Cybersecurity Quiz on Computer Security Principles

Lecture 6: BHMS4472 ICT in Business - Securing Information Systems

• ICT refers to Information, Communication, and Technology.
• Learning Objectives include:
  • Understanding why information systems are vulnerable to destruction, error, and abuse.
  • Knowing the business value of security and control.
  • Identifying the components of an organizational framework for security and control.
  • Recognizing important tools and technologies for safeguarding information resources.
• Systems are Vulnerable (1 of 2):
  • Security involves policies, procedures, and technical measures to prevent unauthorized access, alteration, theft, or physical damage to information systems.
  • Controls are methods, policies, and organizational procedures for ensuring asset safety, accounting record accuracy and reliability, and operational adherence to management standards.
• Systems are Vulnerable (2 of 2):
  • Accessibility of networks is a vulnerability.
  • Hardware problems (breakdowns, configuration errors, damage) are risks.
  • Software problems (programming errors, installation errors, unauthorized changes) are risks.
  • Disasters are potential risks.
  • Use of networks/computers outside of firm's control is a vulnerability.
  • Loss and theft of portable devices is a risk.
• Contemporary Security Challenges:
  • Unauthorized access, errors, tapping, sniffing, message alteration, theft and fraud, and radiation are client-side vulnerabilities
  • Hacking, malware, theft of data, theft and fraud, copying data, vandalism, denial-of-service attacks, alteration of data, hardware failure and software failure are corporate server-side vulnerabilities.
  • Corporate systems are vulnerable to security challenges including attacks on data, hardware, and software.
• Internet Vulnerabilities:
  • Networks open to anyone. Size means abuses can have a wide impact.
  • Corporate networks linked to the Internet are more vulnerable.
  • Email, IM, and P2P increase vulnerability. Email attachments with malicious software can be used to send trade secrets, confidential data, and compromise a secure network.
  • IM systems can also serve as a backdoor into secure networks.
  • P2P systems can transmit malicious software, and expose corporate data.
• Wireless Security Challenges:
  • Bluetooth and Wi-Fi networks are susceptible to hacking.
  • Radio frequency bands are easy to scan.
  • SSIDs (service set identifiers) can be broadcast multiply times, and identified using sniffer programs.
  • War driving refers to eavesdroppers driving by buildings trying to detect SSIDs and gain access to network and resources.
  • Rogue access points can provide unauthorized access.
• Wi-Fi Security Challenges:
  • Legitimate users and intruders interact with the access point using authentication requests, challenges, responses and success.
• Malicious Software (1 of 2):
  • Malware (malicious software) is a risk.
  • Viruses, worms, Trojan horses, and spyware are types of malware.
  • Worms and viruses spread through downloads, drive-by downloads, Email or IM attachments.
  • Mobile device malware and social network malware are also threats.
• Malicious Software (2 of 2):
  • Trojan horses, SQL injection attacks, and ransomware are examples of malicious software
  • Key loggers are one type of spyware that may reset browser home pages, redirect search requests, and slow computer performance.
• Hackers and Computer Crime (1 of 4):
  • Hackers vs. crackers
  • Activities involving system intrusion, system damage, cyber-vandalism which includes intentional disruption, defacement, or destruction of websites or corporate information systems.
• Hackers and Computer Crime (2 of 4):
  • Denial-of-service attacks (DoS)
  • Distributed denial-of-service attacks (DDoS)
  • Botnets
  • Spam
• Hackers and Computer Crime (3 of 4):
  • Computer crime is defined as violations of criminal law that require the knowledge of computer technology.
  • Computers can be targets or instruments of crime.
• Hackers and Computer Crime (4 of 4):
  • Identity theft, phishing, evil twins, and pharming (malicious redirects) are methods of identity theft.
  • Click fraud, cyberterrorism, and cyber warfare are other forms of computer crime.
• Internal Threats:
  • Security threats often originate inside an organization.
  • Inside knowledge, sloppy security procedures (user lack of knowledge), social engineering, end users and information systems specialists are sources of risk.
• Software Vulnerability:
  • Commercial software contains flaws that create security vulnerabilities
  • Bugs are program code defects.
  • Zero defects cannot be achieved.
  • Flaws can open networks to intruders.
  • Zero-day vulnerabilities exist.
  • Patches and patch management fix software flaws.
  • Microprocessor design vulnerabilities, such as Spectre and Meltdown, exist.
• Business Value of Security and Control:
  • Failed computer systems have significant or total loss of business function.
  • Organizations are increasingly vulnerable financially.
  • Confidential, personal, and financial data is a key threat.
  • Trade secrets, new products are at risk.
  • Security breaches immediately affect a firm's market value.
  • Inadequate security and controls lead to liability issues.
• Legal and Regulatory Requirements:
  • HIPAA (Medical security and privacy rules/procedures), Gramm-Leach-Bliley Act (security and confidentiality of financial institution customer data), and Sarbanes-Oxley Act (accuracy and integrity of financial information). Electronic records management follows these legal requirements.
