1、10.1 2006 by Prentice Hall10Chapter 10.2 2006 by Prentice HallOBJECTIVES Explain why information systems need special protection from destruction, error, and abuse Assess the business value of security and control Evaluate elements of an organizational and managerial framework for security and contr
2、ol10.3 2006 by Prentice Hall Evaluate the most important tools and technologies for safeguarding information resources Identify the challenges posed by information systems security and control and management solutions OBJECTIVES (Continued)10.4 2006 by Prentice Hall Challenge: provide network and in
3、frastructure security to a financial services firm in a Web-enabled high-threat environment Solutions: outsource to a well-known security firm the task of providing 24 x 7 network and infrastructure monitoring and reporting Real-time security monitoring 24 x 7, best practices, online security portal
4、, data mining of network transactions Illustrates the role of system and network security in providing customers with service and managing corporate risk in online environmentsWesfarmers Limited Case10.5 2006 by Prentice HallSYSTEM VULNERABILITY AND ABUSE Why Systems Are Vulnerable Contemporary Secu
5、rity Challenges and Vulnerabilities Figure 10-110.6 2006 by Prentice Hall Use of fixed Internet addresses through use of cable modems or DSL Lack of encryption with most Voice over IP (VoIP) Widespread use of e-mail and instant messaging (IM)SYSTEM VULNERABILITY AND ABUSE Internet Vulnerabilities: W
6、hy Systems Are Vulnerable (Continued)10.7 2006 by Prentice Hall Radio frequency bands are easy to scan The service set identifiers (SSID) identifying the access points broadcast multiple times SYSTEM VULNERABILITY AND ABUSE Wireless Security Challenges: 10.8 2006 by Prentice HallSYSTEM VULNERABILITY
7、 AND ABUSE Wi-Fi Security Challenges Figure 10-210.9 2006 by Prentice Hall Computer viruses, worms, trojan horses Spyware Spoofing and Sniffers Denial of Service (DoS) Attacks Identity theft Cyberterrorism and Cyberwarfare Vulnerabilities from internal threats (employees); software flaws SYSTEM VULN
8、ERABILITY AND ABUSE Malicious Software: Viruses, Worms, Trojan Horses, and SpywareHackers and Cybervandalism10.10 2006 by Prentice HallSYSTEM VULNERABILITY AND ABUSE Worldwide Damage from Digital Attacks Figure 10-310.11 2006 by Prentice Hall Inadequate security and control may create serious legal
9、liability. Businesses must protect not only their own information assets but also those of customers, employees, and business partners. Failure to do so can lead to costly litigation for data exposure or theft. A sound security and control framework that protects business information assets can thus
10、 produce a high return on investment.BUSINESS VALUE OF SECURITY AND CONTROL 10.12 2006 by Prentice HallSecurity Incidents Continue to Rise BUSINESS VALUE OF SECURITY AND CONTROL Figure 10-4Source: CERT Coordination Center, www.cert.org, accessed July 6, 2004.10.13 2006 by Prentice HallBUSINESS VALUE
11、 OF SECURITY AND CONTROLLegal and Regulatory Requirements for Electronic Records Management Electronic Records Management (ERM): Policies, procedures and tools for managing the retention, destruction, and storage of electronic records 10.14 2006 by Prentice HallBUSINESS VALUE OF SECURITY AND CONTROL
12、 Data Security and Control Laws: The Health Insurance Portability and Accountability Act (HIPAA) Gramm-Leach-Bliley Act Sarbanes-Oxley Act of 2002 10.15 2006 by Prentice Hall Electronic Evidence: Computer data stored on disks and drives, e-mail, instant messages, and e-commerce transactions Computer
13、 Forensics: Scientific collection, examination, authentication, preservation, and analysis of computer data for use as evidence in a court of lawBUSINESS VALUE OF SECURITY AND CONTROL Electronic Evidence and Computer Forensics 10.16 2006 by Prentice HallGeneral controls: Software and hardware Comput
14、er operations Data security Systems implementation process ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Types of Information Systems Controls 10.17 2006 by Prentice Hall Input Processing Output ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Application controls:10.18 20
15、06 by Prentice Hall Determines the level of risk to the firm if a specific activity or process is not properly controlledESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Risk Assessment: 10.19 2006 by Prentice Hall Acceptable Use Policy (AUP) Authorization policies ESTABLISHING A MANAGEM
16、ENT FRAMEWORK FOR SECURITY AND CONTROL Security Policy: Policy ranking information risks, identifying acceptable security goals, and identifying the mechanisms for achieving these goals10.20 2006 by Prentice HallESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Security Profiles for a Per
17、sonnel System Figure 10-510.21 2006 by Prentice Hall Downtime: Period of time in which a system is not operational Fault-tolerant computer systems: Redundant hardware, software, and power supply components to provide continuous, uninterrupted service High-availability computing: Designing to maximiz
