Copyright © 2003 by Prentice Hall Computers: Tools for an Information Age Chapter 10 Security and Privacy: Computers and the Internet.

2Copyright © 2003 by Prentice Hall Objectives Explain the different types of computer crime and the difficulties of discovery and prosecution Describe the aspects of securing corporate data, including software and data security, disaster recovery plans, and security legislation Describe in general terms how viruses work, the damage they can cause, and procedures used to prevent this damage Explain the threats to personal privacy posed by computers and the Internet. Describe actions you can take to maximize your privacy

3Copyright © 2003 by Prentice Hall Security and Privacy Security – data stored on computer must be kept safe, safe from destruction, accidental damage and theft Privacy – private data must be kept from inquisitive eyes

4Copyright © 2003 by Prentice Hall Computer Crime Hacker – someone who attempts to gain access to computer systems illegally via a data communication network usually from a PC Originally referred to as someone with a high degree of computer expertise Originally referred to as someone with a high degree of computer expertise Also invades web sites Also invades web sites Deface sites with their own private jokes Social engineering – a tongue-in-cheek term for con artist actions Social engineering – a tongue-in-cheek term for con artist actions Persuade people to give away password Persuade people to give away password information over the phone information over the phone Cracker – someone who uses the computer to engage in illegal activity In this case the hackers destroy data files and did not use the system to steal money or property In this case the hackers destroy data files and did not use the system to steal money or property

5Copyright © 2003 by Prentice Hall Computer Crime Initially just software theft or data destruction The increased access to networks made computer crimes easy Most commonly reported categories Credit card fraud Credit card fraud Floating all over public and private networks in varying states of protection. Some are captured and fraudulently

6Copyright © 2003 by Prentice Hall Computer Crime Data communications fraud Data communications fraud includes piggyback on someone else’s network, the use of an office network for personal purposes and computer directed diversion of funds Unauthorized access to computer files Unauthorized access to computer files Covers accessing confidential employee records to the theft of trade secrets and product pricing structures Unlawful copying of copyrighted software Unlawful copying of copyrighted software Casual sharing of copyrighted software with friends

7Copyright © 2003 by Prentice Hall Methods Computer Criminals Use Bomb Data diddling Data diddling Denial of service attacks Denial of service attacks Piggybacking Salami technique Salami technique Scavenging Trapdoor Trojan horse Trojan horse Zapping

8Copyright © 2003 by Prentice Hall Bomb Causes a program to trigger damage under certain conditions Usually set to go off at a later date Usually set to go off at a later date Sometimes planted in commercial software Shareware is more prone to having a bomb planted in it Shareware is more prone to having a bomb planted in it Return

10Copyright © 2003 by Prentice Hall Denial of Service Attack Hackers bombard a site with more requests than it can possibly handle Prevents legitimate users from accessing the site Prevents legitimate users from accessing the site Hackers can cause attacks to come from many different sites simultaneously through the use of trojan horse programs planted on unsuspecting sites Hackers can cause attacks to come from many different sites simultaneously through the use of trojan horse programs planted on unsuspecting sites Return

11Copyright © 2003 by Prentice Hall piggybacking An illicit user “rides” into the system on the back of an authorized user If the user does not exit the system properly, the intruder can continue where the original user has left off If the user does not exit the system properly, the intruder can continue where the original user has left off Always log out of any system you log into Return

12Copyright © 2003 by Prentice Hall Salami Technique An embezzlement technique where small “slices” of money are squirreled away undetected from large financial systems and funneled into salami accounts Would not work today as auditors are much too knowledgeable Would not work today as auditors are much too knowledgeable

13Copyright © 2003 by Prentice Hall Scavenging Searching company trash cans and dumpsters for lists of information Thieves will search garbage and recycling bins of individuals looking for bank account numbers, credit card numbers, etc. Thieves will search garbage and recycling bins of individuals looking for bank account numbers, credit card numbers, etc. Shred documents that contain personal information Return

14Copyright © 2003 by Prentice Hall Trapdoor An illicit program left within a completed legitimate program Allows subsequent unauthorized and unknown entry by the perpetrator to make changes to the program Allows subsequent unauthorized and unknown entry by the perpetrator to make changes to the program Not available to average person but the programmer who has the skills to do it can cause great damage Not available to average person but the programmer who has the skills to do it can cause great damage Damage includes altering the method of program processing to destroying records and files Damage includes altering the method of program processing to destroying records and files

