ring Information Systems –Study Guide

Systems must be more secure when processing transactions and maintaining data. These two issues are the biggest issues facing those wanting to do business on or expand their operations to the Internet.
System Vulnerability and Abuse
Why Systems Are Vulnerable

Information systems are vulnerable to technical, organizational, and environmental threats from internal and external sources. The weakest link in the chain is poor system management. If managers at all levels don’t make security and reliability their number one priority, then the threats to an information system can easily become real. The figure below gives you an idea of some of the threats to each component of a typical network.

Contemporary Security Challenges and Vulnerabilities.

Businesses that partner with outside companies are more vulnerable because at least some data may be less controlled. Partnering companies may not protect information as stringently. Hardware and software safeguards may not be as important to outsiders. Employees of the partnering firm may not view security as diligently as the primary business.

Mobile computing devices like smartphones, cell phones, netbooks, and laptops, add to the vulnerability of information systems
Internet Vulnerabilities

Poor diligence Information broker ChoicePoint sold the personal information of 145,000 people to inadequately vetted bogus businesses. As a consequence, many people later became victims of identity theft. ChoicePoint paid $15 million to settle charges it failed to protect consumers’ information, the Federal Trade Commission announced in January 2006.

Failed processes A laptop containing sensitive personal information on 26.5 million U.S. veterans was stolen May 3 from the suburban Maryland residence of a Veteran’s Administration data analyst who wanted to work at home but did not have remote access to the VA’s system. News of the theft was kept under wraps for 19 days. A week later, Michael H. McLendon, VA deputy assistant secretary for policy, announced his resignation.

These incidents show how long the problem with poor security has existed and how vulnerable computing systems are. Every point of entry into the Internet network is a point of vulnerability.

If you connect to the Internet with a cable modem or DSL you are much more vulnerable to hackers on your home PC than if you connect with a dial-up modem. That’s because you are always connected, with a permanent IP address, which makes it easier for hackers to find you. The only smart thing to do is keep your security software and operating system software up-to-date and include firewall protection.

Because distributed computing is used extensively in network systems, you have more points of entry, which can make attacking the system easier. The more people you have using the system, the more potential for fraud and abuse of the information maintained in that system. That’s why you have to make it everybody’s business to protect the system. It’s easy for people to say that they are only one person and therefore they won’t make much difference. But it only takes one person to ignore necessary safeguards in order for one other person to disable a system or destroy data.
Wireless Security Challenges
Internet cafes, airports, hotels, and other hotspot access points need to make it easy for users to use the network systems with the 802.11 standard. Yet, because it is so easy, hackers and crackers can easily access unsuspecting users’ systems and steal data or use the entry point as a way to spread malicious programs. The hackers can use war driving techniques to gain access to wireless networks not only in hotels and airports, but private businesses and government centers.

Wireless networks are vulnerable in the following ways:

• Radio frequency bands are easy to scan.
• Signals are spread over a wide range of frequencies.
• Service set identifiers (SSID) are broadcast multiple times and are easily picked up.
• Rogue access points can be established on different radio channels and divert signals from authentic points.
• Wired equivalent privacy (WEP) isn’t very effective because it relies on user input.
Malicious Software (Malware): Viruses, Worms, Trojan Horses, and Spyware

Have you ever picked up a cold or the flu from another human? Probably. You then spread it to two or three other people through touch or association. Those people spread it to two or three more people each. Pretty soon it seems that everyone on campus or at work is sick. That is how computer viruses are spread. You copy a file from an infected source, use the file, and maybe send it to friends or associates. The virus is now on your computer and spreads to files other than the original. You then send the same or even a different file to a few friends and their computers are infected.

Web-enabled and e-mail-enabled cell phones are now being targeted as a way to spread viruses.

A different type of malware called worms can also destroy data on computers or clog network systems with software-generated electronic transmissions. Worms are similar to viruses in that they can create additional file copies on a computer and generate emails to other computers with the infected file attached. Worms differ from viruses because they don’t need human intervention to spread from one computer to another.

Trojan horses cause problems because they force a computer system to perform unexpected operations, often to the detriment of the system and the user. This type of malware is usually masked in email messages although it can be stored on Web sites.

Web sites are becoming a magnet for hackers to gain access to users’ computers. It’s imperative that Web site programmers and authors create underlying code that properly validates and filters data entered by site users. That will help prevent SQL injection attacks that target databases and unleash malicious code.

Not all spyware is damaging to a computer system. It is a popular method for some Web sites to monitor how users navigate through a site, providing critical information that the Web designers and developers can use to improve the site. Unfortunately, some spyware is becoming a preferred method for hackers to install malicious code on computers and allow them to infiltrate an unsuspecting computer. Key loggers are an example of how spyware programs are used to capture personal or business information from unsuspecting users.
Hackers and Computer Crime

Hackers constantly develop new ways to get around security software. Unfortunately they usually have the upper hand because they can create hacking methods faster than security software companies can create, update, and distribute software that blocks them. Users who fail to keep their software updated inadvertently help hackers continue to ply their trade. One security software company is trying a new approach and hope they get the help they need from you.

