PROFFESSIONAL ETHICS

Lecture_9

Prepared by:
Dr. Hebatulla M. Nabil

Text book:
Ethics in Information Technology
for GEORGE W.REYNOLDS
 Trustworthy Computing
2

Is a method of computing that:

 Delivers secure, private, and

reliable computing

 Based on sound business

practices
 Implementing Trustworthy
3

Computing
 Security of any system or network is a combination of:

Technology - Policy – People

 A strong security program begins by:

1. Assessing threats to the organization’s computers and network,
2. Identifying actions that address the most serious vulnerabilities,
3. Educating users about the risks involved and the actions they must
take to prevent a security incident.
Implementing Trustworthy
4

Computing (Cont.)
1. Risk Assessment
2. Establishing a Security Policy
3. Educating Employees and
Contract Workers
4. Prevention
5. Detection
6. Response
1. Risk Assessment
5

 Process of assessing security-related risks to an organization’s

computers and networks from both internal and external
threats

 Identifies investments that best protect from most likely and

serious threats

 Focuses security efforts on areas of highest payoff

1. Risk Assessment (Cont.)
6

Eight-step risk assessment process

1. Identify assets of most concern
2. Identify loss events that could occur
3. Assess likelihood of each potential threat
4. Determine the impact of each threat
5. Determine how each threat could be mitigated
6. Assess feasibility of mitigation options
7. Perform cost-benefit analysis
8. Decide which countermeasures to implement
1. Risk Assessment (Cont.)
7
1. Risk Assessment (Cont.)
8
2. Establishing a Security Policy
9

 A security policy defines:

• Organization’s security requirements
• Controls and sanctions needed to meet the requirements

 Determines responsibilities and expected behavior

 Outlines what needs to be done → Not how to do it

 Automated system policies should mirror written policies

2. Establishing a Security Policy (Cont.)
10

 Trade-off between:
• Ease of use
• Increased security
 Areas of concern
• Email attachments
• Wireless devices
 Surfing the web or transacting on an unsecured Wi-Fi network
means you could be exposing your private information and
browsing habits → So…using VPN (Virtual Private Network)
 2. Establishing a Security Policy (Cont.)
12

Virtual Private Network (VPN)

 A VPN connection establishes a

secure connection between you and
the internet.

 VPN uses the Internet to relay

communications but maintains privacy
through security features, it gives you
online privacy and anonymity by
creating a private network from a
public internet connection.
 2. Establishing a Security Policy (Cont.)
13

Virtual Private Network (VPN) (Cont.)

 it maintains privacy through security procedures and tunneling protocols,

which encrypt data at the sending end and decrypt it at the receiving end.

 VPNs mask (encryption) your internet protocol (IP) address so your online
actions are virtually untraceable.

 The encryption and anonymity that a VPN provides helps protect your
online activities → sending emails, shopping online, web browsing or paying
bills.
3. Educating Employees,
13

Contractors, and Part-Time Workers

 Educate and motivate users to understand and follow policy
 Discuss recent security incidents
 Help protect information systems by:
1. Guarding passwords
2. Not allowing sharing of passwords
3. Applying strict access controls to protect data
4. Reporting all unusual activity
5. Protecting portable computing and data storage devices
4. Prevention
15

 The IT security group must lead the effort to implement security

policies and procedures, along with hardware and software
tools to help prevent security breaches.

 The key to prevention of a computer security incident is to

implement a layered security solution to make computer
break-ins so difficult that an attacker eventually gives up.

 No security system is perfect, so systems and procedures must

be monitored to detect a possible intrusion.
4. Prevention (Cont.)
15

1. Installing a Corporate Firewall

2. Intrusion Detection Systems (IDS)
3. Installing Antivirus Software on Personal Computers
4. Implementing Safeguards Against Attacks by Malicious Insiders
5. Defending Against Cyberterrorism
6. Addressing the Most Critical Internet Security Threats
7. Conducting Periodic IT Security Audits
 4. Prevention (Cont.)
16

1. Installing a Corporate Firewall

➢ A Firewall is a network security system

that monitors and controls incoming and
outgoing network traffic based on
predetermined security rules.

➢ A firewall typically establishes a barrier

between a trusted network and an
untrusted network, such as the Internet.
 4. Prevention (Cont.)
17

2. Intrusion Detection Systems (IDS)

➢ A software and/or hardware that monitors

system and network resources and activities,
and notifies network security personnel when
it detects network traffic that attempts to
circumvent the security measures of a
networked computer environment.

➢ Such activities usually signal an attempt to

breach the integrity of the system or to limit
the availability of network resources.
 4. Prevention (Cont.)
18

2. Intrusion Detection Systems (IDS) (Cont.)

IDS Approaches:

A. Knowledge-based Approach → intrusion detection systems contain

information about specific attacks and system vulnerabilities and watch
for attempts to exploit these vulnerabilities, when such an attempt is
detected, an alarm is triggered.

➢ Example: repeated failed login attempts or recurring attempts to

download a program to a server.
 4. Prevention (Cont.)
19

2. Intrusion Detection Systems (IDS) (Cont.)

IDS Approaches: (Cont.)

B. Behavior-based Approach → intrusion detection system models normal

behavior of a system and its users from reference information collected by
various means. It compares current activity with this model and generates
an alarm if it finds a deviation.
➢ Examples include unusual traffic at odd hours or for instance a user
in the Human Resources Department who accesses an accounting
program that she has never before used.
 4. Prevention (Cont.)
20

3. Installing Antivirus Software on Personal Computers

➢ Antivirus software should be installed on each user’s personal

computer to scan a computer’s memory and disk drives regularly for
viruses.

