managing MIS security control
-
Upload
bsnu-shrestha -
Category
Documents
-
view
172 -
download
2
Transcript of managing MIS security control
MIS MIS
SECURITY AND CONTROLSECURITY AND CONTROL
OBJECTIVES
• Explain why information systems need special protection from destruction, error, and abuse
• Assess the business value of security and control
• Evaluate elements of an organizational and managerial framework for security and control
• Evaluate the most important tools and technologies for safeguarding information resources
• Identify the challenges posed by information systems security and control and management solutions
OBJECTIVES
• Designing systems that are neither over-controlled nor under-controlled
• Applying quality assurance standards in large systems projects
MANAGEMENT CHALLENGES
SYSTEM VULNERABILITY AND ABUSE
Why Systems Are Vulnerable
Contemporary Security Challenges and Vulnerabilities
Figure 10-1
SYSTEM VULNERABILITY AND ABUSE
Telecommunication Network Vulnerabilities
• Use of fixed Internet addresses through use of cable modems or DSL
• Lack of encryption with most Voice over IP (VoIP)
• Widespread use of e-mail and instant messaging (IM)
SYSTEM VULNERABILITY AND ABUSE
Internet Vulnerabilities:
Internal Threats: EmployeesInternal Threats: Employees
• Security threats often originate inside an organization
• Social engineering
System Vulnerability and Abuse
Software VulnerabilitySoftware Vulnerability
• Commercial software contains flaws that create security vulnerabilities
• Patches
• Radio frequency bands are easy to scan
• The service set identifiers (SSID) identifying the access points broadcast multiple times
SYSTEM VULNERABILITY AND ABUSE
Wireless Security Challenges:
SYSTEM VULNERABILITY AND ABUSE
Wi-Fi Security Challenges
Figure 10-2
• Computer viruses, worms, trojan horses
• Spyware
• Spoofing and Sniffers
• Denial of Service (DoS) Attacks
• Identity theft
• Cyberterrorism and Cyberwarfare
• Vulnerabilities from internal threats (employees); software flaws
SYSTEM VULNERABILITY AND ABUSE
Malicious Software: Viruses, Worms, Trojan Horses
Hackers and Cybervandalism
• DisasterDisasterDestroys computer hardware, programs, data Destroys computer hardware, programs, data
files, and other equipment files, and other equipment
• SecuritySecurityPrevents unauthorized access, alteration, theft, Prevents unauthorized access, alteration, theft,
or physical damageor physical damage
• ErrorsErrorsCause computers to disrupt or destroy Cause computers to disrupt or destroy
organization’s record-keeping and operationsorganization’s record-keeping and operations
SYSTEM VULNERABILITY AND ABUSE
Concerns for System Builders and Users
• BugsBugsProgram code defects or errorsProgram code defects or errors
• Maintenance NightmareMaintenance NightmareMaintenance costs high due to Maintenance costs high due to
organizational change, software organizational change, software complexity, and faulty system analysis complexity, and faulty system analysis and designand design
SYSTEM VULNERABILITY AND ABUSE
SYSTEM VULNERABILITY AND ABUSE
Points in the Processing Cycle where Errors can Occur
Figure 14-2
Business value of control
ControlsControls
• Methods, policies, and procedures Methods, policies, and procedures
• Ensures protection of organization’s assetsEnsures protection of organization’s assets
• Ensures accuracy and reliability of records, Ensures accuracy and reliability of records, and operational adherence to management and operational adherence to management standardsstandards
Overview
• Failed computer systems can lead to a significant or total loss of business function
• Firms are now more vulnerable than they have ever been
• A security breach may cut into a firm’s market value almost immediately
• Inadequate security and controls also bring forth issues of liability
Business Value of Security and Control
• Inadequate security and control may create serious legal liability.
• Businesses must protect not only their own information assets but also those of customers, employees, and business partners. Failure to do so can lead to costly litigation for data exposure or theft.
• A sound security and control framework that protects business information assets can thus produce a high return on investment.
