© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart1 of 222 C HAPTER 7 Information Systems Controls for Systems.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart2 of 222 INTRODUCTION Questions to be addressed in this chapter: –How does security affect systems reliability? –What are the four criteria that can be used to evaluate the effectiveness of an organization’s information security? –What is the time-based model of security and the concept of defense-in-depth? –What types of preventive, detective, and corrective controls are used to provide information security? –How does encryption contribute to security and how do the two basic types of encryption systems work?

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart3 of 222 INTRODUCTION One basic function of an AIS is to provide information useful for decision making. In order to be useful, the information must be reliable, which means: –It provides an accurate, complete, and timely picture of the organization’s activities. –It is available when needed. –The information and the system that produces it is protected from loss, compromise, and theft.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart4 of 222 INTRODUCTION The five basic principles that contribute to systems reliability: SYSTEMS RELIABILITY

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart5 of 222 INTRODUCTION The five basic principles that contribute to systems reliability: –Security SECURITY SYSTEMS RELIABILITY Access to the system and its data is controlled.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart6 of 222 INTRODUCTION The five basic principles that contribute to systems reliability: –Security –Confidentiality SECURITY CONFIDENTIALITY SYSTEMS RELIABILITY Sensitive information is protected from unauthorized disclosure.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart7 of 222 INTRODUCTION The five basic principles that contribute to systems reliability: –Security –Confidentiality –Privacy SECURITY CONFIDENTIALITY PRIVACY SYSTEMS RELIABILITY  Personal information about customers collected through e- commerce is collected, used, disclosed, and maintained in an appropriate manner.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart8 of 222 INTRODUCTION The five basic principles that contribute to systems reliability: –Security –Confidentiality –Privacy –Processing integrity SECURITY CONFIDENTIALITY PRIVACY PROCESSING INTEGRITY SYSTEMS RELIABILITY Data is processed: –Accurately –Completely –In a timely manner –With proper authorization

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart9 of 222 INTRODUCTION The five basic principles that contribute to systems reliability: –Security –Confidentiality –Online privacy –Processing integrity –Availability SECURITY CONFIDENTIALITY PRIVACY PROCESSING INTEGRITY AVAILABILITY SYSTEMS RELIABILITY  The system is available to meet operational and contractual obligations.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart10 of 222 INTRODUCTION Note the importance of security in this picture. It is the foundation of systems reliability. Security procedures: –Restrict system access to only authorized users and protect: The confidentiality of sensitive organizational data. The privacy of personal identifying information collected from customers. SECURITY CONFIDENTIALITY PRIVACY PROCESSING INTEGRITY AVAILABILITY SYSTEMS RELIABILITY

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart11 of 222 INTRODUCTION Security procedures also: –Provide for processing integrity by preventing: Submission of unauthorized or fictitious transactions. Unauthorized changes to stored data or programs. –Protect against a variety of attacks, including viruses and worms, thereby ensuring the system is available when needed. SECURITY CONFIDENTIALITY PRIVACY PROCESSING INTEGRITY AVAILABILITY SYSTEMS RELIABILITY

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart12 of 222 C OBI T and Trust Services Control Objectives for Information Technology (C OBI T) Information systems controls required for achieving business and governance objectives Adequate Controls

