Security in Information Technology - Lecture 20

Security in Information TechnologyLecture 20Summary of Previous LectureIn previous lecture we have covered,Introduction to Information System PlanningTypes of planningWhy is planning so difficult?The Changing World of PlanningTraditional Strategy-MakingToday’s Sense-and-Respond ApproachSummary of Previous LectureSeven Planning TechniquesStages of GrowthCritical Success FactorsCompetitive Forces ModelFive Forces Analysis of the InternetValue Chain AnalysisE-Business Value MatrixLinkage Analysis PlanningScenario PlanningToday’s LectureWhat is information Security?Control?What is Vulnerable?Why systems are vulnerable?Vulnerability and Challenges.Computer Security Threats and TypesHackingTappingSniffingToday’s LectureSpoofingDenial of Service AttackMalwares and its typesWhy Internet is Vulnerable?Wi-Fi Threats exampleComputer CrimeMore examples of Vulnerabilities.Software VulnerabilityBusiness Values of Computer Security and Control.Related LawsToday’s LectureInformation System ControlManual and automated controlGeneral and application control.Risk AssessmentSecurity PolicyIdentity ManagementDisaster Recovery PlanInformation Security AuditToday’s Lecture Technologies and Tools for ProtectionIdentity management softwareFirewallIntrusion detection systemEncryptionDigital certificate and keysSummaryWhy Talk about Security?Why Talk about Security?What is Information Security?Policies, procedures and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems.The terms information security, computer security and information assurance are frequently used interchangeably. ControlMethods, policies, and organizational procedures that ensure safety of organization’s assets; accuracy and reliability of its accounting records; and operational adherence to management standardsVulnerableVulnerable: Capable of being attacked or damaged.Vulnerability: A flaw, error, or poor coding technique in a program that may allow an attacker to exploit it for a malicious purpose. Why Systems are Vulnerable? Accessibility of networksHardware problems (breakdowns, configuration errors, damage from improper use or crime)Software problems (programming errors, installation errors, unauthorized changes)DisastersUse of networks/computers outside of firm’s controlLoss and theft of portable devices Vulnerabilities and challengesThe architecture of a Web-based application typically includes a Web client, a server, and corporate information systems linked to databases. Each of these components presents security challenges and vulnerabilities. Floods, fires, power failures, and other electrical problems can cause disruptions at any point in the network.Computer Security Threats and TypesThreat Example: HackingHacking means finding out weaknesses in a computer or computer network and exploiting them. This is often used for false purposes.Threat Example: TappingRecoding something in an unauthorized way. For example use of logger devices and software to Tap confidential data.Threat Example: SniffingEavesdropping program that monitors information traveling over networkEnables hackers to steal proprietary information such as e-mail, company files, etc.It is often used within the organization.Threat Example: SpoofingMisrepresenting oneself by using fake e-mail addresses or masquerading as someone elseRedirecting Web link to address different from intended one, with site masquerading as intended destinationDenial-of-service attacks (DoS)Flooding server with thousands of false requests to crash the network.Distributed denial-of-service attacks (DDoS)Use of numerous computers to launch a DoSMalware (malicious software)Malware includes computer viruses, computer worms, Trojan horses, Rootkits,spyware, dishonest adware and other malicious or unwanted softwareMalware formsVirusesRogue software program that attaches itself to other software programs or data files in order to be executed.It can easily replicate itself and spread from one computer to another.Other forms of MalwareComputer WormIndependent computer programs that copy themselves from one computer to other computers over a network.Trojan horsesSoftware program that appears to be benign but then does something other than expected.RootkitsA rootkit is software that implements stealth capabilities that are designed to hide the existence of certain processes or programs. Malware formsSpywareSmall programs install themselves surreptitiously on computers to monitor user Web surfing activity and serve up advertisingAdwareA software that automatically renders advertisement. Sending continuous Adware’s is a threat.Malware formsSQL injection attacksHackers submit data to Web forms that exploits site’s unprotected software and sends rogue SQL query to databaseWhy internet is vulnerable?Internet vulnerabilitiesNetwork open to anyoneSize of Internet means network abuses can have wide impactUse of fixed Internet addresses with cable or DSL modems creates fixed targets hackersUnencrypted VOIPE-mail, P2P, IM InterceptionAttachments with malicious softwareTransmitting trade secretsExample: Wi-Fi ThreatsMany Wi-Fi networks can be penetrated easily by intruders using sniffer programs to obtain an address to access the resources of a network without authorization.Computer CrimeComputer crimeDefined as “any violations of criminal law that involve a knowledge of computer technology for their perpetration, investigation, or prosecution”Computer may be target of crime, e.g.:Breaching confidentiality of protected computerized dataAccessing a computer system without