18、e application and system availability ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Ensuring Business Continuity 10.22 2006 by Prentice Hall Load balancing: Distributes access requests across multiple servers Mirroring: Backup server that duplicates processes on primary server Recover
19、y-oriented computing: Designing computing systems to recover more rapidly from mishaps ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Ensuring Business Continuity (Continued)10.23 2006 by Prentice Hall Disaster recovery planning: Plans for restoration of computing and communications di
20、srupted by an event such as an earthquake, flood, or terrorist attack Business continuity planning: Plans for handling mission-critical functions if systems go down ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Ensuring Business Continuity (Continued)10.24 2006 by Prentice Hall MIS au
21、dit: Identifies all of the controls that govern individual information systems and assesses their effectiveness Security audits: Review technologies, procedures, documentation, training, and personnelESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Auditing: 10.25 2006 by Prentice HallES
22、TABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL Sample Auditors List of Control Weaknesses Figure 10-610.26 2006 by Prentice HallTECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Access Control Passwords Authentication:Access control: Consists of all the policies and procedures a company us
23、es to prevent improper access to systems by unauthorized insiders and outsiders Tokens, smart cards Biometric authentication10.27 2006 by Prentice Hall Firewalls: Hardware and software controlling flow of incoming and outgoing network traffic Intrusion detection systems: Full-time monitoring tools p
24、laced at the most vulnerable points of corporate networks to detect and deter intruders TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Firewalls, Intrusion Detection Systems, and Antivirus Software 10.28 2006 by Prentice Hall Antivirus software: Software that checks computer systems and drives for
25、the presence of computer viruses and can eliminate the virus from the infected area Wi-Fi Protected Access specification TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Firewalls, Intrusion Detection Systems, and Antivirus Software (Continued)10.29 2006 by Prentice HallTECHNOLOGIES AND TOOLS FOR SEC
26、URITY AND CONTROL A Corporate Firewall Figure 10-710.30 2006 by Prentice Hall Public key encryption: Uses two different keys, one private and one public. The keys are mathematically related so that data encrypted with one key can be decrypted using only the other key Message integrity: The ability t
27、o be certain that the message being sent arrives at the proper destination without being copied or changed TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Encryption and Public Key Infrastructure 10.31 2006 by Prentice Hall Digital signature: A digital code attached to an electronically transmitted
28、message that is used to verify the origin and contents of a message Digital certificates: Data files used to establish the identity of users and electronic assets for protection of online transactions Public Key Infrastructure (PKI): Use of public key cryptography working with a certificate authorit
29、y TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Encryption and Public Key Infrastructure (Continued)10.32 2006 by Prentice Hall Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS): protocols for secure information transfer over the Internet; enable client and server compute
30、r encryption and decryption activities as they communicate during a secure Web session. Secure Hypertext Transfer Protocol (S-HTTP): used for encrypting data flowing over the Internet; limited to Web documents, whereas SSL and TLS encrypt all data being passed between client and server.TECHNOLOGIES
31、AND TOOLS FOR SECURITY AND CONTROL Encryption and Public Key Infrastructure (Continued)10.33 2006 by Prentice HallTECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Public Key Encryption Figure 10-810.34 2006 by Prentice HallTECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL Digital Certificates Figure 10
32、-910.35 2006 by Prentice HallMANAGEMENT OPPORTUNITIES, CHALLENGES AND SOLUTIONS Management Opportunities: Creation of secure, reliable Web sites and systems that can support e-commerce and e-business strategies 10.36 2006 by Prentice HallDesigning systems that are neither overcontrolled nor undercon
33、trolledImplementing an effective security policy MANAGEMENT OPPORTUNITIES, CHALLENGES AND SOLUTIONS Management Challenges: 10.37 2006 by Prentice HallSecurity and control must become a more visible and explicit priority and area of information systems investment.Support and commitment from top management is required to show that security is indeed a corporate priority and vital to all aspects of the business.Security and control should be the responsibility of everyone in the organization. MANAGEMENT OPPORTUNITIES, CHALLENGES AND SOLUTIONS Solution Guidelines:
