CH 13

Information Systems Security and Online Privacy

• Information systems security, privacy, and ethics are important for all managers, not just IT professionals.
• Delegating security solely to IT professionals is a mistake.
• Risk management processes include risk assessment and risk mitigation.
• Cybersecurity threats include both internal and external threats.
• Safeguards are developed to mitigate these risks.
• Ethics are defined and applied to information system decisions.

Key Information Security Terms

• Threat: A failure in security, privacy, or ethics that can have dramatic repercussions for an organization, including direct effects (e.g., computer outages) and indirect effects (e.g., legal issues).
• IS controls: Software, devices and procedures to help protect systems.
• Information Resources: Data that must be protected.
• Vulnerability: The likelihood a threat will harm the system.
• Exposure: Potential harm if a threat breaks the controls and compromises the resources.

Examples of Security Breaches

• WannaCry ransomware (May 12, 2017): Infected thousands of computers worldwide.
• Sony Entertainment Company data breach (November 24, 2014): Hackers stole 100 terabytes of sensitive data.

Components of Information Security

• Confidentiality: Information is kept secret, only accessible to authorized people.
• Integrity: Information remains unaltered, without unauthorized changes.
• Availability: Information is accessible when needed by authorized users.

Confidentiality

• To ensure confidentiality, two things are needed:
• Cryptography: Ensures only intended recipients can read data.
• Access Control: Verifies the identity of intended recipients.

Cryptography

• Plaintext: Original message.
• Ciphertext: Transformed message.
• Key: Secret used in transformation.
• Encryption: Algorithm for transforming plaintext into ciphertext.
• Decryption: Algorithm for transforming ciphertext into plaintext.
• Cipher: Algorithm for encryption/decryption.

Access Control

• Three components to control access:
• Authentication: Verifying the identity of a user.
• Authorization: Limiting access to specific information based on user roles.
• Accounting: Tracking user activities to monitor and detect malicious behaviour.
• Password security: Password should have complexity and should not be shared.

Multi-factor Authentication (MFA)

• Several businesses use MFA.
• Something you know (password).
• Something you have (token).
• Something you are (biometric).

Internal Threats

• Intentional Malicious Behavior: Disgruntled or ill-willed employees.
• Careless Behavior: Ignorance or disregard for security policies.
  • Failing to modify default passwords
  • Not following Internet and web usage guidelines
  • Not following guidelines for saving data on personal or portable devices
  • Failure to destroy sensitive data per schedule.

External Threats: The Intrusion Threat

• Hackers: Use coding errors or undocumented features to control IT systems or data.
• Social Engineering: Obtaining restricted information by convincing legitimate users or others to share it
• Phishing: Sending official-sounding spam through emails/links
• Online fake news: Targeted diffusion of false information.
• Troll factories: Organizations specializing in writing and posting fake articles to discredit or promote something.
• Mobile and IoT Cybersecurity Threats: Increased capability of mobile devices leads to more creative vulnerabilities.

Malware

• Malware: Any software with malicious intent.
  • Disrupt computer operation
  • Gain access to private systems
  • Steal personal information
  • Display advertisements
• Types of Malware: • Virus • Worm • Trojan Horse • Ransomware • Spyware

Phishing

• Phishing: Sending official-sounding spam to trick users into entering personal details or passwords through fabricated websites.
• Spear Phishing: Phishing targeting specific individuals.

Online Fake News

• Targeted diffusion of false information gaining traction.
• Ubiquitous social media access reduces entry barriers and speeds misinformation spread.
• Troll factories are new organizations specializing in fake messages to discredit or promote.

Mobile and IoT Cybersecurity Threats

• Smartphones and IoT devices (Internet of Things) are susceptible to the same cybersecurity threats as computers.
• Users of mobile devices are often more ignorant of cybersecurity risks.
• Hackers are finding creative ways to exploit new vulnerabilities on mobile devices.

Privacy

• Privacy: The right to be left alone from intrusions.
• Information Privacy: Related to info collection and dispersion

Cybersecurity is an IT Problem?

• Cybersecurity is a managerial concern and should not be solely the responsibility of the IT department.
• It's essential to have a thorough understanding of potential risks concerning IT, their likelihood, potential consequences, and how to mitigate them.

Cybersecurity = Negative Deliverable

• Cybersecurity is frequently underfunded due to its lack of direct revenue generation.

Managers Responsibility

• Security, privacy and ethics are important managerial concerns that should not be ignored.
• Managers must understand the various conditions under which decisions and trade-offs are made to appropriately manage security.
• Understanding threats and responses is crucial decision-making.

IT Risk Management and Cybersecurity

• Cybersecurity refers to defenses against threats to technology infrastructure and assets.
• IT risk management involves identifying and measuring risks and planning mitigation strategies.
• Cybersecurity has increased in importance due to the rising threat of cyberterrorism.

Risk Assessment

• The process audits current resources (technological and human) to identify the vulnerabilities in a company's information systems security posture.
• Understand the current set of vulnerabilities the firm faces.
• The amount invested in cybersecurity should be proportional to the threat's extent and potential negative consequences.

Risk Mitigation

• Matching the appropriate response to identified cybersecurity threats.
• Optimal strategy balances cybersecurity attainment with investment.

Three Mitigation Strategies

• Risk Acceptance: Not investing in countermeasures, potentially higher failure costs.
• Risk Reduction: Investing in safeguards to mitigate threats, higher anticipation costs.
• Risk Transference: Shifting risks to a third party (outsourcing).

Cybersecurity Responses: Internal Threats

• Comprehensive Assessment: Evaluating potential internal threats (scenarios, likelihood, harm).
• Security Policies: Guiding employee behavior to lessen risks.
• Monitoring: Limiting access to dangerous websites and unauthorized software
• Testing: Phishing to gauge response

Cybersecurity Responses: External Threats

• Intrusion Countermeasures: Passwords and firewalls
• Firewall: Screens and manages network traffic.
• Encryption: Prevents data understanding by unauthorized users.
• Malware Response: Antivirus and spyware software.
• Training and Policies: Helps mitigate malware threats.

Risk Assessment and Mitigation

• Example table highlighting threat, vulnerability, consequence, risk rating, action needed and explanation for specific threats (e.g., flooding, overheating servers).

Cybersecurity Responses: External Threat - Examples

• DDoS Attacks: Low vulnerability but medium risk; reduce by monitoring and updating.
• Insider Threats (Data Theft): Medium vulnerability, high risk; reduce by access control and monitoring.

This quiz explores the essential aspects of information systems security, including the importance of ethical practices and the roles of various professionals in managing security risks. It covers key terminology and concepts related to cybersecurity threats and safeguards. Understanding these elements is crucial for any manager overseeing information resources.