ITM 100 Class 9: Securing Information Systems

ITM 100 Class 9: Securing Information Systems

• This class focuses on securing information systems.
• The study material is adapted from Management Information Systems: Managing the Digital Firm, 17th Edition by Kenneth C. Laudon and Jane P. Laudon.

Real World Example - TJX

• In 2006, TJX experienced a significant computer system security breach, affecting up to 94 million customers.
• Albert Gonzalez received a 20-year prison sentence in 2010 for his role in the TJX breach.
• The potential financial impact of the breach, according to federal guidelines, exceeded $400 million.
• The breaches began in 2005 with war-driving expeditions to identify vulnerable wireless networks.
• Hackers entered the TJX network, moved upstream to the corporate network, and installed a packet sniffer to capture transaction data.
• Authorities discovered 16.3 million stolen credit card numbers on Gonzalez's Latvian server and another 27.5 million on a server in Ukraine.

Real World Example - Heartland Payment Systems

• In March 2008, a breach exposed 134 million credit cards at Heartland Payment Systems.
• Albert Gonzalez and two unnamed Russian accomplices were indicted in 2009 and Gonzalez was sentenced to 20 years in prison.
• The vulnerability to SQL injection was known, with security analysts warning retailers well in advance, of the potential risks for years.

Top 10 Data Breaches (2008-2019)

• This section provides a list of the top 10 data breaches between 2008 and 2019.
• The companies included are Yahoo!, MySpace, Marriott, LinkedIn, Equifax, Heartland Payment Systems, Target, Capital One, Sony.
• Data is provided on the service, the company involved, and dates.
• Example: Yahoo!, Web services provider, 3000 million (2013)

System Security

• Information systems play a crucial role in many organizations and are extremely vulnerable.
• System failures can significantly impact a firm's business functions and profitability.
• Critical organizational data, like confidential information, trade secrets, and new products are at risk if security measures are insufficient.
• Security breaches can dramatically reduce a company's market value and lead to liability issues.

Why Systems Are Vulnerable

• Hardware issues such as breakdowns, misconfigurations, and improper use can cause system vulnerabilities.
• Software flaws and programming errors, installation problems, and unauthorized modifications are another threat to system security.
• Systems located outside of a firm’s control also increase vulnerabilities.

Software Vulnerability

• Commercial software often has bugs (code defects).
• Achieving zero defects in software is not always possible due to the complexity of large programs.
• Security vulnerabilities frequently exist that enable intrusions. Buffer overflow is an example with such vulnerabilities.

Computer Crime

• Illegal acts against computer systems or using computers to commit crimes are considered computer crimes.
• Gaining unauthorized access, breaching confidentiality of data, or stealing trade secrets are all types of computer-related violations.

Internet Vulnerabilities

• The openness of the internet makes it susceptible to attacks like interception, person-in-the-middle attacks, malicious software, etc.
• The sheer size of the internet means a successful attack can have widespread impact.

Wireless Security Challenges

• The radio frequency spectrum used for wireless communication is easily accessible to eavesdroppers.
• Service set identifiers (SSIDs) can be easily detected through tools like sniffer programs.
• War-driving attempts to identify unprotected or vulnerable wireless networks.

Malicious Software

• Malicious software, often abbreviated as malware, comes in several forms, including viruses, worms, and Trojans.
• This software can cause damage to computers.

Computer Viruses

• Viruses are designed to attach to other programs to execute unauthorized functions.
• They replicate and spread to other programs and computers, sometimes by email attachments. - They can cause data damage and theft.

Worms

• Worms replicate themselves across networks to spread across multiple computer systems.
• They don't require an active host program to run, unlike a Virus.

Trojan Horses

• Trojan horse programs often appear benign initially then carry out harmful actions.
• They frequently spread viruses or malware.

SQL Injection, Spyware

• Hackers use SQL injection attacks against database-driven applications. These attacks use maliciously crafted data submitted in web forms to execute unauthorized commands against databases.
• Spyware includes keyloggers, applications that record user keystrokes to capture sensitive data.

Hackers and Computer Crime

• Hackers are those individuals who attempt to gain unauthorized access to computer systems.
• Crackers are a subset of hackers with malicious intent.

Computer Crime (Continued)

• Identity theft, password guessing, phishing, and pharming are fraudulent activities that involve unauthorized access to personal information, which poses a significant threat.

Spoofing and Sniffing

• Spoofing includes masquerading as another person or redirecting web links to unintended destinations.
• Sniffing is a passive attack that observes data traveling across a network, enabling hackers to steal data like emails and company files.

Denial of Service (DoS) Attacks

• Hackers flood a computer system with extraneous communication to crash the service.
• Distributed DoS attacks utilize many computers to overwhelm the system.
• Botnets are often employed in DoS attacks: networks of compromised computer systems that carry out malicious activities on command from the attacker.

Internal Threats: Employees

• Security threats originate from within organizations, such as through insiders with inside knowledge.
• Sloppy security practices and inadequate user training can cause weaknesses.
• Social engineering tricks employees into revealing passwords or other sensitive data.
• Information systems specialists and end users alike are points of weakness.

Contemporary Security Challenges and Vulnerabilities

• Network security vulnerabilities can arise from numerous sources, including unauthorized access, tapping, message alteration, and radiation.

Security and Controls

• Security measures, encompassing policies and procedures, are steps taken to prevent unauthorized access, damage to data, and theft.

Information Systems Controls

• Controls are procedures employed over the entire organization's information systems, such as general controls, which address systems design or application controls which pertain to specific applications.

CIA Triad of Information Security

• Confidentiality, Integrity, and Availability (CIA) are the three pillars of information security: Confidentiality ensures data stays secret; Integrity ensures data's accuracy and reliability; Availability ensures authorized users can access data when needed.

Tools and Technologies for Safeguarding Information Systems

• Software patches address flaws in software programs.
• Identity management software helps manage user accounts and access privileges.
• Authentication methods such as password systems, tokens, smart cards, and biometric systems control access to sensitive information. Tools such as firewalls block unauthorized users. Intrusion detection systems monitor potential threats. Antivirus software checks for and removes malware.

Preventing Unauthorized Access

• Guidelines for passwords should be easy to remember but hard to guess. This advice includes mixing upper and lowercase letters, numbers, and special characters to avoid simple guessing tactics.

Risk Assessment

• Risk assessments are crucial to determine the probability and potential cost of system vulnerabilities.
• Risk assessment considers types of threats, potential losses, and expected annual losses.

Online Order Processing Risk Assessment

• An example demonstrates classifying exposure to risk with probability of occurrence and loss ranges.

Security Policy

• Security policies outline appropriate security goals, acceptable use policies, and computing equipment standards.

Disaster Recovery Planning and Business Continuity Planning

• Disaster recovery plans aim to restore disrupted services after a disaster.
• Business continuity plans address continuing business operations after a major disruption.

The Role of Auditing

• Information systems audits evaluate the organization’s overall security posture.
• Security audits review technologies, procedures, documentation, training, and personnel.
• Auditors can simulate disaster scenarios to test response capabilities.

Sample Auditor's List of Control Weaknesses

• This is an example of findings from an information systems audit.