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart13 of 222 FUNDAMENTAL INFORMATION SECURITY CONCEPTS There are three fundamental information security concepts that will be discussed in this chapter: –Security as a management issue, not a technology issue. –The time-based model of security. –Defense in depth.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart14 of 222 FUNDAMENTAL INFORMATION SECURITY CONCEPTS There are three fundamental information security concepts that will be discussed in this chapter: –Security as a management issue, not a technology issue. –The time-based model of security. –Defense in depth.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart15 of 222 SECURITY AS A MANAGEMENT ISSUE Though information security is a complex technical subject, security is first and foremost a top management issue, not an IT issue.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart16 of 222 SECURITY AS A MANAGEMENT ISSUE Management is responsible for the accuracy of various internal reports and financial statements produced by the organization’s IS. –SOX Section 302 requires that the CEO and CFO certify the accuracy of the financial statements. –SOX Section 404 requires that the annual report include a report on the company’s internal controls. Within this report, management acknowledges their responsibility for designing and maintaining internal controls and assessing their effectiveness. –Security is a key component of the internal control and systems reliability to which management must attest. –As identified in the COSO model, management’s philosophy and operating style are critical to an effective control environment.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart17 of 222 SECURITY AS A MANAGEMENT ISSUE The Trust Services framework identifies four essential criteria for successfully implementing the five principles of systems reliability:Trust Services –Develop and document policies. –Effectively communicate those policies to all authorized users. –Design and employ appropriate control procedures to implement those policies. –Monitor the system, and take corrective action to maintain compliance with the policies. Top management involvement and support is necessary to satisfy each of the preceding criteria.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart18 of 222 FUNDAMENTAL INFORMATION SECURITY CONCEPTS There are three fundamental information security concepts that will be discussed in this chapter: –Security is a management issue, not a technology issue. –The time-based model of security. –Defense in depth.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart19 of 222 TIME-BASED MODEL OF SECURITY Given enough time and resources, any preventive control can be circumvented. Consequently, effective control requires supplementing preventive procedures with: –Methods for detecting incidents; and –Procedures for taking corrective remedial action. Detection and correction must be timely, especially for information security, because once preventive controls have been breached, it takes little time to destroy, compromise, or steal the organization’s economic and information resources.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart20 of 222 TIME-BASED MODEL OF SECURITY The time-based model of security focuses on implementing a set of preventive, detective, and corrective controls that enable an organization to recognize that an attack is occurring and take steps to thwart it before any assets have been compromised. All three types of controls are necessary: –Preventive Limit actions to those in accord with the organization’s security policy and disallows all others.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart21 of 222 TIME-BASED MODEL OF SECURITY The time-based model of security focuses on implementing a set of preventive, detective, and corrective controls that enable an organization to recognize that an attack is occurring and take steps to thwart it before any assets have been compromised. All three types of controls are necessary: –Preventive –Detective  Identify when preventive controls have been breached.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart22 of 222 TIME-BASED MODEL OF SECURITY The time-based model of security focuses on implementing a set of preventive, detective, and corrective controls that enable an organization to recognize that an attack is occurring and take steps to thwart it before any assets have been compromised. All three types of controls are necessary: –Preventive –Detective –Corrective Repair damage from problems that have occurred. Improve preventive and detective controls to reduce likelihood of similar incidents.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart23 of 222 TIME-BASED MODEL OF SECURITY The time-based model evaluates the effectiveness of an organization’s security by measuring and comparing the relationship among three variables: –P = Time it takes an attacker to break through the organization’s preventive controls. –D = Time it takes to detect that an attack is in progress. –C = Time to respond to the attack. These three variables are evaluated as follows: –If P > (D + C), then security procedures are effective. –Otherwise, security is ineffective.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart24 of 222 FUNDAMENTAL INFORMATION SECURITY CONCEPTS There are three fundamental information security concepts that will be discussed in this chapter: –Security is a management issue, not a technology issue. –The time-based model of security. –Defense in depth.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart25 of 222 DEFENSE IN DEPTH The idea of defense-in-depth is to employ multiple layers of controls to avoid having a single point of failure. If one layer fails, another may function as planned. Information security involves using a combination of firewalls, passwords, and other preventive procedures to restrict access. Redundancy also applies to detective and corrective controls.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart26 of 222 DEFENSE IN DEPTH  Major types of preventive controls used for defense in depth include: –Authentication controls (passwords, tokens, biometrics, MAC addresses) –Authorization controls (access control matrices and compatibility tests) –Training –Physical access controls (locks, guards, biometric devices) –Remote access controls (IP packet filtering by border routers and firewalls using access control lists; intrusion prevention systems; authentication of dial-in users; wireless access controls) –Host and application hardening procedures (firewalls, anti-virus software, disabling of unnecessary features, user account management, software design, e.g., to prevent buffer overflows) –Encryption

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart27 of 222 DEFENSE IN DEPTH Detective controls include: –Log analysis –Intrusion detection systems –Managerial reports –Security testing (vulnerability scanners, penetration tests, war dialing)

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart28 of 222 DEFENSE IN DEPTH Corrective controls include: –Computer emergency response teams –Chief Security Officer (CSO) –Patch Management

