management information systems, sixth edition

47
Management Information Systems, Sixth Edition Chapter 14: Risks, Security, and Disaster Recovery

Upload: ila-reed

Post on 31-Dec-2015

54 views

Category:

Documents


3 download

DESCRIPTION

Management Information Systems, Sixth Edition. Chapter 14: Risks, Security, and Disaster Recovery. Objectives. Describe the primary goals of information security Enumerate the main types of risks to information systems List the various types of attacks on networked systems - PowerPoint PPT Presentation

TRANSCRIPT

Page 1: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition

Chapter 14:

Risks, Security, and Disaster Recovery

Page 2: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 2

Objectives

• Describe the primary goals of information security

• Enumerate the main types of risks to information systems

• List the various types of attacks on networked systems

• Describe the types of controls required to ensure the integrity of data entry and processing and uninterrupted e-commerce

Page 3: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 3

Objectives (continued)

• Describe the various kinds of security measures that can be taken to protect data and ISs

• Improve the security of your personal information system and the information it stores

• Recognize online scams• Outline the principles of developing a recovery

plan• Explain the economic aspects of information

security

Page 4: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 4

Goals of Information Security

• Protecting IT resources is a primary concern• Securing corporate ISs is becoming increasingly

challenging• The major goals of information security are to:

– Reduce the risk of systems ceasing operation

– Maintain information confidentiality

– Ensure the integrity and reliability of data resources

– Ensure the uninterrupted availability of resources

– Ensure compliance with policies and laws

Page 5: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 5

Risks to Information Systems

• Downtime: the period of time during which an IS is not available

• Extremely expensive: average losses of:– $2,500/minute for CRM systems

– $7,800/minute for e-commerce applications

• $4 billion lost annually in the U.S. due to downtime

Page 6: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 6

Risks to Hardware

• #1 cause of system downtime is hardware failure• Major causes of damage to hardware include:

– Natural disasters• Fires, floods, earthquakes, hurricanes, tornadoes, and

lightning

– Blackouts and brownouts• Blackout: total loss of electricity• Brownout: partial loss of electricity• Uninterruptible power supply (UPS): backup power

– Vandalism• Deliberate destruction

Page 7: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 7

Risks to Data and Applications

• Data should be a primary concern because it is often a unique resource

• Data and applications are susceptible to disruption, damage, and theft

• The culprit in damage to software or data is almost always human

• Keystroke logging: records individual keystrokes• Social engineering: con artists pretend to be

service people, and ask for passwords• Identity theft: pretending to be another person

Page 8: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 8

Page 9: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 9

Risks to Data and Applications (continued)

• Risks to data include:– Alteration

– Destruction

– Web defacement

• Deliberate alteration or destruction is often done as a prank, but has a high cost

• The target may be a company’s Web site• Honeytoken: a bogus record in a networked

database used to combat hackers

Page 10: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 10

Risks to Data and Applications (continued)

• Honeypot: a server containing a mirrored copy of a database or a bogus database– Educates security officers about vulnerable points

• Virus: spreads from computer to computer• Worm: spreads in a network without human

intervention• Antivirus software: protects against viruses• Trojan horse: a virus disguised as legitimate

software

Page 11: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 11

Page 12: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 12

Risks to Data and Applications (continued)

• Logic bomb: software that is programmed to cause damage at a specific time

• Unintentional, nonmalicious damage can be caused by:– Human error

– Lack of adherence to backup procedures

– Poor training

– Unauthorized downloading and installation of software may cause damage

Page 13: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 13

Risks to Online Operations

• Many hackers try daily to interrupt online businesses

• Types of attacks include:– Unauthorized access

– Data theft

– Defacing of Web pages

– Denial of service

– Hijacking

Page 14: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 14

Denial of Service

• Denial of service (DoS): an attacker launches a large number of information requests– Slows down legitimate traffic to site

• Distributed denial of service (DDoS): an attacker launches a DoS attack from multiple computers– Usually launched from hijacked personal

computers called “zombies”

– No definitive cure for this

– A site can filter illegitimate traffic

Page 15: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 15

Computer Hijacking

• Hijacking: using some or all of a computer’s resources without the consent of its owner– Often done for making a DDoS attack

