Bis4225.15 - Security Of Information And Information Systems.ppt 3d1j4j

BIS4225.15 Security of Information and Information Systems 1

Reading Materials Laudon and Laudon (2002) Chap. 14

2

IS Security The process of protecting and safeguarding data and information from accidental, intentional, or natural disasters through policies, procedures, tools, techniques, and methods. 3

Vulnerability of Systems Vulnerability: A flaw, problem, or other condition that makes an information system exposed to threats. 4

Vulnerability of Systems IS are vulnerable because of: • • • • •

increased access to systems; increase system complexity; cyber terrorism on the Internet; network environment; complacent management 5

Risks Potential losses (direct or indirect) to a firm. • total loss • partial loss • temporary loss 6

Threat People, action, event, or other situations that could trigger losses. Three categories: • Accidental of unintentional errors; • Intentional errors; • Natural disasters.

7

Hacker A person who gains unauthorized access to a computer system for profit, criminal activity or personal pleasure.

8

Hacker CLIENT

NETWORK

SERVER Insider Jobs Hacking

Web Servers

Databas e Servers

Application Servers

9

Virus A computer virus is a hidden program which inserts itself into the computer system and clones itself.

10

Worm A program designed to replicate itself and travels between machines and across network connections. It does not require a host. 11

Development Controls CLIENT

NETWORK

SERVER

Viruses Worms Web Servers

Databas e Servers

Application Servers

12

IS Controls A control is a tool for controlling risks. It is used to identify, prevent, or reduce the risk of a security breach, or to minimize the harm done. 13

IS Controls Security Exposure: • Minimize the probability of it happening. • Minimizing the damage, if it does happen. • Recover from the damage. 14

IS Controls • Application Controls • Development (Implementation) Controls • Physical Facility Controls

15

Application Controls Provides security to the input, processes, output, and storage phases of a system. • IDs, s • Backups 16

Application Controls Backups: Creating duplicate copies of a file or program and storing it on a separate disk or other medium in a different location from the original file or program. 17

Development Controls Security measures that are part of each phase of the development life cycle of an information system. • Encryption • Digital Signatures • Firewalls

18

Development Controls Encryption CLIENT

NETWORK

SERVER Web Servers

Application Servers

Cryptography Instruction: Instruction:ENCRYPTION djgoshrj68sj:DECRYPTION Databas e 100 apples ... Buy Wt9e uy22 sl0ytl; ... Buy 100 apples ... Servers

19

Development Controls Cryptography: A collection of technologies for securing electronic messages and transactions by encryption Instruction: Buy 100 units of ... ENCRYPTION

djgoshrj68sj: Wt9e uy22 sl0ytl; ...

20

Development Controls Encryption SENDER Algorithm

Plain Text

Encrypt

Key

RECEIVER Algorithm

Cipher Decrypt Text (in transmission)

Plain Text

Key

21

Development Controls

Digital Signatures Plain Text

Plain Text

Hashing

Message Digest

Sender’s Keys

Plain Text

Encrypt

Private

Encrypt

Message Digest

Cipher Text

Public

Receiver’s Keys Private

Public

22

Development Controls Message Digest C O M P A R E

Message Digest

Hashing

Digital Signatures

Plain Text

Plain Text

Message Digest

Message Digest

Decrypt

Private Public Sender’s Keys

Cipher Text

Decrypt

Private

Public

Receiver’s Keys

23

Development Controls Digital Certificates Sender’s Keys Private

CA’s Keys

Public

Private

Public

Public

Identification Information

Identification Information

Hashing

Message Digest

Public

Encrypt Digital Certificate

24

Development Controls Digital Certificates

Plain Text

Plain Text

Hashing

Message Digest

Plain Text

Encrypt

Encrypt

Message Digest

Cipher Text

Digital Certificate

Sender’s Keys

Private

Public

Receiver’s Keys Private

Public

25

Development Controls Private

Public

Sender’s Keys

C O M P A R E

Digital Certificates Follows Digital Signature Process

Decrypt

Public

Cipher Text

Plain Text Message Digest

Decrypt

Digital Certificate

Private

Public

Receiver’s Keys Private

Public

CA’s Keys

26

Development Controls Firewall

INTERNET

R FW DMZ Internal Local Area Network

Servers

27

Physical Facility Controls • • • •

Fire alarms Security personnel Restricted access Temperature and humidity monitors 28

Vulnerability of the Internet CLIENT

NETWORK

SERVER

Consumer/

Internet Network

Company/Retailer

Cookies Spyware Viruses

Tapping Spoofing

Insider Jobs Hacking

Web Servers

Databas e Servers

Application Servers

29

Security Policy The setting, implementing, and enforcing security policies and procedures. Developed from the view point of getting the right balance for the business. 30

Business Continuity Plan Components: Preparation

Prevention

Recovery Restoration

Examples:

Flood

Fire

Lightning Sabotage

31

Business Continuity Plan Preparation

Prevention

Recovery Restoration

• training of systems personnel to face disasters;

• documenting the system components; • regular back-up of the system.

32

Business Continuity Plan Preparation

Prevention

Recovery Restoration

• to reduce the probability of disruptions to computer systems, for example: • prevent fire: “no smoking” enforcement. • prevent water: relocate away from waterprone areas.

33

Business Continuity Plan Preparation

Prevention

Recovery Restoration

• procedures to recover the system in the shortest possible time in order to

resume operations, for example, setting up temporary facilities.

34

Business Continuity Plan Preparation

Prevention

Recovery Restoration

• salvage of reusable equipment; • re-establish the operational capability of the existing premises; or establish new premises; • changeover from the temporary system to restored system.

35