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart29 of 222 Understanding Targeted Attacks How are they done? –Reconnaissance –Social Engineering –Scan and Map –Research –Attack Execution –Cover Tracks  Collecting information to identify potential vulnerabilities.  Tricking unsuspecting employees into allowing access to system.  Detailed scan of system to identify potential points of remote entry.  Researching vulnerabilities of software identified during scan.  Unauthorized access to system.  Removing evidence of attack.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart30 of 222 PREVENTIVE CONTROLS Major types of preventive controls used for defense in depth include: –Authentication controls (passwords, tokens, biometrics, MAC addresses) –Authorization controls (access control matrices and compatibility tests) –Training –Physical access controls (locks, guards, biometric devices) –Remote access controls (IP packet filtering by border routers and firewalls using access control lists; intrusion prevention systems; authentication of dial-in users; wireless access controls) –Host and application hardening procedures (firewalls, anti-virus software, disabling of unnecessary features, user account management, software design, e.g., to prevent buffer overflows) –Encryption

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart31 of 222 PREVENTIVE CONTROLS The objective of preventive controls is to prevent security incidents from happening. Involves two related functions: –Authentication Focuses on verifying the identity of the person or device attempting to gain access. –Authorization Restricts access of authenticated users to specific portions of the system and specifies what actions they are permitted to perform.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart32 of 222 PREVENTIVE CONTROLS Users can be authenticated by verifying: –Something they know, such as passwords or PINs. –Something they have, such as smart cards or ID badges. –Some physical characteristic (biometric identifier), such as fingerprints or voice.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart33 of 222 PREVENTIVE CONTROLS Passwords are probably the most commonly used authentication method and also the most controversial. –An effective password must satisfy a number of requirements: Length  Longer is better.  Should be at least 8 characters.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart34 of 222 PREVENTIVE CONTROLS Passwords are probably the most commonly used authentication method and also the most controversial. –An effective password must satisfy a number of requirements: Length Multiple character types  Use a mix of upper-and lower- case alphabetic, numeric, and special characters.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart35 of 222 PREVENTIVE CONTROLS Passwords are probably the most commonly used authentication method and also the most controversial. –An effective password must satisfy a number of requirements: Length Multiple character types Random Passwords should not be words found in the dictionary or dictionary words preceded or followed by a number such as 4dog or dog4. Should not be related to the employee’s personal interests or hobbies, because special- purpose, password-cracking dictionaries can be found on the Internet containing the most common passwords related to various topics.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart36 of 222 PREVENTIVE CONTROLS Passwords are probably the most commonly used authentication method and also the most controversial. –An effective password must satisfy a number of requirements: Length Multiple character types Random Secret The most important requirement. A password must be kept secret to be effective.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart37 of 222 PREVENTIVE CONTROLS A password that meets the preceding criteria is typically difficult to memorize—exacerbated by the typical requirement that the password be changed every 90 days. So most people either: –Select passwords that can be easily guessed but can be memorized; or –Select passwords that meet the criteria for a strong password but write them down. –When the password is written down, it changes from something the employee knows to something the employee has, which can be stolen and used.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart38 of 222 PREVENTIVE CONTROLS As a result of this dilemma, some security experts argue for abandoning the quest to develop and use strong passwords. –They note that a major component of help desk costs is associated with resetting passwords. –They suggest reliance on dual-factor authentication methods, such as a combination of a smart card and a PIN number.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart39 of 222 PREVENTIVE CONTROLS Other experts disagree. –They note that operating systems can now accommodate passwords longer than 15 characters. –So users can create strong but easy-to-remember paraphrases like: Idlike2binParis. –Long paraphrases dramatically increase the effort required to crack them by guessing. –So this group argues that longer length, coupled with the fact that it is easier to remember a long paraphrase than a strong password, should dramatically cut help desk costs while improving security.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart40 of 222 PREVENTIVE CONTROLS Each authentication method has its limitations. –Passwords Can be guessed, lost, written down, or given away.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart41 of 222 PREVENTIVE CONTROLS Each authentication method has its limitations. –Passwords –Physical identification techniques Include cards, badges, and USB devices. Can be lost, stolen, or duplicated.