• Electronic Evidence and Computer Forensics:
  • Electronic evidence, often digital, is used in white-collar crimes.
  • Proper controls of data save time and money during legal discovery requests.
  • Scientific collection, examination, authentication, preservation, and analysis are core to computer forensics.
  • Recovery of ambient data is part of the process.
• Information Systems Controls:
  • Controls can be automated or manual.
  • General controls govern security and use of computer programs and data files.
  • Software, hardware, computer operations, data security, system development, and administrative controls are part of general controls.
  • Application controls are unique to specific applications including input, processing and output controls.
• Risk Assessment:
  • Risk assessment determines the level of risk if a process is not controlled.
  • Types of threat, probability of occurrence, potential losses and value of threat are elements in assessing probable risk. Expected annual loss is another factor to consider.
• Online Order Processing Risk Assessment (Example):
  • Specific exposure risks (Power failure, Embezzlement, User error) are evaluated for their levels of probability and potential losses to calculate expected annual loss for each.
• Security Policy:
  • Ranks information risks, identifies security goals and mechanisms for achieving those goals.
  • Acceptable use policy (AUP) defines acceptable uses of firm's resources and equipment. Identity management includes identifying users and controlling access.
• Access Rules (example):
  • Specific roles and access levels are defined to control data visibility and usage.
• Disaster Recovery Planning and Business Continuity Planning:
  • Disaster recovery plans restore disrupted services.
  • Business continuity plans focus on restoring business operations after a disaster.
  • Both types of plans need to identify the firm's most critical systems and the sequence of system restoration in an outage.
  • Business impact analysis is necessary.
• The Role of Auditing:
  • Information systems audit examines an organization's security environment and controls governing individual information systems.
  • Security audits review technologies, procedures, documentation, training, and personnel.
  • Audits may simulate disasters to test responses, weaknesses, and probabilities of occurrence.
  • Financial and organizational impact of each threat is assessed.
• Sample Auditor's List of Control Weaknesses (example):
  • Examples of identified internal control weaknesses and remediation are shown.
• Tools and Technologies for Safeguarding Information Systems (1 of 3):
  • Identity management software automates user and privilege tracking, authentication, and access controls.
  • Password systems, tokens, smart cards, biometric authentication, and two-factor authentication are examples.
• Tools and Technologies for Safeguarding Information Systems (2 of 3):
  • Firewalls combine hardware and software to prevent unauthorized network access.
  • Packet filtering, stateful inspection, network address translation (NAT), and application proxy filtering are firewall components.
• Tools and Technologies for Safeguarding Information Systems (3 of 3):
  • Intrusion detection systems monitor corporate networks to detect and deter intruders.
  • Antimalware and antispyware software checks for and often eliminates malware. Update requirements are necessary.
  • Unified threat management (UTM) systems provide comprehensive threat mitigation.
• Securing Wireless Networks:
  • WEP security uses static encryption keys that are easily cracked.
  • WPA2 replaces WEP with stronger standards, with continuously changing, longer encryption keys.
  • WPA3 is the most recent specification with even stronger encryption.
• Encryption and Public Key Infrastructure (1 of 3):
  • Encryption transforms text into cipher text. SSL and TLS (and S-HTTP) are methods of encryption.
• Encryption and Public Key Infrastructure (2 of 3):
  • Two methods of encryption are symmetric key encryption and public key encryption.
• Encryption and Public Key Infrastructure (3 of 3):
  • Digital certificates establish user and electronic asset identities.
  • Certification authorities (CAs) validate user's identities.
  • Public key infrastructure (PKI) uses public key cryptography with certificate authorities.
• Securing Transactions with Blockchain:
  • Blockchain is a secure transaction database that uses encryption to verify users and transactions.
  • Blockchain records cannot be changed.
  • Blockchain has some security vulnerabilities.
• Ensuring System Availability:
  • Online transaction processing needs 100% system availability.
  • Fault-tolerant systems use redundant hardware, software, and power supplies.
  • Security outsourcing can involve managed security service providers (MSSPs).
• Achieving Digital Resiliency:
  • Addresses how to maintain and increase the resilience of organizations and their businesses processes.
  • Attention is directed to managerial and organizational issues.
  • A single weak link can cause outage if resilience is not properly designed, tested, and measured.
• Security Issues for Cloud Computing and Mobile Digital Platforms (1 of 2):
  • Cloud security responsibility resides with the company owning the data.
  • Ensuring providers provide protection (storage location, corporate requirements, legal privacy, data segregation, audits and certifications, SLAs).
• Security Issues for Cloud Computing and Mobile Digital Platforms (2 of 2):
  • Security policies for mobile devices must include any special requirements for these platforms and applications.
  • Mobile device management tools are necessary. Authorization, inventory records, control updates, lock-down/erase lost devices, encryption, and software segregation are components of mobile security policies.
• Ensuring Software Quality:
  • Software metrics and measurements objectively assess system quality. (Number of transactions, online response time, payroll checks, known bugs per line of code are examples.)
  • Early and regular testing, quality walkthroughs, and debugging processes are key.