15Copyright © 2003 by Prentice Hall Trojan Horse Involves illegal instructions placed in the middle of a legitimate program Program does something useful, but the Trojan horse instructions do something destructive in the background Program does something useful, but the Trojan horse instructions do something destructive in the background Return

17Copyright © 2003 by Prentice Hall White-Hat Hackers The hackers approach is to access company’s system from the internet Quality of security varies from company to company Hackers that are paid by a company to break into that company’s computer systems Expose security holes and flaws before criminals find them Expose security holes and flaws before criminals find them Use same kind of tricks that a hacker does Use same kind of tricks that a hacker does Once exposed, flaws can be fixed Once exposed, flaws can be fixed Sometimes companies hire one company to establish security and then hire white hat hackers to try to defeat it Sometimes companies hire one company to establish security and then hire white hat hackers to try to defeat it The company might not alert its employees to the hacker activities and check whether the intrusions are detected and how employees react The company might not alert its employees to the hacker activities and check whether the intrusions are detected and how employees react

18Copyright © 2003 by Prentice Hall Discovery and Prosecution Crimes are often undetected When they are detected, they are often not reported because businesses are worried about their reputation When they are detected, they are often not reported because businesses are worried about their reputation Prosecuting computer criminal is difficult Even if a computer crime is detected, prosecution is not assured Law enforcement agencies do not understand the complexities of computer related fraud Law enforcement agencies do not understand the complexities of computer related fraud Law enforcement agencies and prosecutors are ill-equipped and not qualified to handle computer crime Law enforcement agencies and prosecutors are ill-equipped and not qualified to handle computer crime Judges and juries often not educated about computers and don’t understand the seriousness of computer crime Judges and juries often not educated about computers and don’t understand the seriousness of computer crime Congress passed the Computer Fraud and Abuse Act to increase awareness of computer crime Most states have passed some form of computer crime law Most states have passed some form of computer crime law

19Copyright © 2003 by Prentice Hall Computer Forensics Uncovering computer-stored information suitable for use as evidence in courts of law Restores files and/or e-mail messages that someone has deleted Restores files and/or e-mail messages that someone has deleted Such data is not safely hidden from professionals known as forensic experts Such data is not safely hidden from professionals known as forensic experts Some experts are available for hire, but most are on the staffs of police departments and law firms

20Copyright © 2003 by Prentice Hall Computer Forensics Used both in civil and criminal cases Each computer forensic examination is unique in its purpose and method of approach One company might need to trace missing inventory One company might need to trace missing inventory Some forensic experts have set up shop and are for hire and even advertise on their own websites Most such experts are on the staffs of police departments and law firms Most such experts are on the staffs of police departments and law firms

21Copyright © 2003 by Prentice Hall Security: Playing It Safe Security – a system of safeguards Protects system and data from deliberate or accidental damage Protects system and data from deliberate or accidental damage Protects system and data from unauthorized access Protects system and data from unauthorized access

22Copyright © 2003 by Prentice Hall Controlling Access Four means of controlling who has access to the computer What you have What you have What you have What you have What you know What you know What you know What you know What you do What you do What you do What you do What you are What you are What you are What you are

23 What You Have Requires you to have some device to gain access to the computer Badge, key, or card to give you physical access to the computer room or a locked terminal Badge, key, or card to give you physical access to the computer room or a locked terminal Debit card with a magnetic strip gives you access to your bank account at an ATM Debit card with a magnetic strip gives you access to your bank account at an ATM Active badge broadcasts your location by sending out radio signals Active badge broadcasts your location by sending out radio signals A clip on identification card with an embedded computer chip

24Copyright © 2003 by Prentice Hall What You Know Requires you to know something to gain access Password and login name give you access to computer system Password and login name give you access to computer system Cipher locks on doors require you to know the combination of numbers to get in Cipher locks on doors require you to know the combination of numbers to get in Return

26Copyright © 2003 by Prentice Hall What You Are Uses biometrics – the science of measuring body characteristics Uses fingerprinting, voice pattern, retinal scan, etc. to identify a person Uses fingerprinting, voice pattern, retinal scan, etc. to identify a person Some systems use the characteristics of entire hand Some systems use the characteristics of entire hand Can combine fingerprinting and reading a smart card to authenticate Return