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart42 of 222 PREVENTIVE CONTROLS Each authentication method has its limitations. –Passwords –Physical identification techniques –Biometric techniques Expensive and often cumbersome. Not yet 100% accurate, sometimes rejecting legitimate users and allowing unauthorized people. Some techniques like fingerprints may carry negative connotations that hinder acceptance. Security concerns surround the storage of this data. –If the data is compromised, it could create serious, life- long problems for the donor. –Unlike passwords or tokens, biometric identifiers cannot be replaced or changed.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart43 of 222 PREVENTIVE CONTROLS Although none of the three basic authentication methods is foolproof by itself, the use of two or three in conjunction, known as multi-factor authentication, is quite effective. Example: Using a palm print and a PIN number together is much more effective than using either method alone.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart44 of 222 PREVENTIVE CONTROLS Authorization controls are implemented by creating an access control matrix. –Specifies what part of the IS a user can access and what actions they are permitted to perform. –When an employee tries to access a particular resource, the system performs a compatibility test that matches the user’s authentication credentials against the matrix to determine if the action should be allowed.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart48 of 222 PREVENTIVE CONTROLS  The access control matrix should be regularly updated, so that an employee who changes job duties cannot accumulate a set of rights that are incompatible with proper segregation of duties.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart49 of 222 PREVENTIVE CONTROLS Authentication and authorization can be applied to devices as well as users. –Every workstation, printer, or other computing device needs a network interface card (NIC) to connect to the organization’s network. –Each network device has a unique identifier, referred to as its media access control (MAC) address. –It is possible to restrict network access to only those devices which have a recognized MAC address or to use MAC addresses for authorization. –For example, payroll or EFT applications should be set only to run from authorized terminals. MAC address can be changed using software making it possible to “spoof” a machine’s identity.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart50 of 222 PREVENTIVE CONTROLS  These are the multiple layers of preventive controls that reflect the defense-in-depth approach to satisfying the constraints of the time-based model of security.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart52 of 222 PREVENTIVE CONTROLS People play a critical role in information security. The effectiveness of specific control procedures depends on how well employees understand and follow the organization’s security policies. Employees should be taught why security measures are important to the organization’s long-run survival.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart53 of 222 PREVENTIVE CONTROLS Employees should be trained to follow safe computing practices, such as: –Never open unsolicited email attachments. –Use only approved software. –Never share or reveal passwords. –Physically protect laptops, especially when traveling.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart54 of 222 PREVENTIVE CONTROLS Train employees about social engineering attacks, which use deception to obtain unauthorized access. –Do not divulge passwords or other info about their accounts or workstation configuration to anyone who contacts them by phone, email, or IM, even if they claim to be part of systems security staff. –Do not allow other people (employees or outsiders) to follow them through restricted-access entrances. This type of piggybacking can take place at main entrances and at internal locked doors. Often succeeds because people feel it is rude not to let the other person come through with them. Role-playing exercises are particularly helpful here.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart55 of 222 PREVENTIVE CONTROLS It is also important to invest in continuing professional education for information security specialists. –New technology developments create new security threats and make old solutions obsolete. –Organizations frequently fail to invest in this vital training.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart56 of 222 PREVENTIVE CONTROLS It is also useful to keep abreast of recent hacking developments. –“White hat” organizations monitor hacker activities and publish findings on the Web. How the activities are perpetrated. How network administrators can protect themselves from each approach.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart57 of 222 PREVENTIVE CONTROLS –Underground journals, books, and cracker Websites provide information on how to break into systems, including how to: Breach a server Generate virus code Hide your identity –These sites should be monitored to stay abreast of current approaches and protect your system.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart58 of 222 PREVENTIVE CONTROLS Top management must also provide support for training. –Providing funding –Demonstrating that they support employees who follow prescribed security policies. Especially important for combating social engineering attacks. –Enforcing consequences against employees who willfully violate security policies. Sends strong message to other employees. May mitigate consequences to the organization if the employee has engaged in illegal behavior.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart59 of 222 PREVENTIVE CONTROLS Controlling Physical Access –Physical access controls are the second layer of preventive controls.