➢ Antivirus software scans for a specific sequence of bytes, known as a

virus signature, that indicates the presence of a specific virus.

➢ If it finds a virus, the antivirus software informs the user, and it may
clean, delete, or quarantine any files, directories, or disks affected by
the malicious code.
 4. Prevention (Cont.)
21

3. Installing Antivirus Software on Personal Computers (Cont.)

➢ Good antivirus software checks vital system files when the system is booted
up, monitors the system continuously for viruslike activity, scans disks, scans
memory when a program is run, checks programs when they are
downloaded, and scans email attachments before they are opened.

➢ It is crucial that antivirus software be continually updated with the latest virus
signatures → the network administrator responsibility.

➢ Antivirus software is not able to identify and block all viruses.

 4. Prevention (Cont.)
22

4. Implementing Safeguards Against Attacks

by Malicious Insiders

By:
 Departing employees and contractors
• Promptly delete computer accounts, login IDs, and passwords
 Carefully defining employee roles and separate key responsibilities
 Creating roles and user accounts to limit authority
 4. Prevention (Cont.)
23

5. Defending against cyberterrorism

 Department of Homeland Security and its National Cyber Security

Division (NCSD) is a resource
• Builds and maintains a national security cyberspace response
system
• Implements a cyber-risk management program for protection of
critical infrastructure, including banking and finance, water,
government operations, and emergency services
 4. Prevention (Cont.)
24

6. Addressing the Most Critical Internet Security Threats

➢ The majority of successful computer attacks takes advantage of well-

known vulnerabilities → which makes scanning the Internet for
vulnerable systems an effective attack strategy.

➢ The rampant and destructive spread of worms, such as Blaster,

Slammer, and Code Red, was made possible by the exploitation of
known but unpatched vulnerabilities.
4. Prevention (Cont.)
25

6. Addressing the Most Critical Internet Security Threats (Cont.)

 The actions required to address these issues include:

• Installing a known patch to the software
• Keeping applications and operating systems up to date.

 Those responsible for computer security must make it a priority to

prevent attacks using these vulnerabilities.

Patching is the process of applying targeted changes to a software program, an operating system;
In order to either update the system to a newer version, or to supply code to fix an existing problem.
4. Prevention (Cont.)
26

7. Conduct periodic IT security audits

 Evaluate policies and whether they are followed

 Review access and levels of authority
 Test system safeguards
 Information
Protection Assessment kit is available from
the Computer Security Institute
 5. Detection
27

 Detection systems → catch intruders in the act

 Intrusion detection system (IDS):

• Monitors system/network resources and activities
• Notifies the proper authority when it identifies:
- Possible intrusions from outside the organization
→ using Knowledge-based approach
- Misuse from within the organization
→ using Behavior-based approach
6. Response
28

 An organization should be prepared for the worst - a successful attack

that defeats all or some of a system’s defenses and damages data and
information systems.

 A well-developed response plan helps keep an incident under technical

and emotional control.

 Response plan must be developed well in advance of any incident.

And it is approved by Legal department and Senior management.

 Only 56% have response plan

6. Response (Cont.)
29

 Primary goals are:

 Regain control and limit damage Not to monitor or catch an intruder

 Clear reaction plan addresses:

1. Incident Notification
2. Protection of Evidence and Activity Logs
3. Incident Containment
4. Eradication
5. Incident Follow-Up
6. Response (Cont.)
30

Clear reaction plan addresses:

1. Incident Notification

 Incident notification defines:

• Who to notify
• Who not to notify

 Security experts recommend against releasing specific information

about a security compromise in public forums
6. Response (Cont.)
31

Clear reaction plan addresses: (cont.)

2. Protection of Evidence and Activity Logs
 An organization should document all details of a security incident as it
works to resolve the incident. Documentation captures valuable
evidence for a future prosecution and provides data to help during
the incident eradication and follow-up phases.
 It is especially important to capture all system events, the specific
actions taken (what, when, and who), and all external conversations
(what, when, and who) in a logbook.
 Because this data may become court evidence, an organization
should establish a set of document handling procedures using the
legal department as a resource.
 6. Response (Cont.)
32

Clear reaction plan addresses: (cont.)

3. Incident Containment
➢ Often it is necessary to act quickly to contain an attack and to keep a
bad situation from becoming even worse. The response plan should
clearly define the process for deciding if an attack is dangerous enough
to warrant shutting down or disconnecting critical systems from the
network.
➢ The potential for negative publicity must also be considered. Discussing
security attacks through public trials and the associated publicity has not
only enormous potential costs in public relations but real monetary costs
as well. For example, a bank or a brokerage firm might lose customers
who learn of an attack and think their money or records aren’t secure.
 6. Response (Cont.)
33

Clear reaction plan addresses: (cont.)

4. Eradication effort and recovery

 Collect and log all possible criminal evidence
 Verify necessary backups are current and complete
 Create new backups
6. Response (Cont.)
34

Clear reaction plan addresses: (cont.)

5. Incident Follow-Up
 Determine how security was compromised
• Prevent it from happening again
 Review

• Determine exactly what happened

• Evaluate how the organization responded
6. Response (Cont.)
35

 Another important issue is the amount of effort that should be put into
capturing the perpetrator.

 Legal precedent → Hold organizations accountable for their own IT

security weaknesses
Computer Forensics
36

 Computer forensics is a discipline that combines elements of law and

computer science to identify, collect, examine, and preserve data
from computer systems, networks, and storage devices in a manner
that preserves the integrity of the data gathered so that it is
admissible as evidence in a court of law.

 Computer forensics investigation requires extensive training,

certification and knowledge of laws that apply to gathering of
criminal evidence