管理信息系统（第11版）课件：Securing Information Systems

SecuringInformationSystemsSTUDENTLEARNINGOBJECTIVESEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsWhyareinformationsystemsvulnerabletodestruction,error,andabuse?Whatisthebusinessvalueofsecurityandcontrol?Whatarethecomponentsofanorganizationalframeworkforsecurityandcontrol?Evaluatethemostimportanttoolsandtechnologiesforsafeguardinginformationresources.STUDENTLEARNINGOBJECTIVESEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsLearningTracksTheBoomingJobMarketinITSecurityTheSarbanesOxleyActComputerForensicsGeneralandApplicationControlsforInformationSystemsManagementChallengesofSecurityandControlSoftwareVulnerabilityandReliabilityVideoCasesCase1:StuxnetandCyberwarfareCase2:IBMZoneTrustedInformationChannel(ZTIC)InstructionalVideo1:SonyPlayStationHacked;DataStolenfrom77MillionUsersInstructionalVideo2:ZapposWorkingtoCorrectOnlineSecurityBreachInstructionalVideo3:MeettheHackers:AnonymousStatementonHackingSONYYou’reonLinkedIn?WatchOut!LinkedIn:Oneoftheworld’slargestsocialnetworkswithmorethan225millionusersTargetforhackersaswidelyused“social”siteOutdatedsecurityprocessesProblem

Securitybreachresultsinexposureof6.5millionpasswordsReputationaldamageMultimilliondollarlawsuitEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsAlthoughLinkedIn’s

securitypolicieswereadequatesomeyearsago,in2012theywereveryinadequateMissing:ChiefsecurityofficerEvenminimalpasswordprotectionandencryptionPasswordsaltingtechniquesIllustrates:LackofliabilityforcompaniesinsocialtechnologyservicesDemonstrates:NeedforupdatingsecuritypoliciescontinuouslyEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsYou’reonLinkedIn?WatchOut!EssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsYou’reonLinkedIn?WatchOut!SystemVulnerabilityandAbuseAnunprotectedcomputerconnectedtoInternetmaybedisabledwithinsecondsSecurity:Policies,procedures,andtechnicalmeasuresusedtopreventunauthorizedaccess,alteration,theft,orphysicaldamagetoinformationsystemsControls:Methods,policies,andorganizationalproceduresthatensuresafetyoforganization’sassets;accuracyandreliabilityofitsaccountingrecords;andoperationaladherencetomanagementstandardsEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsWhySystemsAreVulnerableHardwareproblemsBreakdowns,configurationerrors,damagefromimproperuseorcrimeSoftwareproblemsProgrammingerrors,installationerrors,unauthorizedchangesDisastersPowerfailures,flood,fires,andsoonUseofnetworks,computersoutsideoffirm’scontrolDomesticoroffshoreoutsourcingvendorsMobiledevicesSystemVulnerabilityandAbuseEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsContemporarySecurityChallengesandVulnerabilitiesThearchitectureofaWeb-basedapplicationtypicallyincludesaWebclient,aserver,andcorporateinformationsystemslinkedtodatabases.Eachofthesecomponentspresentssecuritychallengesandvulnerabilities.Floods,fires,powerfailures,andotherelectricalproblemscancausedisruptionsatanypointinthenetwork.SystemVulnerabilityandAbuseEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsFigure8-1InternetvulnerabilitiesNetworkopentoanyoneSizeofInternetmeansabusescanhavewideimpactUseoffixedInternetaddresseswithpermanentconnectionstoInterneteasesidentificationbyhackersE-mailattachments,filedownloading,andsharingE-mailusedfortransmittingtradesecretsIMmessageslacksecurity,canbeeasilyinterceptedSystemVulnerabilityandAbuseEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsWirelesssecuritychallengesRadiofrequencybandseasytoscanSSIDs(servicesetidentifiers)Identifyaccesspoints.Broadcastmultipletimes.WardrivingEavesdroppersdrivebybuildingsandtrytointerceptnetworktrafficWithaccesstoSSID,hasaccesstonetwork’sresourcesRogueaccesspointsSystemVulnerabilityandAbuseEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsWi-FiSecurityChallengesFigure8-2ManyWi-Finetworkscanbepenetratedeasilybyintrudersusingsnifferprogramstoobtainanaddresstoaccesstheresourcesofanetworkwithoutauthorization.SystemVulnerabilityandAbuseEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsMaliciousSoftware:Viruses,Worms,TrojanHorses,andSpywareMalwareVirusesRoguesoftwareprogramthatattachesitselftoothersoftwareprogramsordatafilesinordertobeexecutedWormsIndependentcomputerprogramsthatcopythemselvesfromonecomputertoothercomputersoveranetworkTrojanhorsesSoftwareprogramthatappearstobebenignbutthendoessomethingotherthanexpected.SystemVulnerabilityandAbuseEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsMaliciousSoftware:Viruses,Worms,TrojanHorses,andSpywareSQLinjectionattacksSpywareSmallprogramsinstallthemselvessurreptitiouslyoncomputerstomonitoruserWebsurfingactivityandserveupadvertisingKeyloggersRecordeverykeystrokeoncomputertostealserialnumbers,passwords,launchInternetattacksSystemVulnerabilityandAbuseEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsHackersandComputerCrimeSystemVulnerabilityandAbuseHackersversuscrackersActivitiesinclude:SystemintrusionTheftofgoodsandservicesSystemdamageCybervandalism—Intentionaldisruption,defacement,destructionofWebsiteorcorporateinformationsystemEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsHackersandComputerCrimeSystemVulnerabilityandAbuseSpoofingMisrepresentingoneselfbyusingfakee-mailaddressesormasqueradingassomeoneelseRedirectingWeblinktoaddressdifferentfromintendedone,withsitemasqueradingasintendeddestinationSnifferEavesdroppingprogramthatmonitorsinformationtravelingovernetworkEnableshackerstostealproprietaryinformationsuchase-mail,companyfiles,andsoonEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsHackersandComputerCrimeSystemVulnerabilityandAbuseDenial-of-serviceattacks(DoS)Floodingserverwiththousandsoffalserequeststocrashthenetwork.Distributeddenial-of-serviceattacks(DDoS)UseofnumerouscomputerstolaunchaDoSBotnetsNetworksof“zombie”PCsinfiltratedbybotmalwareEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsHackersandComputerCrimeSystemVulnerabilityandAbuseComputercrimeAnyviolationsofcriminallawthatinvolveaknowledgeofcomputertechnologyfortheirperpetration,investigation,orprosecutionComputermaybetargetofcrime:BreachingconfidentialityofprotectedcomputerizeddataAccessingacomputersystemwithoutauthorityComputermaybeinstrumentofcrime:TheftoftradesecretsUsinge-mailforthreatsorharassmentEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsReadtheInteractiveSessionandthendiscussthefollowingquestions:Describethesecurityvulnerabilitiesexploitedbythehackers.Whatpeople,organizational,andtechnologyfactorscontributedtotheseproblems?Whatsolutionsareavailableforthisproblem?Howdifficultaretheytoimplement?Why?InteractiveSession:OrganizationsThe21stCenturyBankHeistSystemVulnerabilityandAbuseEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsHackersandComputerCrimeSystemVulnerabilityandAbuseIdentitytheftTheftofpersonalinformation(socialsecurityID,driver’slicense,orcreditcardnumbers)toimpersonatesomeoneelsePhishingSettingupfakeWebsitesorsendinge-mailmessagesthatlooklikelegitimatebusinessestoaskusersforconfidentialpersonaldataEviltwinsWirelessnetworksthatpretendtooffertrustworthyWi-FiconnectionstotheInternetEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsHackersandComputerCrimeSystemVulnerabilityandAbusePharmingRedirectsuserstoabogusWebpage,evenwhenindividualtypescorrectWebpageaddressintohisorherbrowserClickfraudFraudulentclicksononlineadsGlobalthreatsCyberterrorismCyberwarfareEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsInternalThreats:EmployeesSecuritythreatsoftenoriginateinsideanorganization.InsideknowledgeSloppysecurityproceduresUserlackofknowledgeSocialengineering:TrickingemployeesintorevealingtheirpasswordsbypretendingtobelegitimatemembersofthecompanyinneedofinformationSystemVulnerabilityandAbuseEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsSoftwareVulnerabilitySystemVulnerabilityandAbuseCommercialsoftwarecontainsflawsthatcreatesecurityvulnerabilities.Hiddenbugs(programcodedefects)ZerodefectscannotbeachievedbecausecompletetestingisnotpossiblewithlargeprogramsFlawscanopennetworkstointrudersPatches:SmallpiecesofsoftwaretorepairflawsreleasedbyvendorsHowever,amountofsoftwareinusecanmeanexploitscreatedfasterthanpatchescanbereleasedEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsFailedcomputersystemscanleadtosignificantortotallossofbusinessfunction.Firmsnowmorevulnerablethanever.Asecuritybreachmaycutintofirm’smarketvaluealmostimmediately.Inadequatesecurityandcontrolsalsobringforthissuesofliability.BusinessValueofSecurityandControlEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsLegalandRegulatoryRequirementsforElectronicRecordsManagementBusinessValueofSecurityandControlFirmsfacenewlegalobligationsfortheretentionandstorageofelectronicrecordsaswellasforprivacyprotectionHIPAA:medicalsecurityandprivacyrulesandproceduresGramm-Leach-BlileyAct:requiresfinancialinstitutionstoensurethesecurityandconfidentialityofcustomerdataSarbanes-OxleyAct:imposesresponsibilityoncompaniesandtheirmanagementtosafeguardtheaccuracyandintegrityoffinancialinformationthatisusedinternallyandreleasedexternallyEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsElectronicEvidenceandComputerForensicsEvidenceforwhitecollarcrimesoftenfoundindigitalformDatastoredoncomputerdevices,e-mail,instantmessages,e-commercetransactionsPropercontrolofdatacansavetime,moneywhenrespondingtolegaldiscoveryrequestComputerforensics:Scientificcollection,examination,authentication,preservation,andanalysisofdatafromcomputerstoragemediaforuseasevidenceincourtoflawIncludesrecoveryofambientandhiddendataBusinessValueofSecurityandControlEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsEstablishingaFrameworkforSecurityandControlInformationsystemscontrolsGeneralcontrolsGoverndesign,security,anduseofcomputerprogramsandsecurityofdatafilesingeneralthroughoutorganization’sinformationtechnologyinfrastructure.Applytoallcomputerizedapplications.Combinationofhardware,software,andmanualprocedurestocreateoverallcontrolenvironment.EssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsEstablishingaFrameworkforSecurityandControlTypesofgeneralcontrolsSoftwarecontrolsHardwarecontrolsComputeroperationscontrolsDatasecuritycontrolsImplementationcontrolsAdministrativecontrolsEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsEstablishingaFrameworkforSecurityandControlApplicationcontrolsSpecificcontrolsuniquetoeachcomputerizedapplication,suchaspayrollororderprocessing.Includebothautomatedandmanualprocedures.Ensurethatonlyauthorizeddataarecompletelyandaccuratelyprocessedbythatapplication.Include:InputcontrolsProcessingcontrolsOutputcontrolsEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsEstablishingaFrameworkforSecurityandControlRiskassessmentDetermineslevelofrisktofirmifspecificactivityorprocessisnotproperlycontrolledTypesofthreatProbabilityofoccurrenceduringyearPotentiallosses,valueofthreatExpectedannuallossEXPOSUREPROBABILITYLOSSRANGEEXPECTEDANNUALLOSSPowerfailure30%$5K–$200K$30,750Embezzlement5%$1K–$50K$1,275Usererror98%$200–$40K$19,698EssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsEstablishingaFrameworkforSecurityandControlSecuritypolicyRanksinformationrisksIdentifiesacceptablesecuritygoalsIdentifiesmechanismsforachievingthesegoalsDrivesotherpoliciesAcceptableusepolicy(AUP)AuthorizationpoliciesProvisionsforidentitymanagementEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsEstablishingaFrameworkforSecurityandControlIdentitymanagementBusinessprocessandtechnologiesforidentifyingvalidusersofsystemCreatesdifferentlevelsorrolesofsystemuserandaccessAllowseachuseraccessonlytothoseportionsofsystemunderthatuserroleEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsSecurityProfilesforaPersonnelSystemFigure8-3Thesetwoexamplesrepresenttwosecurityprofilesordatasecuritypatternsthatmightbefoundinapersonnelsystem.Dependingonthesecurityprofile,auserwouldhavecertainrestrictionsonaccesstovarioussystems,locations,ordatainanorganization.EssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsEstablishingaFrameworkforSecurityandControlEstablishingaFrameworkforSecurityandControlDisasterrecoveryplanning:DevisesplansforrestorationofdisruptedservicesBusinesscontinuityplanning:FocusesonrestoringbusinessoperationsafterdisasterBothtypesofplansneededtoidentifyfirm’smostcriticalsystemsBusinessimpactanalysistodetermineimpactofanoutageManagementmustdeterminewhichsystemsrestoredfirstDisasterRecoveryPlanningandBusinessContinuityPlanningEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsEstablishingaFrameworkforSecurityandControlTheRoleofAuditingMISauditExaminesfirm’soverallsecurityenvironmentaswellascontrolsgoverningindividualinformationsystemsReviewstechnologies,procedures,documentation,training,andpersonnelMayevensimulatedisastertotestresponseoftechnology,ISstaff,otheremployeesListsandranksallcontrolweaknessesandestimatesprobabilityoftheiroccurrence.AssessesfinancialandorganizationalimpactofeachthreatEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsSampleAuditor’sListofControlWeaknessesFigure8-4Thischartisasamplepagefromalistofcontrolweaknessesthatanauditormightfindinaloansysteminalocalcommercialbank.Thisformhelpsauditorsrecordandevaluatecontrolweaknessesandshowstheresultsofdiscussingthoseweaknesseswithmanagement,aswellasanycorrectiveactionstakenbymanagement.EssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsEstablishingaFrameworkforSecurityandControlIdentityManagementandAuthenticationTechnologiesandToolsforProtectingInformationResourcesAuthenticationPasswordsystemsTokensSmartcardsBiometricauthenticationFingerprints,irises,voicesEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsFirewall:CombinationofhardwareandsoftwarethatpreventsunauthorizedaccesstonetworkTechnologiesinclude:PacketfilteringStatefulinspectionNetworkaddresstranslation(NAT)ApplicationproxyfilteringFirewalls,IntrusionDetectionSystems,andAntivirusSoftwareEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsTechnologiesandToolsforProtectingInformationResourcesACorporateFirewallFigure8-5Thefirewallisplacedbetweenthefirm’sprivatenetworkandthepublicInternetoranotherdistrustednetworktoprotectagainstunauthorizedtraffic.EssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsTechnologiesandToolsforProtectingInformationResourcesIntrusiondetectionsystems:Monitorhotspotsoncorporatenetworkstodetectanddeterintruders.Examineeventsastheyarehappeningtodiscoverattacksinprogress.Antivirusandantispywaresoftware:Checkcomputersforpresenceofmalwareandcanofteneliminateitaswell.Requirecontinualupdating.UnifiedThreatManagement(UTM)systemsEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsTechnologiesandToolsforProtectingInformationResourcesWEPsecuritycanbeimproved:ActivatingitAssigninguniquenametonetwork’sSSIDUsingitwithVPNtechnologyWi-FiAlliancefinalizedWPA2specification,replacingWEPwithstrongerstandardsContinuallychangingkeysEncryptedauthenticationsystemwithcentralserverSecuringWirelessNetworksEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsTechnologiesandToolsforProtectingInformationResourcesEncryption:TransformingtextordataintociphertextthatcannotbereadbyunintendedrecipientsTwomethodsforencryptiononnetworksSecureSocketsLayer(SSL)andsuccessorTransportLayerSecurity(TLS)SecureHypertextTransferProtocol(S-HTTP)EncryptionandPublicKeyInfrastructureEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsTechnologiesandToolsforProtectingInformationResourcesTwomethodsofencryptionSymmetrickeyencryptionSenderandreceiverusesingle,sharedkeyPublickeyencryptionUsestwo,mathematicallyrelatedkeys:publickeyandprivatekeySenderencryptsmessagewithrecipient’spublickeyRecipientdecryptswithprivatekeyEncryptionandPublicKeyInfrastructureEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsTechnologiesandToolsforProtectingInformationResourcesPublicKeyEncryptionFigure8-6Apublickeyencryptionsystemcanbeviewedasaseriesofpublicandprivatekeysthatlockdatawhentheyaretransmittedandunlockthedatawhentheyarereceived.Thesenderlocatestherecipient’spublickeyinadirectoryandusesittoencryptamessage.ThemessageissentinencryptedformovertheInternetoraprivatenetwork.Whentheencryptedmessagearrives,therecipientuseshisorherprivatekeytodecryptthedataandreadthemessage.EssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsTechnologiesandToolsforProtectingInformationResourcesDigitalcertificate:DatafileusedtoestablishtheidentityofusersandelectronicassetsforprotectionofonlinetransactionsUsescertificationauthority(CA)tovalidateauser’sidentityCAverifiesuser’sidentity,storesinformationinCAserver,whichgeneratesencrypteddigitalcertificatecontainingownerIDinformationandcopyofowner’spublickeyPublickeyinfrastructure(PKI)UseofpublickeycryptographyworkingwithcertificateauthorityWidelyusedine-commerceEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsTechnologiesandToolsforProtectingInformationResourcesDigitalCertificatesFigure8-7Digitalcertificateshelpestablishtheidentityofpeopleorelectronicassets.Theyprotectonlinetransactionsbyprovidingsecure,encrypted,onlinecommunication.EssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsTechnologiesandToolsforProtectingInformationResourcesOnlinetransactionprocessingrequires100percentavailability,nodowntime.Fault-tolerantcomputersystemsForcontinuousavailability,forexample,stockmarketsContainredundanthardware,software,andpowersupplycomponentsthatcreateanenvironmentthatprovidescontinuous,uninterruptedserviceHigh-availabilitycomputingHelpsrecoverquicklyfromcrashMinimizes,doesnoteliminate,downtimeEnsuringSystemAvailabilityEssentialsofManagementInformationSystemsChapter8SecuringInformationSystemsTechnologiesandToolsforProtectingInformationResourcesRecovery-orientedcomputingDesigningsystemsthatrecoverquicklywithcapabilitiestohelpoperatorspinpointandcorrectfault