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart60 of 222 PREVENTIVE CONTROLS Within a few minutes, a skilled attacker with unsupervised direct physical access to the system can successfully obtain access to sensitive data. –Special boot disks exist that, when inserted, provide the person with unfettered privileges and rights on the computer. –Keystroke loggers can be installed on the PC through hardware or software, which will capture every one of the authorized user’s keystrokes, including his ID and password. –A diskette with a publicly available utility can be inserted in a PC which will instantly capture any ID number or password that has been entered on that PC, since the time it was last booted. –Data can be copied to USB drive. –Hard drive can be stolen.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart61 of 222 PREVENTIVE CONTROLS Physical access control begins with entry points to the building itself. –Should be one regular entry point unlocked during normal office hours. –Fire codes require emergency exits. These should not permit entry from outside. Should be connected to an alarm that is triggered if someone leaves through the exit. –A receptionist or security guard should be stationed at the main entrance of the building to: Verify the identity of employees. Require that visitors sign in and be escorted to their destination.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart62 of 222 PREVENTIVE CONTROLS Once inside the building, physical access to rooms housing computer equipment must be restricted. –Rooms should be securely locked. –All entries and exits should be monitored by closed-circuit TV. –Multiple failed access attempts should trigger an alarm. –Rooms with servers with highly sensitive data should supplement regular locks with: Card readers; Numeric keypads; or Biometric devices.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart63 of 222 PREVENTIVE CONTROLS Access to wiring used in LANs must be restricted to prevent wiretapping. –Cables and wiring should not be exposed in areas accessible to casual visitors. –Wall jacks not in use should be physically disconnected from the network. –Wiring closets should be securely locked. If shared with other tenants of a building, the telecommunications equipment should be placed inside locked steel cages.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart64 of 222 PREVENTIVE CONTROLS Physical access security must be cost effective. –Requires top management involvement to ensure resources are properly valued and that the access controls are appropriate for that value.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart65 of 222 PREVENTIVE CONTROLS Laptops, cell phones, and PDA devices require special attention. –Laptop theft is a major problem, and the major cost is not the price of the laptop but the loss of the confidential information and the costs of notifying those affected. –To deal with laptop theft, employees should be trained to always lock their laptops to an immovable object—even while in the office. –Sensitive data should only be stored on removable media, not the hard drive, and special care should be taken to restrict access to the removable media.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart66 of 222 PREVENTIVE CONTROLS Controlling Remote Access –The third layer of defense is control of remote access.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart67 of 222 PREVENTIVE CONTROLS Perimeter Defense: Routers, Firewalls, and Intrusion Prevention Systems –This figure shows the relationship between an organization’s information system and the Internet. –A device called a border router connects an organization’s information system to the Internet.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart68 of 222 PREVENTIVE CONTROLS  Behind the border router is the main firewall, either a special- purpose hardware device or software running on a general purpose computer.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart69 of 222 PREVENTIVE CONTROLS  Web servers and email servers are placed in a separate network called the demilitarized zone (DMZ), because it sits outside the corporate network but is accessible from the Internet.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart70 of 222 PREVENTIVE CONTROLS Together, the border router and firewall control which information is allowed to enter and leave the organization’s information system. To understand how they function, we first need to discuss how information is transmitted on the Internet.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart71 of 222 PREVENTIVE CONTROLS Information traverses the Internet and internal networks in the form of packets. –Documents and files that you send to a printer or to a colleague are first divided into packets. –The packets are sent over the LAN and maybe the Internet to their destination. –The device receiving the packets must reassemble them.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart72 of 222 PREVENTIVE CONTROLS This process is governed by TCP/IP, two protocols for transmitting information over the Internet. –Transmission Control Protocol (TCP) specifies the procedures for dividing files and documents into packets and for reassembly at the destination. –Internet Protocol (IP) specifies the structure of the packets and how to route them to the proper destination.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart73 of 222 PREVENTIVE CONTROLS The structure of IP packets facilitates their efficient transmission over the Internet. –Every IP packet consists of two parts. Header—contains the packet’s origin and destination addresses, as well as info about the type of data contained in the body. Body. –The IP protocol prescribes the size of the header and the sequence of the information fields in it.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart74 of 222 PREVENTIVE CONTROLS Special purpose devices called routers read the destination address fields in packet headers to decide where to send (route) the packet next. –The current version of the IP protocol, IPv4, uses 32-bit long addresses. Consist of four 8-bit numbers separated by periods. –When users type a URL in their browser, e.g., www.prenticehall.com, the name is translated into the appropriate address, i.e., 165.193.123.253. www.prenticehall.com

