Information Systems Security Chapter  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5–1 Learning Objective Describe general approaches to analyzing vulnerabilities and threats in information systems  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5–2 Overview The information security system is the subsystem of the organization that controls the special risks associated with computer-based information systems The information security system has the basic elements of any information system, such as hardware, databases, procedures, and reports  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5–3 The Information Security System Life Cycle Life-cycle Phase Objective Analyze system vulnerabilities Systems analysis in terms of relevant threats and their associated loss exposure Systems design Design security measures and contingency plans to control the identified loss exposures  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5–4 The Information Security System Life Cycle Life-cycle Phase Systems implementation Systems operation, evaluation, and control Objective Implement the security measures as designed Operate the system and assess its effectiveness and efficiency Make changes as circumstances require  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5–5 The Information Security System in the Organization The information security system must be managed by a chief security officer (CSO) This individual should report directly to the board of directors in order to maintain complete independence  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5–6 Analyzing Vulnerabilities and Threats Quantitative approach to risk assessment Qualitative approach  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5–7 Analyzing Vulnerabilities and Threats Cost of an individual loss × Likelihood of its occurrence  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5–8 Analyzing Vulnerabilities and Threats Identifying the relevant costs per loss and the associated likelihoods can be difficult Estimating the likelihood of a given failure requires predicting the future, which is very difficult  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5–9 Analyzing Vulnerabilities and Threats The system’s vulnerabilities and threats are subjectively ranked in order of their contribution to the company’s total loss exposure  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– Controls for Active Threats Site-access controls System-access controls File-access controls  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– Controls for Active Threats The objective of site-access controls is to physically separate unauthorized individuals from computer resources  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– Controls for Active Threats TV monitor Telephone Locked door (opened from inside vault) Locked door (entrance) Locked door LOBBY Intercom to vault Scanner Magnet detector Service window Data archive INNER VAULT  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– Controls for Active Threats These controls authenticate users by using such means as user IDs, passwords, IP addresses, and hardware devices It is often desirable to withhold “administrative rights” from individual PC users  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– Controls for Active Threats The most fundamental file-access control is the establishment of authorization guidelines and procedures for accessing and altering files  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– Controls for Passive Threats Fault-tolerant systems use redundant components If one part of the system fails, a redundant part immediately takes over, and the system continues operating with little or no interruption  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– Controls for Passive Threats Full backups Incremental backups Differential backups  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– Internet Security Internet-related vulnerabilities may arise from weaknesses in five areas the operating system or its configuration the Web server or its configuration the private network and its configuration various server programs general security procedures  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– Learning Objective Discuss contingency planning and other disaster risk management practices  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– Disaster Risk Management Disaster risk management is essential to ensure continuity of operations in the event of a catastrophe Prevention planning Contingency planning  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– Disaster Risk Management Natural disaster Deliberate actions Human error 30% 45% 25% A large percentage of disasters can be mitigated or avoided  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– Disaster Risk Management A disaster recovery plan must be implemented at the highest levels in the company The first step in developing a disaster recovery plan should be obtaining the support of senior management and setting up a planning committee  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– Disaster Risk Management The design of the plan should include three major components What are these components?  Assess the company’s critical needs  List priorities for recovery  Establish recovery strategies and procedures  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– Disaster Risk Management A complete set of recovery strategies should take into account the following:  emergency response center  escalation procedures  alternate processing arrangements  personnel relocation and replacements plans  salvage plan  plan for testing and maintaining the system  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood 5– End of Chapter  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/Hopwood – 43 ... approaches to analyzing vulnerabilities and threats in information systems  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/ Hopwood 5–2 Overview The information. .. Publishing, Accounting Information Systems, 9/e, by Bodnar/ Hopwood 5–4 The Information Security System Life Cycle Life-cycle Phase Systems implementation Systems operation, evaluation, and control... Operate the system and assess its effectiveness and efficiency Make changes as circumstances require  2004 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, by Bodnar/ Hopwood