– Done by installing a software bot on the computer

– Main purpose of hijacking is usually to send spam

• Bots are planted by exploiting security holes in operating systems and communications software– A bot usually installs e-mail forwarding software

Page 16: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 16

Controls

• Controls: constraints and restrictions imposed on a user or a system– Controls can be used to secure against risks

– Controls are also used to ensure that nonsensical data is not entered

• Controls can reduce damage caused to systems, application, and data

Page 17: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 17

Controls (continued)

Page 18: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 18

Application Reliability and Data Entry Controls

• A reliable application is one that can resist inappropriate usage such as incorrect data entry or processing– The application should provide clear messages

when errors or deliberate misuses occur

• Controls also translate business policies into system features

Page 19: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 19

Backup

• Backup: periodic duplication of all data• Redundant Arrays of Independent Disks

(RAID): set of disks programmed to replicate stored data

• Data must be routinely transported off-site as protection from a site disaster

• Some companies specialize in data backup services or backup facilities for use in the event of a site disaster

Page 20: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 20

Access Controls• Access controls: measures taken to ensure only

authorized users have access to a computer, network, application, or data– Physical locks: lock the equipment in a secure

facility

– Software locks: determine who is authorized

• Three types of access controls:– What you know: access codes, such as user ID

and password

– What you have: requires special devices

– Who you are: unique physical characteristics

Page 21: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 21

Access Controls (continued)

• Access codes and passwords are usually stored in the OS or in a database

• Security card is more secure than a password– Allows two-factor access

• Biometric: uses unique physical characteristics such as fingerprints, retinal scans, or voiceprints

• Up to 50% of help desk calls are from people who have forgotten their passwords– Biometrics can eliminate these kinds of calls

Page 22: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 22

Atomic Transactions

• Atomic transaction: a set of indivisible transactions– All of the transactions in the set must be

completely executed, or none can be

– Ensures that only full entry occurs in all the appropriate files to guarantee integrity of the data

– Is also a control against malfunction and fraud

Page 23: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 23

Atomic Transactions (continued)

Page 24: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 24

Audit Trail

• Audit trail: a series of documented facts that help detect who recorded which transactions, at what time, and under whose approval– Sometimes automatically created using data and

timestamps

• Certain policy and audit trail controls are required in some countries

• Information systems auditor: a person whose job is to find and investigate fraudulent cases

Page 25: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 25

Security Measures

• Organizations can protect against attacks using various approaches, including:– Firewalls

– Authentication

– Encryption

– Digital signatures

– Digital certificates

Page 26: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 26

Firewalls and Proxy Servers• Firewall: the best defense against unauthorized

access over the Internet– Consists of hardware and software that blocks

access to computing resources– Firewalls are now routinely integrated into routers

• DMZ: demilitarized zone approach– One end of the network is connected to the trusted

network, and the other end to the Internet

• Proxy server: represents another server– Employs a firewall, and is usually placed between

the Internet and the trusted network

Page 27: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 27

Page 28: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 28

Authentication and Encryption

• Authentication: the process of ensuring that you are who you say you are

• Encryption: coding a message into an unreadable form

• Messages are encrypted and authenticated to ensure security

• A message may be text, image, sound, or other digital information

Page 29: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 29

Authentication and Encryption (continued)

Page 30: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 30

Authentication and Encryption (continued)

• Encryption programs scramble the transmitted information– Plaintext: the original message

– Ciphertext: the encoded message

• Encryption uses a mathematical algorithm and a key

• Key: a unique combination of bits that will decipher the ciphertext

• Public-key encryption: uses two keys, one public and one private

Page 31: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 31

Page 32: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 32

Authentication and Encryption (continued)

• Symmetric encryption: when the sender and the recipient use the same key

• Asymmetric encryption: both a public and a private key are used

• Transport Layer Security (TLS): a protocol for transactions on the Web that uses a combination of public key and symmetric key encryption

• HTTPS: the secure version of HTTP• Digital signature: a means to authenticate online

messages; implemented with public keys

Page 33: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 33

Page 34: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 34

Authentication and Encryption (continued)