What do you have to lose Hardware Not a major problem and covered by insurance and can be replaced Not a major problem and covered by insurance and can be replaced True problem is the diminished processing ability exists while managers find a substitute facility and return to its former state True problem is the diminished processing ability exists while managers find a substitute facility and return to its former state Software loss should not be a problem because organizations make back up copies More important problem is the loss of data 27Copyright © 2003 by Prentice Hall

28Copyright © 2003 by Prentice Hall A Disaster Recovery Plan A method of restoring computer processing operations and data files in the event of major destruction and if operations are halted and files are damages by major destructions Several approaches Revert to Manual services Revert to Manual services Life without computers is difficult Buying time at a service bureau Buying time at a service bureau Inconvenient for companies in remote areas

A Disaster Recovery Plan Mutual aid pact Mutual aid pact If for example fire destroys the computing facility then two or more companies agree to lend each other computing power if one of them is having problem If there is regional disaster and many companies needed assistance  Consortium 29Copyright © 2003 by Prentice Hall

30 A Disaster Recovery Plan A joint venture among firms to support a complete computer facility Used only in the event of a disaster Used only in the event of a disaster Routinely tested Routinely tested Hot site – a fully equipped computer center with hardware, environmental controls, security and communication facilities Hot site – a fully equipped computer center with hardware, environmental controls, security and communication facilities Cold site – an empty shell in which a company can install its own computer system Cold site – an empty shell in which a company can install its own computer system

A Disaster Recovery Plan The idea is that everything except the hardware has been stored in a safe place Should be several miles away so that it will not be affected by local physical forces Typical items stored at the backup site are program and data files, program listings, program and OS documentation, hardware inventory lists, output forms and disaster plan manual 31

A Disaster Recovery Plan Should include a list of priorities identifying the programs that must be run first Plans for notifying employees of changes in locations and procedures A list of needed equipment and where it can be obtained List of alternating computing facilities Procedures for handling input and output data in a different environment 32

33Copyright © 2003 by Prentice Hall Software Security Who owns custom-made software Is the owner the person who wrote the program or the company for which the program is written? Is the owner the person who wrote the program or the company for which the program is written? What prevents a programmer from taking a copy of the program from one job to another?

Software Security Answer is well established If the programmer is employed by the company, the software belongs to the company If the programmer is employed by the company, the software belongs to the company The programmer may not take the software along to the next job If the programmer is a consultant, ownership of the software should be specified in the contract If the programmer is a consultant, ownership of the software should be specified in the contract 34Copyright © 2003 by Prentice Hall

35 Data Security Several techniques can be taken to prevent theft or alteration of data Secured waste Secured waste Discarded printouts, printer ribbons can be the source of information This kind of waste can be made secure by the use of shredders Internal controls Internal controls These are controls that are planned as part of the computer system Example is transaction log which is a file of accesses or attempted accesses to certain data

Data Security Auditor checks Auditor checks Auditors frequently review programs and data Might check who has accessed data during periods when that data is not usually used Can use off-the-shelf software that assess the validity and accuracy of system’s operations and output Applicant screening Applicant screening Employees who are hired for sensitive positions should undergo complete background checks 36Copyright © 2003 by Prentice Hall

Data Security Passwords Passwords Must be typed to gain access to a computer system Cracking password is the most prevalent method of illicit entry to computer systems Built-in software protection Built-in software protection One form of software protection is a system that matches a user number against a assigned to data being accessed If a person does not get access, it is recorded that he or she to tap into the same area for which he was not authorized If a person does not get access, it is recorded that he or she to tap into the same area for which he was not authorized Another form is a user profile Information is stored about each user including the files to which user has legitimate access Information is stored about each user including the files to which user has legitimate access 37

38Copyright © 2003 by Prentice Hall Personal Computer Security There is an active market for stolen PCs and their components Physical security of hardware Secure hardware in place with locks and cables Secure hardware in place with locks and cables Most PCs have an individual cover lock that prevents access to internal components Most PCs have an individual cover lock that prevents access to internal components Avoid eating, drinking, and smoking around computers Avoid eating, drinking, and smoking around computers Occasional cleaning is recommended Occasional cleaning is recommended

39Copyright © 2003 by Prentice Hall Protecting Disk Data Use a surge protector to prevent electrical problems from affecting data files The computer is plugged into the surge protector The computer is plugged into the surge protector Uninterruptible power supply includes surge protection and battery backup Enables us to continue operating your PC during power loss Enables us to continue operating your PC during power loss Provides battery power in the event power is lost Provides battery power in the event power is lost Allows users to save work and close files properly Allows users to save work and close files properly Diskettes should be under lock and key Diskettes should be under lock and key Back up files regularly

40Copyright © 2003 by Prentice Hall Backing Up Files Personal computer users are not as used to backup data files on regular basis Back up to tape drive, CD-RW, or DVD- RAM You can use software that automatically backs up at a certain type of day You can use software that automatically backs up at a certain type of day Disk mirroring Makes second copy of everything you put on disk to another hard disk Makes second copy of everything you put on disk to another hard disk

What could go wrong Software itself can harm data Hard disk could malfunction making file inaccessible You can accidentally delete files Can be recovered using utility software Files can be infected with virus

42 Types of Backup A better way is to back up all your files on a tape, CD-RW or DVD-RAM is safer and faster Use software that will automatically back up all your files at a certain time of the day or on command Use software that will automatically back up all your files at a certain time of the day or on command An expensive approach used by the sophisticated users place their files on mirror hard disk, which makes a copy of everything you put on original disk An expensive approach used by the sophisticated users place their files on mirror hard disk, which makes a copy of everything you put on original disk Three types of backup Full backup – copies everything from the hard drive Full backup – copies everything from the hard drive Differential backup – copies all files that have been changed since the last full backup Differential backup – copies all files that have been changed since the last full backup Incremental backup – copies only those files that have been changed since either the last full backup or the last incremental backup Incremental backup – copies only those files that have been changed since either the last full backup or the last incremental backup Comprehensive backup plan involves periodic full backups, complemented by more frequent incremental or differential backups With the differential approach the restoration process requires the use of two backup files The last full backward followed by the most recent differential backup The last full backward followed by the most recent differential backup Restoration with incremental approach can require the last full backup followed by each incremental backup performed since the full backup

44Copyright © 2003 by Prentice Hall Worm A program that transfers itself from computer to computer over a network Plants itself as a separate file on the target computer’s disks Plants itself as a separate file on the target computer’s disks Fairly rare Fairly rare SQL Slammer worm disabled many Web servers in January 2003 Return

46Copyright © 2003 by Prentice Hall Transmitting a Virus Viral instructions inserted into a game or file Typically distributed via the Web or e-mail Typically distributed via the Web or e-mail Users download the file onto their computers Every time the user opens that file, virus is loaded into memory As other files are loaded into memory, they become infected As other files are loaded into memory, they become infected Return

47Copyright © 2003 by Prentice Hall Damage from Viruses Some are benign, but many cause serious damage Some attach themselves to operating systems, where they can affect how the computer works Some attach themselves to operating systems, where they can affect how the computer works Some delete data files or attempt to reformat your hard disk Some delete data files or attempt to reformat your hard disk Macro virus uses a program’s own programming language to distribute itself Macro virus uses a program’s own programming language to distribute itself Organizations and individuals spend billions of dollars defending computers against viruses Return

48Copyright © 2003 by Prentice Hall Virus Prevention Antivirus software Detects virus signature Detects virus signature Scans hard disk every time you boot the computer Scans hard disk every time you boot the computer Viruses tend to show up on free software or software downloaded from the Internet Use antivirus software to scan files before you load them on your computer Use antivirus software to scan files before you load them on your computer Often distributed as e-mail attachments Do not open e-mail attachments without scanning them or if you do not know the person sending the e- mail Do not open e-mail attachments without scanning them or if you do not know the person sending the e- mail Return

49Copyright © 2003 by Prentice Hall Virus Myths You cannot get infected by simply being online If you download and execute an infected file, you can get infected If you download and execute an infected file, you can get infected Although most e-mail viruses are in attachments that must be opened, it is possible to get infected by viewing an e-mail You cannot get infected from data If graphics files include a viewer, that program could contain a virus If graphics files include a viewer, that program could contain a virus Return

50Copyright © 2003 by Prentice Hall Protecting Your Privacy Data you give to organizations is often sold or rented to other organizations Massive databases make it easy and inexpensive to learn almost anything about anybody Massive databases make it easy and inexpensive to learn almost anything about anybody LegislationLegislation exists to protect your privacy Legislation