Symantec asks customers to opt in to a program that will collect data about attempted computer intrusions and then forward the information to authorities. Symantec will also begin posting the FBI‘s top 10 hackers and their schemes on its Web site, where customers go for software updates. Next year, the company will begin offering cash bounties for information leading to an arrest. (BusinessWeek, Hounding the Hackers, Edwards, Cliff, Sep 14, 2009)

Some hackers penetrate systems just to see if they can. They use special computer systems that continually check for password files that can be copied. Or they look for areas of the system that have been “left open,“ so to speak, where they can enter the system. Sometimes they don’t do any damage, but far too often they destroy files, erase data, or steal data for their own use through cybervandalism. Other hackers attack systems because they don’t like the company.
Even after last week‘s unveiling of privacy upgrades, a security lapse on the Facebook Inc. social network early this week still exposed restricted photos to anyone using the site, according to an Associated Press report later confirmed by the company to Computerworld.
A spokeswoman said that after learning of the problem, Facebook engineers on Monday “tested the scenario, found that it was a bug and fixed it immediately.“ In a statement, the company added that “We take security very seriously.“ (Computerworld, March 26, 2008)
Spoofing/pharming and Sniffing

These are two other methods hackers and criminals use to gain improper or illegal access to computer systems. Spoofing or pharming is becoming a common way to steal financial information through fake Web sites. The spoofed site is almost a mirror image of the real site and unless the unsuspecting user examines the spoof closely, he/she may inadvertently give out important personal and financial information.

Using a sniffer program is a popular way to “grab“ information as it passes over transmission lines regardless of whether they are hard-wired or wireless. It is almost impossible to detect and encryption is about the only way to safeguard against it.
Denial of Service Attacks

As companies and organizations expand their business to Web sites, they are opening another point of vulnerability through denial of service attacks. Using botnets to launch distributed denial of service attacks is becoming all too common. The hackers seem to enjoy attacking the most popular Web sites like Facebook and Twitter.

“On this otherwise happy Thursday morning, Twitter is the target of a denial of service attack,“ wrote Stone (Twitter co-found Biz Stone). “Attacks such as this are malicious efforts orchestrated to disrupt and make unavailable services such as online banks, credit card payment gateways, and in this case, Twitter for intended customers or users. We are defending against this attack now and will continue to update our status blog as we continue to defend and later investigate.“ In a denial-of-service attack, a malicious party barrages a server with so many requests that it can’t keep up, or causes it to reset. As a result, legitimate users can only access the server very slowly — or not at all, as appears to be the case here. (www.wired.com, Van Buskirk, Elliott, Denial-of-Service Attack Knocks Twitter Offline, Aug 6, 2009)

Computer Crime

Computer crime is a growing national and international threat to the continued development of e-business and e-commerce. When the Internet was first created in the late 1960s, the designers intentionally built it to be open and easily accessible. Little did they know 40 years later, that structure would be the very cause of so much crime and vandalism. This table lists the best known examples of computer crime.

Identity Theft

The fastest growing crime off or on the Internet is identity theft. Even though identity theft is most likely to occur in an offline environment, once your personal information has been stolen its easy to use it in an online environment.

There are many precautions people can take to help prevent identity theft. One way is to scrutinize emails or phone calls that ask for your personal information or financial account information. No legitimate financial institution will ever send an e-mail requesting you to supply your account information. That is the number one indicator that the e-mail is a phishing e-mail. You should ignore and delete the email immediately. You can also access www.annualcreditreport.com and receive free copies of your credit reports from the three major credit reporting bureaus to monitor the information about your credit card and financial activities.

Other ways your identity can be stolen is through evil twins based on wireless network intrusions and pharming, the use of bogus Web sites. All of these are classified as computer crimes for which our government is continually passing new laws.
Click Fraud
All those ads you see on Web sites cost the sponsor money. Every time someone clicks on an ad, the sponsor is charged a pay-per-click fee. The fee is based on the popularity of the search words that generated the ad. What if your company is paying for an ad with little or no resultant traffic to your Web site? That’s what happens in the case of click fraud. A person or a software program continually hits on the ad, driving up the advertising fees, without any intention of actually visiting the site.
Internal Threats: Employees

It is surprising to learn that much computer crime against companies is committed by current or former employees. They know the system best, are entrusted with huge amounts of data, and have the easiest access. Managers and executives need to be aware of potential internal threats to their systems and put special measures in place to safeguard systems and data. They also need to impress upon all employees how important security is throughout the system right down to the last person.
Internet behavior—surfing to unknown or even suspicious sites, for example—when they have an IT department behind them to clean up their mess, a recently released study claims.
According to the July study—which was released Tuesday by Tokyo-based Trend Micro and based on polls of 1,200 users, 400 each in the United States, Germany, and Japan—39 percent of enterprise workers believed that their company’s IT department would keep them safe from viruses, worms, spyware, spam, and phishing and pharming attacks.
That confidence, whether on the mark or misplaced, leads workers to do risky, even stupid, things at work, such as opening questionable e-mail messages or clicking on unknown Web site links.

