Privacy Integrity, and Security of IT in the 21st Century
Sub Module 8-3 CIS 310 Organizational Responsibilities Governance, Managing, Securing and Controlling IT
IT Security Management
Starts with Management commitment and support It is applied the beginning of design and extends throughout the life of the system IT Security Management involves:
Security Policy User Information Configuration management Design Documentation and other activities to secure the organizations data and information assets
Security Extends through the life cycle even on the Net
Design Develop Implement Test Production Maintenance
1
Management involvement includes:
Determine which information is critical to the business Define who creates the critical information Specify who uses that information Determine what would happen if that critical information was stolen, corrupt or lost
Management Involvement includes: Cont.
Specify how long the company can operate without access to the critical data A Contingency Plan and Business Continuity Plan that works
IT Governance
Information Technology is a resource shared by all within an organization, therefore Governance is needed. IT Governance recognizes the need for security, privacy, control and management of this resource. As partners in governance, they assist in the prioritization, planning and support of these goals.
2
Management involvement does not include a Contingency Plan that works.
A) True B) False
Correct - Click anywhere to continue Your answer:
Incorrect - Click anywhere to continue
You did not answer this You answered this correctly! question completely The correct answer is: Try again
Submit
Clear
Information System Security Managerial Techniques Assessing Risk Security Audit identifies all aspects of information systems and business processes that use them Risk Analysis assesses the value of assets being protected Alternatives based on Risk Analysis:
Risk Reduction implementing active counter measures to protect systems (e.g. firewalls) Risk Acceptance implementing no counter measures Risk Transference transferring riskbuying insurance
Controlling Access Keeping information safe by only allowing access to those that require it to do their jobs Authentication verifying identity before granting access (e.g. passwords) Access Control Granting access to only those system areas where the user is authorized (e.g. accounting)
Controls and Authentication
3
Information System Security Managerial Techniques Organizational Policies and Procedures Acceptable Use Policies formally document how systems should be used, for what, and penalties for non-compliance Backups and Disaster Recovery Backups taking periodic snapshots of critical systems data and storing in a safe place or system (e.g. backup tape) Disaster Recovery Plans spell out detailed procedures to be used by the organization to restore access to critical business systems (e.g. viruses or fire) Disaster Recovery executing Disaster Recovery procedures using backups to restore the system to the last backup if it was totally lost
Standards and Risk
Authentication means verifying identity before granting access (e.g. passwords) A) True B) False
Correct - Click anywhere to continue Your answer:
Incorrect - Click anywhere to continue
You did not answer this You answered this correctly! question completely The correct answer is: Try again
Submit
Clear
4
Securing and Controlling
Issues confronting organizations range from:
Spam Cookies Viruses Spyware and these all cost organizations money in lost productivity
Also, who has access and to what and why?
Information Property Gathering and Uses Spam (see Chapter 4 for definition) This unsolicited e-mail can come from reputable sites selling your information. Possible problems from spam include: Viruses in attachments or links Added to other spam lists by responding Slows systems by taking up resources disk space Cookies These files stored on a computer do have legitimate uses but they also can: Store and transmit information about online habits including, sites visited, purchases made, etc. Prevent accessing sites when cookies are refused Collect and combine information with other information to build a personal profile to be sold
Information Property Gathering and Uses Spyware These stealth computer applications are installed and then collect information about individuals without their knowledge. Currently this technology is not illegal Spyware Issues Spyware applications collect and transmit, or use, this information locally in several ways including: Sale of information to online marketers (spammers) Illegal uses such as identity theft Modify user experience to market to the user by presenting ad banners, pop-ups, etc. (Adware)
5
Information Accessibility
Information Accessibility Concerned with defining what information a person or organization has the right to obtain about others and how that information is used Who has access? Besides personal access, other parties have the legal right to access and view information private including: Government using advanced software packages (e.g Carnivore), e-mail traffic and all online activity can be monitored in real-time or after the fact Employers they can legally limit, monitor or access activities on company-owned computers or networks as long as policy has been distributed to employees
Information Access Example of Carnivore
Spyware are stealth computer applications which are installed and then collect information about individuals without their knowledge.
A) True B) False
Correct - Click anywhere to continue Your answer:
Incorrect - Click anywhere to continue
You did not answer this You answered this correctly! question completely The correct answer is: Try again
Submit
Clear
6
The Need of Ethical Behavior
Ethical Behavior Illegal versus unethical behavior is an information age concern. Though activities are not explicitly illegal, questions exist of whether they are unethical such as: Photograph manipulation/modification in this circumstance, the photograph not longer reflects absolute reality Unauthorized use of computers at work or at school, stealing time for personal business or use Information collection by companies compiling information to sell for profit
Responsible Computer Use
Guidelines In area of ethics, we rely on guidelines to guide behavior. These guidelines can come from many organizations The Computer Ethics Institute developed these guidelines for ethical computer use that prohibit the following behaviors:
Using a computer to harm others Interfering with other peoples computer work Snooping in other peoples files Using a computer to steal Using a computer to bear false witness Copying or using proprietary software without paying for it Using other peoples computer resources without authorization or compensation Appropriating other peoples intellectual output
Responsible Computer Use
The guidelines from the Computer Ethics Institute also recommend the following when creating programs or using computers: Thinking about the social consequences of programs you write and systems you design (e.g Napster, or a piece of Spyware) Using computers in way that show consideration and respect for others (e.g. proliferation of viruses, instant messaging, etc.)
7
Review
IT Security Starts with Management Commitment and Support IT Governance recognizes the need for security, privacy, control and management of this resource. As partners in governance, they assist in the prioritization, planning and support of these goals.
Review (Cont)
Assessing Risk includes:
Security Audit identifies all aspects of information systems and business processes that use them Risk Analysis assesses the value of assets being protected
Securing and Controlling focuses on protection against malicious attacks and who has proper access Ethics is an organization issue which requires education, communication, monitoring and enforcement. Even in using IT, one must do so with ethics in mind and becoming a responsible Computer User.
IT Securit...