authorityComputer may be instrument of crime, e.g.:Theft of trade secretsUsing e-mail for threats or harassmentOther Examples of System VulnerabilitiesIdentity theftTheft of personal Information (social security id, driver’s license or credit card numbers) to impersonate someone elsePhishingSetting up fake Web sites or sending e-mail messages that look like legitimate businesses to ask users for confidential personal data.Evil twinsWireless networks that pretend to offer trustworthy Wi-Fi connections to the InternetOther Examples of System VulnerabilitiesPharmingRedirects users to a bogus Web page, even when individual types correct Web page address into his or her browserClick fraudOccurs when individual or computer program fraudulently clicks on online ad without any intention of learning more about the advertiser or making a purchaseCyberterrorism and CyberwarfareOther Examples of System VulnerabilitiesInternal threats: employeesSecurity threats often originate inside an organizationInside knowledgeSloppy security proceduresUser lack of knowledgeSocial engineering:Tricking employees into revealing their passwords by pretending to be legitimate members of the company in need of informationSystem VulnerabilitiesSoftware vulnerabilityCommercial software contains flaws that create security vulnerabilitiesHidden bugs (program code defects)Zero defects cannot be achieved because complete testing is not possible with large programsFlaws can open networks to intrudersPatchesVendors release small pieces of software to repair flawsHowever exploits often created faster than patches be released and implementedBusiness Values of Computer Security and controlFailed computer systems can lead to significant or total loss of business functionFirms now more vulnerable than everConfidential personal and financial dataTrade secrets, new products, strategiesA security breach may cut into firm’s market value almost immediatelyInadequate security and controls also bring forth issues of liabilityRelated LawsNational Response Center has been established in Pakistan to stop internet misuse and trace those involved in cyber crime.Electronic Crime Act 2004 was prepared. Act addresses and lays down legislative terms for the following cyber crimes:Criminal access Criminal data access Data damage System damageRelated Laws..Electronic fraud Electronic forgery Misuse of devices Misuse of encryption Malicious code Cyber stalking Spamming Spoofing Unauthorized interception Cyber Terrorism Waging cyber war Enhanced punishment for offences involving sensitive electronic systems Attempt and aiding or abetting Cyber Law SocietyCyber Laws awareness is in Process!Information System ControlInformation System ControlProper control of data can save time and money when responding to legal request.Computer ForensicIt is the Scientific collection, examination, authentication, preservation, and analysis of data from computer storage media for use as evidence in court of law.It Includes recovery of ambient and hidden dataInformation System ControlInformation system control can be viewed asManual and automated controlGeneral and application control.Manual and automated controlManual control is achieved by manual manipulation of system. For example placing a server in highly security zone etc.Automated control is the set of computerized tasks to achieve security of the overall system.Information System ControlGeneral ControlGovern design, security, and use of computer programs and security of data files in general throughout organization’s information technology infrastructure.Apply to all computerized applicationsCombination of hardware, software, and manual procedures to create overall control environmentInformation System Control..Types of general controlsSoftware controlsHardware controlsComputer operations controlsData security controlsImplementation controlsAdministrative controlsInformation System ControlApplication controlsSpecific controls unique to each computerized application, such as payroll or order processingInclude both automated and manual proceduresEnsure that only authorized data are completely and accurately processed by that applicationInclude:Input controlsProcessing controlsOutput controlsRisk AssessmentDetermines level of risk to firm if specific activity or process is not properly controlledTypes of threatProbability of occurrence during yearPotential losses, value of threatExpected annual lossEXPOSUREPROBABILITYLOSS RANGE (AVG)EXPECTED ANNUAL LOSSPower failure30%$5K - $200K ($102,500)$30,750Embezzlement5%$1K - $50K ($25,500)$1,275User error98%$200 - $40K ($20,100)$19,698Security PolicyRanks information risks, identifies acceptable security goals, and identifies mechanisms for achieving these goals.Drives other policiesAcceptable use policy (AUP)Defines acceptable uses of firm’s information resources and computing equipmentAuthorization policiesDetermine differing levels of user access to informationIdentity managementBusiness processes and tools to identify valid users of system and control accessIdentifies and authorizes different categories of usersSpecifies which portion of system users can accessAuthenticating users and protects identitiesIdentity management systemsCaptures access rules for different levels of usersThese two examples represent two security profiles or data security patterns that might be found in a personnel system. Depending on the security profile, a user would have certain restrictions on access to various systems, locations, or data in an organization.Disaster Recovery PlanDisaster recovery