. Computer criminals or corporate
spies get around security systems by building an
inappropriate trust relationship with insiders.

Shweta Sharma

IBS Gurgaon 1

Information system for managers

Espionage or Trespass
The act of gaining access to the information an organization
is trying to protect by an unauthorized individual.
Industrial espionage (spying) occurs in areas where
researching information about the competition goes beyond
the legal limits.
Governments practice industrial espionage against
companies in other countries.
Shoulder surfing is looking at a computer monitor or ATM
screen over another persons shoulder.

System Vulnerability
A universal vulnerability is a state in a computing system
which either allows an attacker to execute commands as another user;
allows an attacker to access data that is contrary to the access
restrictions for that data;
allows an attacker to pose as another entity;
or allows an attacker to conduct a denial of service.

Protecting Privacy

(Continued)

Information on Internet Bulletin Boards and Newsgroups.

Electronic discussions such as chat rooms and these other sites
appear on the Internet, within corporate intranets, and on blogs.
A blog (Weblog) is an informal, personal journal that is frequently
updated and intended for general public reading.
Privacy Codes and Policies. An organizations guidelines with
respect to protecting the privacy of customers, clients, and
employees.
International Aspects of Privacy. Privacy issues that international
organizations and governments face when information spans
countries and jurisdictions.

Information Extortion
When an attacker or formerly trusted employee
steal information from a computer system and
then demands compensation for its return or an
agreement not to disclose it.

An exposure is a state in a computing system (or set of

systems) which is not a universal vulnerability, but either:
allows an attacker to conduct information gathering activities;
allows an attacker to hide activities;
includes a capability that behaves as expected, but can be easily
compromised;
is a primary point of entry that an attacker may attempt to use to gain
access to the system or data;
and is considered a problem according to some security policy.

Protecting Privacy

Sabotage or Vandalism

Privacy. The right to be left alone and to be free of unreasonable

personal intrusions.

A popular type of online vandalism is hacktivist or

cyberactivist activities.

Two rules have been followed fairly closely in past court decision in
many countries:
The right of privacy is not absolutes. Privacy must be balanced
against the needs of society
The publics right to know is superior to the individuals right of
privacy.

Hacktivist or cyberactivist use technology for high-tech

civil disobedience to protest operations, policies, or
actions of an individual, an organization, or a
government agency.

Electronic Surveillance. The tracking of peoples activities, online

or offline, with the aid of computers.
Personal Information in Databases. Information about individuals
is being kept in many databases: banks, utilities co., govt. agencies,
etc.; the most visible locations are credit-reporting agencies.

Shweta Sharma

IBS Gurgaon 2

Information system for managers

Sabotage or Vandalism

(Continued)

Cyber terrorism is a premeditated, politically motivated

attack against information, computer systems, computer
programs, and data that results in violence against
noncombatant targets by sub-national groups or
clandestine agents.
Cyber-war. War in which a countrys information systems
could be paralyzed from a massive attack by destructive
software.

Software Attacks (Continued)

Viruses. Segments of computer code that performs
unintended actions ranging from merely annoying to
destructive.
Worms. Destructive programs that replicate themselves
without requiring another program to provide a safe
environment for replication.

Theft is the illegal taking of property that belongs to

another individual or organization.

Trojan horses. Software programs that hide in other

computer programs and reveal their designed behavior
only when they are activated.

Identity Theft

Software Attacks (Continued)

Crime in which someone uses the personal information

of others, usually obtained from the Internet, to create a
false identity and then commits fraud.

Logic bombs. Designed to activate and perform a

destructive action at a certain time.

Fastest growing white-collar crime.

Back doors or trap doors. Typically a password, known

only to the attacker, that allows access to the system
without having to go through any security.

Biggest problem is restoring victims damaged credit

rating.

Denial-of-service. An attacker sends so many

information requests to a target system that the target
cannot handle them successfully and can crash the entire
system. [Case: SCO site bombarded on Linux
controversy]

Software Attacks

Alien Software

Malicious software (malware) designed to damage,

destroy, or deny service to the targeted systems.

Pestware. Clandestine software that uses up valuable

system resources and can report on your Web surfing
habits and other personal information.

Most common types of software attacks are viruses,

worms, Trojan horses, logic bombs, back doors, denialof-service, alien software, phishing and pharming.

Adware. Designed to help popup advertisements appear

on your screen.
Spyware. Software that gathers user information
through the users Internet connection without their
knowledge (i.e. key logger, password capture).