• Message digest: unique fingerprint of file• Digital certificates: computer files that

associate one’s identity with one’s public key– Issued by certificate authority

• Certificate authority (CA): a trusted third party• A digital certificate contains its holder’s name, a

serial number, its expiration dates, and a copy of holder’s public key– Also contains the digital signature of the CA

Page 35: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 35

Page 36: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 36

The Downside of Security Measures

• Single sign-on (SSO): a user must enter his or her name/password only once

• Single sign-on saves employees time• Encryption slows down communication

– Every message must be encrypted and then decrypted

• IT specialists must clearly explain the implications of security measures to upper management

Page 37: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 37

Recovery Measures

• Security measures may reduce mishaps, but no one can control all disasters

• Preparation for uncontrolled disasters requires that recovery measures are in place

• Redundancy may be used– Very expensive, especially in distributed systems

• Other measures must be taken

Page 38: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 38

The Business Recovery Plan• Business recovery plan: a plan about how to

recover from a disaster– Also called disaster recovery plan, business

resumption plan, or business continuity plan

• Nine steps to develop a business recovery plan:1.Obtain management’s commitment to the plan

2.Establish a planning committee

3.Perform risk assessment and impact analysis

4.Prioritize recovery needs• Mission-critical applications: those without which

the business cannot conduct operations

Page 39: Management Information Systems, Sixth Edition

The Business Recovery Plan (continued)

• Nine steps to develop a business recovery plan (continued):5. Select a recovery plan

6. Select vendors

7. Develop and implement the plan

8. Test the plan

9. Continually test and evaluate

• The plan should include key personnel and their responsibilities

Management Information Systems, Sixth Edition 39

Page 40: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 40

Recovery Planning and Hot Site Providers

• Can outsource recovery plans to firms that specialize in disaster recover planning

• Hot sites: alternative sites that a business can use when a disaster occurs– Backup sites provide desks, computer systems,

and Internet links

Page 41: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 41

The Economics of Information Security

• Security measures should be regarded as analogous to insurance

• Spending for security measures should be proportional to the potential damage

• A business must assess the minimum acceptable rate of system downtime and ensure that the company can financially sustain the downtime

Page 42: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 42

How Much Security Is Enough Security?

• Two costs should be considered:– Cost of the potential damage– Cost of implementing a preventative measure

• As the cost of security measures increases, the cost of potential damage decreases– Companies try to find the optimal point

• The company must define what needs to be protected

• Security measures should never exceed the value of protected system

Page 43: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 43

How Much Security Is Enough Security? (continued)

Page 44: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 44

Calculating Downtime

• Businesses should try to minimize downtime, but the benefit of greater uptime must be compared to the added cost

• Mission-critical systems must be connected to an alternative source of power, duplicated with a redundant system, or both

• Many ISs are now interfaced with other systems– Interdependent systems have greater downtime

• Redundancy reduces downtime

Page 45: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 45

Summary

• The purpose of controls and security measures is to maintain the functionality of ISs

• Risks to ISs include risks to hardware, data, and networks, and natural disaster and vandalism

• Risks to data and applications include theft of information, identity theft, data alteration, data destruction, defacement of Web sites, viruses, worms, logic bombs, and nonmalicious mishaps

• Risks to online systems include denial of service and hijacking

Page 46: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 46

Summary (continued)

• Controls are used to minimize disruption• Access controls require information to be

entered before resources are made available• Atomic transactions ensure data integrity• Firewalls protect against Internet attacks• Encryption schemes scramble messages to

protect them on the Internet• A key is used to encrypt and decrypt messages

Page 47: Management Information Systems, Sixth Edition

Management Information Systems, Sixth Edition 47

Summary (continued)

• SSL, TLS, and HTTPS are encryption standards designed for the Web

• Keys and digital certificates can be purchased from a certificate authority

• Many organizations have business recovery plans, which may be outsourced

• Careful evaluation of the amount spent on security measures is necessary

• Redundancy reduces the probability of downtime• Governments are obliged to protect citizens

against crime and terrorism