Password theft is the easiest way for hackers to gain access to a system. No, they don’t come into your office at night and look at the piece of paper in your desk drawer that has your password written on it. They generally use specially written software programs that can build various passwords to see if any of them will work. That’s why you should use odd combinations of letters and numbers not easily associated with your name to create your password. The longer the password, the harder it is to replicate. The same password should not be used for more than one access point. Using multiple passwords limits the damage done if a hacker does manage to obtain a single password.

Safeguarding individual passwords from social engineering maliciousness is the responsibility of everyone in the organization. An effective way of limiting access to data is to establish computer-generated logs that show every employee who logged on, what they did, what part of the system they accessed, and whether any data were used or updated. Logs are easily created by system software programs and should be periodically reviewed by the information technology staff and department managers. If nothing else, it gives them an idea of what their employees are doing.
Software Vulnerability

With millions of lines of code, it’s impossible to have a completely error-free program. Most software manufacturers know their products contain bugs when they release them to the marketplace. They provide free updates, patches, and fixes on their Web sites. That’s why it’s a good idea not to buy the original version of a new software program but to wait until some of the major bugs have been found and corrected.

Because bugs are so easy to create, most unintentionally, you can reduce the number of them in your programs by using the tools discussed in other chapters to design good programs. Many bugs originate in poorly defined and designed programs and keep infiltrating all parts of the program.
Business Value of Security and Control

Transactions worth billions and trillions of dollars are carried out on networks every day. Think of the impact if the networks experience downtime for even a few minutes. And, the problem is far worse than companies may reveal:
In 2005 ChoicePoint, a data brokerage company, revealed that they had inadvertently sold personal and financial information to more than 50 companies that were fronts for identity thieves. This incident underscores the difficulties with protecting data and information on millions of unsuspecting consumers and legitimate businesses. The cost of settling several lawsuits went far beyond the potential profits Choicepoint probably made. Indeed, the problem has been very damaging to Choicepoint’s business reputation.

Consumer data broker ChoicePoint, Inc., which last year acknowledged that the personal financial records of more than 163,000 consumers in its database had been compromised, will pay $10 million in civil penalties and $5 million in consumer redress to settle Federal Trade Commission charges that its security and record-handling procedures violated consumers’ privacy rights and federal laws. The settlement requires ChoicePoint to implement new procedures to ensure that it provides consumer reports only to legitimate businesses for lawful purposes, to establish and maintain a comprehensive information security program, and to obtain audits by an independent third-party security professional every other year until 2026.
“The message to ChoicePoint and others should be clear: Consumers’ private data must be protected from thieves,“ said Deborah Platt Majoras, Chairman of the FTC. “Data security is critical to consumers, and protecting it is a priority for the FTC, as it should be to every business in America.“ (FTC.gov, Nov 2008)
Legal and Regulatory Requirements for Electronic Records Management

Because so much of our personal and financial information is now maintained electronically, the U.S. government is beginning to pass laws mandating how the data will be protected from unauthorized or illegal misuse. Congress has passed several measures outlining the requirements for electronic records management:
• HIPAA: protects medical and health care data
• Gramm-Leach-Bliley Act: requires financial institutions to ensure the security and confidentiality of customer data
• Sarbanes-Oxley Act: requires companies and their management to safeguard the accuracy and integrity of financial information that is used internally and released externally

All of these laws are in response to computer crimes and abuses that businesses or individuals have committed or experienced. It’s very difficult to pass the laws and costly for businesses who struggle to comply with them.
Electronic Evidence and Computer Forensics

Several things are happening in the corporate world that are changing the requirements for how companies handle their electronic documents: 1) Companies are communicating more and more with e-mail and other forms of electronic transmissions, and 2) Courts are allowing all forms of communication to be held as evidence. Therefore businesses must develop methods of capturing, storing, and presenting any and all electronic communications including e-mail, instant messaging, and e-commerce transactions.

Computer forensics is a growing field because of the increasing digitization of documents and communications. Many people believe that just because they delete a file from a computer file directory that it’s no longer available or recoverable. That’s a false belief. Ambient data remains on hard drives in magnetic form long after it’s apparently been deleted. People trained in computer forensics are able to uncover ambient data and other forms of electronic evidence that can be used in courts of law. Businesses and employees must increase their awareness of the necessity for keeping good records.