Shweta Sharma

IBS Gurgaon 3

Information system for managers

Alien Software (Continued)

Compromises to Intellectual Property

(Continued)

Spamware. Designed to use your computer as a

launch pad for spammers.

Copyright. Statutory grant that provides creators of

intellectual property with ownership of the property for life
of the creator plus 70 years.

Spam. Unsolicited e-mail, usually for purposes

of advertising.

Piracy. Copying a software program without making

payment to the owner.

Cookies. Small amount of information that Web

sites store on your computer, temporarily or
more-or-less permanently.

Alien Software (Continued)

IS Vulnerability

Web bugs. Small, usually invisible, graphic images that

are added to a Web page or e-mail.
Phishing. Uses deception to fraudulently acquire
sensitive personal information such as account numbers
and passwords disguised as an official-looking e-mail.
Pharming. Fraudulently acquires the Domain Name for a
companys Web site and when people type in the Web
site url they are redirected to a fake Web site.

23

Compromises to Intellectual Property

Intellectual property. Property created by individuals or
corporations which is protected under trade secret,
patent, and copyright laws.
Trade secret. Intellectual work, such as a business plan,
that is a company secret and is not based on public
information.

Patent. Document that grants the holder exclusive rights

on an invention or process for 20 years.

Shweta Sharma

IBS Gurgaon 4

Information system for managers

Defacement

Malware

Website defacement is an attack on a

website that changes the visual
appearance of the site or a webpage.
These are typically the work of system
crackers, who break into a web server and
replace the hosted website with one of
their own.

Malware' is an umbrella term used to refer

to a variety of forms of hostile or intrusive
software, including computer viruses,
worms, trojan horses, ransomware,
spyware, adware, scareware, and other
malicious programs. It can take the form of
executable code, scripts, active content,
and other software.

Targeted Attack

DDOS

A targeted attack refers to a type of threat

in which threat actors actively pursue and
compromise a target entity's infrastructure
while maintaining anonymity. These
attackers have a certain level of expertise
and have sufficient resources to conduct
their schemes over a long-term period.

DDoS is a type of DOS attack where

multiple compromised systems, which are
often infected with a Trojan, are used to
target a single system causing a Denial of
Service (DoS) attack.

SQLi

Account Hijacking

SQL injection (SQLi) refers to an injection

attack wherein an attacker can execute
malicious SQL statements (also commonly
referred to as a malicious payload) that
control a web application's database
server (also commonly referred to as a
Relational Database Management System
RDBMS).

Account hijacking is a process through

which an individuals email account,
computer account or any other account
associated with a computing device or
service is stolen or hijacked by a hacker.

Shweta Sharma

It is a type of identity theft in which the

hacker uses the stolen account
information to carry out malicious or
unauthorized activity

IBS Gurgaon 5

Information system for managers

POS Malware

Malvertising

Point-of-sale malware (POS malware) is

malicious software expressly written to
steal customer payment data -- especially
credit card data -- from retail checkout
systems. Criminals often purchase POS
malware to steal customer data from a
retail organization with the intention of
selling the data rather than using it
directly.

Malvertising (a portmanteau of "malicious

advertising") is the use of online
advertising to spread malware.
Malvertising involves injecting malicious
or malware-laden advertisements into
legitimate online advertising networks and
webpages.

BGP Hijacking
BGP hijacking is known to be caused by Internet
service providers (ISPs) which do not filter the
prefix announcements coming from some of
their peers before transferring them to others.
Once an attacker obtains access to such peer,
he can advertise any prefix he wants to the other
peers of the vulnerable ISP, causing denial of
service (or possibly man-in-the-middle attack)
for either the hijacked prefix or the upstream ISP
itself in case the incoming traffic requires more
bandwidth than this ISP can handle.

Heartbeat Vulnerability
A vulnerability in OpenSSL could allow a
remote attacker to expose sensitive data,
possibly including user authentication
credentials and secret keys, through
incorrect memory handling in the TLS
heartbeat extension.

Shweta Sharma

IBS Gurgaon 6

Information system for managers

How a virus works

Corporate Security Plan

- Protecting

Chapter 16

Defense Strategy - Controls

Shweta Sharma

IBS Gurgaon 7

Information system for managers

Controls
Controls evaluation. Identifies security deficiencies and
calculates the costs of implementing adequate control
measures.
General controls. Established to protect the system
regardless of their application.
Physical controls. Physical protection of computer facilities and
resources.
Access controls. Restriction of unauthorized user access to
computer resources; use biometrics and passwords controls
for user identification.