51Copyright © 2003 by Prentice Hall Privacy Legislation Fair Credit Reporting Act Fair Credit Reporting Act Freedom of Information Act Freedom of Information Act Federal Privacy Act Federal Privacy Act Video Privacy Protection Act Video Privacy Protection Act Computer Matching and Privacy Protection Act Computer Matching and Privacy Protection Act Health Insurance Portability and Accountability Act Health Insurance Portability and Accountability Act

52Copyright © 2003 by Prentice Hall Fair Credit Reporting Act Gives you access to your credit information Must be provided free if you have been denied credit Must be provided free if you have been denied credit Gives you the right to challenge your credit records Return

54Copyright © 2003 by Prentice Hall Federal Privacy Act Stipulates there can be no secret personal files Individuals must know what is stored in files about them and how the data will be used Organizations must be able to justify the need to obtain information Return

57Copyright © 2003 by Prentice Hall Health Insurance Portability and Accountability Act Governs the security of health information records Requires employers, health care providers, and insurance companies to take steps to protect employees’ medical records Return

58Copyright © 2003 by Prentice Hall Security and Privacy Problems on the Internet With so many people on the Internet, how do you keep data secure? Several approaches Using a firewall Using a firewall Using a firewall Using a firewall Encryption Encryption Encryption Privacy issues Being monitored Being monitored Being monitored Being monitored Junk e-mail Junk e-mail Junk e-mail Junk e-mail

59Copyright © 2003 by Prentice Hall A Firewall A combination of hardware and software that sits between an organization’s network and the Internet All traffic between the two goes through the firewall All traffic between the two goes through the firewall Protects the organization from unauthorized access Protects the organization from unauthorized access Can prevent internal users from accessing inappropriate Internet sites Can prevent internal users from accessing inappropriate Internet sites Return

60Copyright © 2003 by Prentice Hall Encryption Scrambling data so that it can only be read by a computer with the appropriate key Encryption key converts the message into an unreadable form Encryption key converts the message into an unreadable form Message can be decrypted only by someone with the proper key Message can be decrypted only by someone with the proper key Private key encryption – senders and receivers share the same key Public key encryption – encryption software generates the key Return

61Copyright © 2003 by Prentice Hall Being Monitored Employers can monitor employees’ e-mail, use of the Internet, and count the number of keystrokes per minute Employees are often unaware they are being monitored Employees are often unaware they are being monitored Web sites can easily collect information when a user just visits the site Web sites use cookies to store your preferences Web sites use cookies to store your preferencescookies Return

62Copyright © 2003 by Prentice Hall Cookies A small text file stored on your hard drive File is sent back to the server each time you visit that site Stores preferences, allowing Web site to be customized Stores preferences, allowing Web site to be customized Stores passwords, allowing you to visit multiple pages within the site without logging in to each one Stores passwords, allowing you to visit multiple pages within the site without logging in to each one Tracks surfing habits, targeting you for specific types of advertisements Tracks surfing habits, targeting you for specific types of advertisements Return

63Copyright © 2003 by Prentice Hall Spamming Mass advertising via e-mail Can overflow your e-mail inbox Can overflow your e-mail inbox Bogs down your e-mail server, increasing the cost of e-mail service Bogs down your e-mail server, increasing the cost of e-mail service Preventing spam Preventing spam Return

64Copyright © 2003 by Prentice Hall Preventing Spam Many ways you can minimize junk e-mail Be careful how you give out your e-mail address Be careful how you give out your e-mail address Filtering software allows you to block messages or send them to designated folders Filtering software allows you to block messages or send them to designated folders Don’t register at Web sites without a promise the Web site will not sell your information Don’t register at Web sites without a promise the Web site will not sell your information NEVER respond to spam NEVER respond to spam Antispamming legislation is being proposed in many states Return

Copyright © 2003 by Prentice Hall Computers: Tools for an Information Age Chapter 10 Security and Privacy: Computers and the Internet.

Similar presentations

Presentation on theme: "Copyright © 2003 by Prentice Hall Computers: Tools for an Information Age Chapter 10 Security and Privacy: Computers and the Internet."— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Copyright © 2003 by Prentice Hall Computers: Tools for an Information Age Chapter 10 Security and Privacy: Computers and the Internet.

Similar presentations

Presentation on theme: "Copyright © 2003 by Prentice Hall Computers: Tools for an Information Age Chapter 10 Security and Privacy: Computers and the Internet."— Presentation transcript:

Similar presentations

About project

Feedback