planning: Devise plans for restoration of disrupted servicesBusiness continuity planning: Focuses on restoring business operations after disasterBoth types of plans needed to identify firm’s most critical systemsBusiness impact analysis to determine impact of an outageManagement must determine which systems restored firstInformation System Audit MIS auditExamines firm’s overall security environment as well as controls governing individual information systemsReviews technologies, procedures, documentation, training, and personnel. May even simulate disaster to test response of technology, IS staff, other employees.Lists and ranks all control weaknesses and estimates probability of their occurrence. Assesses financial and organizational impact of each threatThis chart is a sample page from a list of control weaknesses that an auditor might find in a loan system in a local commercial bank. This form helps auditors record and evaluate control weaknesses and shows the results of discussing those weaknesses with management, as well as any corrective actions taken by management.Technologies and Tools for ProtectionTechnologies and Tools for ProtectionIdentity management softwareAutomates keeping track of all users and privilegesAuthenticates users, protecting identities, controlling accessAuthenticationPassword systemsTokensSmart cardsBiometric authenticationTechnologies and Tools for ProtectionFirewall: Combination of hardware and software that prevents unauthorized users from accessing private networksTechnologies include:Static packet filteringNetwork address translation (NAT)Application proxy filteringThe firewall is placed between the firm’s private network and the public Internet or another distrusted network to protect against unauthorizedtraffic.Technologies and Tools for ProtectionIntrusion detection systems:Monitor hot spots on corporate networks to detect and prevent intrudersExamines events as they are happening to discover attacks in progressAntivirus and antispyware software:Checks computers for presence of malware and can often eliminate it as wellRequire continual updatingUnified threat management (UTM) systemsTechnologies and Tools for ProtectionEncryption: Transforming text or data into cipher text that cannot be read by unintended recipientsTwo methods for encryption on networksSecure Sockets Layer (SSL) and successor Transport Layer Security (TLS)Secure Hypertext Transfer Protocol (S-HTTP)Technologies and Tools for ProtectionTwo methods of encryptionSymmetric key encryptionSender and receiver use single, shared keyPublic key encryptionUses two, mathematically related keys: Public key and private keySender encrypts message with recipient’s public keyRecipient decrypts with private keyA public key encryption system can be viewed as a series of public and private keys that lock data when they are transmitted and unlock the data when they are received. The sender locates the recipient’s public key in a directory and uses it to encrypt a message. The message is sent in encrypted form over the Internet or a private network. When the encrypted message arrives, the recipient uses his or her private key to decrypt the data and read the message.Technologies and Tools for ProtectionDigital certificate: Data file used to establish the identity of users and electronic assets for protection of online transactionsUses a trusted third party, certification authority (CA), to validate a user’s identityCA verifies user’s identity, stores information in CA server, which generates encrypted digital certificate containing owner ID information and copy of owner’s public keyPublic key infrastructure (PKI)Use of public key cryptography working with certificate authorityWidely used in e-commerceDigital certificates help establish the identity of people or electronic assets. They protect online transactions by providing secure, encrypted, online communication.Digital Certificate ExampleTechnologies and Tools for ProtectionEnsuring system availabilityOnline transaction processing requires 100% availability, no downtimeFault-tolerant computer systemsFor continuous availability, e.g. stock marketsContain redundant hardware, software, and power supply components that create an environment that provides continuous, uninterrupted serviceHigh-availability computingHelps recover quickly from crashMinimizes, does not eliminate downtimeTechnologies and Tools for ProtectionRecovery-oriented computingDesigning systems that recover quickly with capabilities to help operators pinpoint and correct faults in multi-component systemsControlling network trafficDeep packet inspection (DPI) Video and music blockingSecurity outsourcingManaged security service providers (MSSPs)Technologies and Tools for ProtectionEnsuring software qualitySoftware metrics: Objective assessments of system in form of quantified measurementsNumber of transactionsOnline response timePayroll checks printed per hourKnown bugs per hundred lines of codeEarly and regular testingWalkthrough: Review of specification or design document by small group of qualified peopleDebugging: Process by which errors are eliminatedSummaryInformation system security is critical matter which organizations must take care of.Security can not be by itself.It is the responsibility of every employee in an organization.There exists wide range of security threats which can be harmful for the data.Technological help can be taken to enforce proper security mechanism.More study![1] Laudon, Management Information Systems: Managing The Digital Firms.  Prentice Hall, 2012.Chapter 8.