Controls (Continued)
Virtual Private Networking. Uses the Internet
to carry information within a company and
among business partners but with increased
security by uses of encryption, authentication
and access control.
Application controls. Controls that protect
specific applications and include: input,
processing and output controls.

Controls (Continued)

Controls (Continued)

Communications (networks) controls. To

protect the movement of data across networks
and include border security controls,
authentication and authorization.

Information systems auditing. Independent or

unbiased observers task to ensure that
information systems work properly.

Firewalls. System that enforces access-control policy

between two networks.
Encryption. Process of converting an original
message into a form that cannot be read by anyone
except the intended receiver.

Types of Auditors and Audits

Internal. Performed by corporate internal auditors.
External. Reviews internal audit as well as the inputs,
processing and outputs of information systems.
Audit. Examination of information systems, their
inputs, outputs and processing.

Controls (Continued)

IS Auditing Procedure

All encryption systems use a key.

Symmetric encryption. Sender and the
recipient use the same key.
Public-key encryption. Uses two different keys:
a public key and a private key.
Certificate authority. Asserts that each
computer is identified accurately and provides
the public keys to each computer.

Auditing around the computer means verifying

processing by checking for known outputs or
specific inputs.
Auditing through the computer means inputs,
outputs and processing are checked.
Auditing with the computer means using a
combination of client data, auditor software, and
client and auditor hardware.

Shweta Sharma

IBS Gurgaon 8

Information system for managers

Risk Mitigation Strategies

Auditing
Implementing controls in an organization can be very complicated and difficult to
enforce. Are controls installed as intended? Are they effective? Did any breach of
security occur? These and other questions need to be answered by independent and
unbiased observers. Such observers perform an auditing task.

There are two types of auditors:

An internal auditor is usually a corporate employee who is not a
member of the ISD-Information Service Dept.).
An external auditor is a corporate outsider. This type of auditor
reviews the findings of the internal audit.
There are two types of audits.
The operational audit determines whether the ISD is working
properly.
The compliance audit determines whether controls have been
implemented properly and are adequate.

IS Audit objective

is for Protecting Information Resources

Risk. The probability that a threat will impact an

information resource.
Risk management. To identify, control and minimize the
impact of threats.
Risk analysis. To assess the value of each asset being
protected, estimate the probability it might be
compromised, and compare the probable costs of it
being compromised with the cost of protecting it.

Protecting Information Resources

Risk Acceptance. Accept the potential risk, continue

operating with no controls, and absorb any damages that
occur.
Risk limitation. Limit the risk by implementing controls
that minimize the impact of threat.

Risk transference. Transfer the risk by using other

means to compensate for the loss, such as purchasing
insurance.

Disaster Recovery Planning

Disaster recovery. The chain of events linking
planning to protection to recovery, disaster
recovery plan.
Disaster avoidance. Oriented towards
prevention, uninterrupted power supply (UPS).
Hot sites. External data center that is fully
configured and has copies of the organizations
data and programs.

Business Continuity

(Continued)
Risk mitigation is when the organization takes concrete
actions against risk. It has two functions:
(1) implement controls to prevent identified threats
from occurring, and
(2) developing a means of recovery should the threat
become a reality.

An important element in any security system is the business continuity plan,

also known as the disaster recovery plan. Such a plan outlines the process
by which businesses should recover from a major disaster.
The purpose of a business continuity plan is to keep the business running
after a disaster occurs.
Recovery planning is part of asset protection.
Planning should focus on recovery from a total loss of all capabilities.
Proof of capability usually involves some kind of what-if analysis that
shows that the recovery plan is current.
All critical applications must be identified and their recovery procedures
addressed.
The plan should be written so that it will be effective in case of disaster.

Shweta Sharma

IBS Gurgaon 9

Information system for managers

Managerial Issues
What is the business value of IT security and
control?
Why are these legal obligations?
How important is IT security to management
IT security and internal control must be
implemented top-down
Acceptable use policies

Managerial Issues (Continued)

Digital assets are relied upon for competitive
advantage
What does risk management involve
What are the impacts of IT security breaches
Federal and State regulations
Internal Control and Computer Forensics

Shweta Sharma

IBS Gurgaon 10