BUSINESS VALUE OF SECURITY AND CONTROL
BUSINESS VALUE OF SECURITY AND CONTROL
Legal and Regulatory Requirements for Electronic Records Management
• Electronic Records Management (ERM): Policies,
procedures and tools for managing the retention,
destruction, and storage of electronic records
• Electronic Evidence: Computer data stored on disks
and drives, e-mail, instant messages, and e-
commerce transactions
• Computer Forensics: Scientific collection,
examination, authentication, preservation, and
analysis of computer data for use as evidence in a
court of law
BUSINESS VALUE OF SECURITY AND CONTROL
Electronic Evidence and Computer Forensics
Control Systems
General controlsGeneral controlsEstablish framework for controlling design, Establish framework for controlling design,
security, and use of computer programs security, and use of computer programs • Include software, hardware, computer Include software, hardware, computer
operations, data security, implementation, and operations, data security, implementation, and administrative controlsadministrative controls
• Types of General controlsTypes of General controls1.1. Software and hardware Software and hardware 2.2. Computer operations Computer operations 3.3. Data security Data security 4.4. Systems implementation process Systems implementation process
CREATING A CONTROL ENVIRONMENT
Application controlsApplication controls
• Unique to each computerized applicationUnique to each computerized application
• Include input, processing, and output controlsInclude input, processing, and output controls
CREATING A CONTROL ENVIRONMENT
Establishing a Framework for Security and Control
• Downtime
• Fault-tolerant computer systems
• High-availability computing
• Recovery-oriented computing
• Disaster recovery planning
• Business continuity planning
• Security outsourcing (managed security service providers)
• Downtime: Period of time in which a system is not
operational
• Fault-tolerant computer systems: Redundant
hardware, software, and power supply components to
provide continuous, uninterrupted service
• High-availability computing: Designing to maximize
application and system availability
• High-availability computingHigh-availability computing: Tools and : Tools and technologies enabling system to recover from a technologies enabling system to recover from a crashcrash
• Load balancingLoad balancing: Distributes large number of : Distributes large number of requests for access among multiple servers requests for access among multiple servers
• Acceptable Use Policy (AUP)
• Authorization policies
Security Policy:
Policy ranking information risks, identifying acceptable security goals, and identifying the mechanisms for achieving these goals
• Determines the level of risk to the firm if a specific activity or process is not properly controlled
Risk Assessment:
• Load balancing: Distributes access requests across
multiple servers
• Mirroring: Backup server that duplicates processes on
primary server
• Recovery-oriented computing: Designing computing systems to recover more rapidly from mishaps
• Disaster recovery planning: Plans for restoration of computing and communications disrupted by an event such as an earthquake, flood, or terrorist attack
• Business continuity planning: Plans for handling mission-critical functions if systems go down
• MIS audit: Identifies all of the controls that govern
individual information systems and assesses their
effectiveness
• Security audits: Review technologies, procedures,
documentation, training, and personnel
Auditing:
The Role of AuditingThe Role of Auditing
• MIS audit
• Identifies the controls that govern information systems and assesses their effectiveness
• Auditor conducts interviews with key individuals
• Examines security, application controls, overall integrity controls, and control disciplines
Sample Auditor’s List of Control Weaknesses
Figure 14-8
Data quality auditData quality audit
• Survey and/or sample of files Survey and/or sample of files
• Determines accuracy and completeness of data Determines accuracy and completeness of data
Data cleansingData cleansing
• Correcting errors and inconsistencies in data to Correcting errors and inconsistencies in data to increase accuracy increase accuracy
• Walkthrough:Walkthrough: Review of specification or design Review of specification or design document by small group of people document by small group of people
• Debugging:Debugging: Process of discovering and eliminating Process of discovering and eliminating errors and defects in program codeerrors and defects in program code
• MetricsMetrics: Objective assessment of software used in : Objective assessment of software used in the system in form of quantified measurementsthe system in form of quantified measurements
Technology and Tools
Access Control
• Passwords
Authentication:
Access control: Consists of all the policies and procedures a company uses to prevent improper access to systems by unauthorized insiders and outsiders
• Tokens, smart cards
• Biometric authentication
• Firewalls: Hardware and software controlling flow of
incoming and outgoing network traffic
• Intrusion detection systems: Full-time monitoring
tools placed at the most vulnerable points of
corporate networks to detect and deter intruders
Firewalls, Intrusion Detection Systems, and Antivirus Software
A Corporate Firewall
Figure 10-7
• Antivirus software: Software that checks computer
systems and drives for the presence of computer
viruses and can eliminate the virus from the infected
area
• Wi-Fi Protected Access specification
• Encryption: transforming text or data into cipher text that cannot be read by unintended recipients
• Secure Sockets Layer (SSL)
• Transport Layer Security (TLS)
• Secure Hypertext Transfer Protocol (S-HTTP)
• Public key encryption
• Digital signature
• Digital certificate
• Public key infrastructure (PKI)
Encryption and Public Key InfrastructureEncryption and Public Key Infrastructure
• Public key encryption: Uses two different keys, one
private and one public. The keys are mathematically
related so that data encrypted with one key can be
decrypted using only the other key
• Message integrity: The ability to be certain that the
message being sent arrives at the proper destination
without being copied or changed
Encryption and Public Key Infrastructure
Public Key Encryption
Figure 10-8
• Digital signature: A digital code attached to an electronically transmitted message that is used to verify the origin and contents of a message
• Digital certificates: Data files used to establish the identity of users and electronic assets for protection of online transactions
• Public Key Infrastructure (PKI): Use of public key cryptography working with a certificate authority
Digital Certificates
Figure 10-9
• Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS): protocols for secure information transfer over the Internet; enable client and server computer encryption and decryption activities as they communicate during a secure Web session.
• Secure Hypertext Transfer Protocol (S-HTTP): used for encrypting data flowing over the Internet; limited to Web documents, whereas SSL and TLS encrypt all data being passed between client and server.
What we now know
Management Opportunities:
Creation of secure, reliable Web sites
and systems that can support e-
commerce and e-business strategies
• Designing systems that are neither
overcontrolled nor undercontrolled
• Implementing an effective security policy
Management Challenges:
• Security and control must become a more visible and explicit priority and area of information systems investment.
• Support and commitment from top management is required to show that security is indeed a corporate priority and vital to all aspects of the business.
• Security and control should be the responsibility of everyone in the organization.
Solution Guidelines: