Information Systems Security

Chapter 5

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 51
 Learning Objective 1

Describe general approaches to

analyzing vulnerabilities and
threats in information systems.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 52
 Overview

The information security system is the

subsystem of the organization that
controls the special risks associated
with computer-based information systems.

The information security system has

the basic elements of any information
system, such as hardware, databases,
procedures, and reports.
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 53
 The Information Security
System Life Cycle

Life-cycle Phase Objective

Analyze system vulnerabilities
Systems analysis in terms of relevant threats and
their associated loss exposure.
Design security measures and
Systems design contingency plans to control
the identified loss exposures.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 54
 The Information Security
System Life Cycle

Life-cycle Phase Objective

Systems Implement the security
implementation measures as designed.
Operate the system and
Systems operation,
assess its effectiveness and
evaluation,
efficiency. Make changes
and control
as circumstances require.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 55
 The Information Security
System in the Organization

The information security system must be

managed by a chief security officer (CSO).

This individual should report directly

to the board of directors in order to
maintain complete independence.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 56
 Analyzing Vulnerabilities
and Threats

Quantitative approach
to risk assessment

Qualitative approach

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 57
 Analyzing Vulnerabilities
and Threats

Cost of an individual loss

Likelihood of its occurrence

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 58
 Analyzing Vulnerabilities
and Threats

Identifying the relevant costs per loss and

the associated likelihoods can be difficult.

Estimating the likelihood of a given

failure requires predicting the future,
which is very difficult.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 59
 Analyzing Vulnerabilities
and Threats

The systems vulnerabilities and

threats are subjectively ranked in
order of their contribution to the
companys total loss exposure.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 10
 Analyzing Vulnerabilities
and Threats

business interruption
loss of software
loss of data
loss of hardware
loss of facilities
loss of service and personnel

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 11
 Learning Objective 2

Identify active and passive

threats to information systems.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 12
 Vulnerabilities and Threats

What is a vulnerability?
A vulnerability is a
weakness in a system.
What is a threat?
A threat is a potential
exploitation of a vulnerability.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 13
 Vulnerabilities and Threats

Active threats

Passive threats

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 14
 Individuals Posing a Threat
to the Information System

Groups of individuals that could

be involved in an information
systems attack:

Information systems personnel

Users Intruders

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 15
 Individuals Posing a Threat
to the Information System

computer maintenance persons

programmers
network operators
information systems administrative
personnel
data control clerks

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 16
 Individuals Posing a Threat
to the Information System

Users are composed of heterogeneous

groups of people. Their functional
area does not lie in data processing.

An intruder is anyone who accesses

equipment, electronic data, or files
without proper authorization.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 17
 Individuals Posing a Threat
to the Information System
A hacker is an intruder who attacks
a system for fun and challenge.
What are other types of intruders?
unnoticed intruders
wiretappers
piggybackers
impersonating intruders
eavesdroppers
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 18
 Active Threats to
Information Systems

Input manipulation Sabotage

Program alteration
Misappropriation
or theft of
Direct file alteration
information
resources
Data theft

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 19
 Active Threats to
Information Systems

In most cases of computer fraud,

manipulation of input
is the method used.

Program alteration is perhaps

the least common method used
to commit computer fraud.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 20
 Active Threats to
Information Systems

A direct file alteration occurs when individuals

find ways to bypass the normal process
for inputting data into computer programs.

Data theft is a serious problem in business today.

What are some methods of computer sabotage?

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 21
 Active Threats to
Information Systems

Logic bomb

Trojan horse

Virus program

Denial of service attack

Defacing the companys Web site

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 22
 Active Threats to
Information Systems

What is a worm?

It is a type of virus that spreads

itself over a computer network.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 23
 Active Threats to
Information Systems

One type of misappropriation

of computer resources exists
when employees use company
computers resources for
their own business.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 24
 Learning Objective 3

Identify key aspects of an

information security system.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 25
 The Information System
Security System

Security measures focus on

preventing and detecting threats.

Contingency plans focus on

correcting the effects of threats.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 26
 The Control Environment

Management philosophy
and operating style

Organization structure

Board of directors
and its committees

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 27
 The Control Environment

Management control activities

Internal audit function

Personnel policies and practices

External influences

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 28
 Controls for Active Threats

Site-access controls

System-access controls

File-access controls

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 29
 Controls for Active Threats

The objective of site-access controls

is to physically separate unauthorized
individuals from computer resources.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 30
 Controls for Active Threats

TV monitor Telephone Locked door

Locked door
(opened from
inside vault) LOBBY
Service
Locked door
window
(entrance)
Intercom Data
to vault archive
Magnet
Scanner detector INNER
VAULT

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 31
 Controls for Active Threats

These controls authenticate users by using

such means as user IDs, passwords,
IP addresses, and hardware devices.

It is often desirable to withhold

administrative rights from
individual PC users.
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 32
 Controls for Active Threats

The most fundamental file-access control

is the establishment of authorization guidelines
and procedures for accessing and altering files.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 33
 Controls for Passive Threats

Fault-tolerant systems use redundant components.

If one part of the system fails, a redundant part

immediately takes over, and the system
continues operating with little or no interruption.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 34
 Controls for Passive Threats

Full backups

Incremental backups

Differential backups

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 35
 Internet Security

Internet-related vulnerabilities may

arise from weaknesses in five areas.

1. the operating system or its configuration

2. the Web server or its configuration
3. the private network and its configuration
4. various server programs
5. general security procedures

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 36
 Learning Objective 4

Discuss contingency planning

and other disaster risk
management practices.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 37
 Disaster Risk Management

Disaster risk management is essential

to ensure continuity of operations
in the event of a catastrophe.

Prevention Contingency
planning planning

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 38
 Disaster Risk Management

Natural disaster 30%

Deliberate actions 45%
Human error 25%

A large percentage of disasters

can be mitigated or avoided.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 39
 Disaster Risk Management

A disaster recovery plan must be implemented

at the highest levels in the company.

The first step in developing a disaster recovery

plan should be obtaining the support of senior
management and setting up a planning committee.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 40
 Disaster Risk Management

The design of the plan should

include three major components.

What are these components?

Assess the companys critical needs.

List priorities for recovery.
Establish recovery strategies and procedures.

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 41
 Disaster Risk Management

A complete set of recovery strategies

should take into account the following:
emergency response center
escalation procedures
alternate processing arrangements
personnel relocation and replacements plans
salvage plan
plan for testing and maintaining the system
2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 42
 End of Chapter 5

2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5 43