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart75 of 222 PREVENTIVE CONTROLS –An organization’s border router checks the contents of the destination address field of every packet it receives. If the address is not that of the organization, the packet is forwarded to another router on the Internet. If the destination address matches the organization, the packet undergoes one or more tests before being allowed in.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart76 of 222 PREVENTIVE CONTROLS A set of rules called an access control list (ACL) determine which packets are allowed in and which are dropped. –Border routers typically perform a static packet filtering, which screens individual packets based only on the contents of the source and/or destination fields in the packet header.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart77 of 222 PREVENTIVE CONTROLS ACL normally specifies that the following packets should not be allowed entry. –Packets with illegal source addresses. Certain source addresses are reserved for internal use and cannot be routed over the Internet: 10.0.0.0 – 10.255.255.255 172.16.0.0 – 172.31.255.255 192.168.0.0 – 192.168.255.255 –The preceding packets would not be allowed in because they are either errors or attacks.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart78 of 222 PREVENTIVE CONTROLS Packets with the organization’s IP address as the source address. –Does not make sense that an internal message is routed over the Internet, so these are typically spoofed addresses and not allowed in. Border router ACLs often contain several additional rules that specify other types of packets that should be denied entry. The ACL rules mainly focus on dropping packets, but the last rule in the ACL specifies that any packet not dropped should be forwarded to the firewall.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart79 of 222 PREVENTIVE CONTROLS The firewall will subject the packet to more detailed testing before allowing it to enter the internal network. Like the border router, firewalls use ACLs to determine what to do with each packet. –Firewalls are designed to act as filters and only permit packets that meet specific conditions to pass. –The final rule in the firewall ACL usually specifies that any packet not allowed entry by a previous rule should be dropped. –Firewalls don’t block all traffic, but only filter it. –Certain traffic passes through.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart80 of 222 PREVENTIVE CONTROLS Firewalls use more sophisticated techniques than border routers to filter packets. –Most employ stateful packet filtering. –Static packet filtering would examine each IP packet in isolation, but stateful packet filtering maintains a table that lists all established connections between the organization’s computers and the Internet. –The firewall consults this table to determine whether an incoming packet is part of an ongoing communication initiated by an internal computer. –Enables the firewall to reject specially crafted attack packets that would have passed a simple static packet filter.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart81 of 222 PREVENTIVE CONTROLS Stateful packet filtering is still limited to examining only information in the IP packet header—the same as screening mail by looking at just the destination and return addresses on the envelope. –Process is fast and catches patently undesirable packages. –Limited effectiveness because undesirable mail can get through if the return address is not on the list of unacceptable sources.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart82 of 222 PREVENTIVE CONTROLS Control would be more effective if each envelope or package were opened and inspected. A process called deep packet inspection examines the data in the body of an IP packet to provide more effective access control. The process takes more time, and therefore the added cost is loss of speed.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart83 of 222 PREVENTIVE CONTROLS Deep packet inspection is the heart of a new type of filter called intrusion prevention systems (IPS). –IPS are designed to identify and drop packets that are part of an attack. –Uses several techniques to identify undesirable packets: Checking packet contents against a database of patterns (signatures) of known attack methods. Developing a profile of “normal” traffic and using statistical analysis to identify packets that don’t fit the profile. Using rule bases that specify acceptable standards for specific types of traffic and dropping packets that don’t conform.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart84 of 222 PREVENTIVE CONTROLS The major benefit of this approach is that it blocks not only known attacks for which signatures already exist, but also blocks new attacks that violate the standards. IPS is a promising addition to the security arsenal, but does have problems. –Slows overall throughput. –Prone to false alarms, resulting in rejection of legitimate traffic.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart85 of 222 PREVENTIVE CONTROLS Another dimension of the defense-in- depth concept is the use of a number of internal firewalls to segment different departments within the organization.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart86 of 222 PREVENTIVE CONTROLS Many security incidents involve employees rather than outsiders. These internal firewalls help restrict the data and portions of the IS that particular employees can access. Increases security and strengthens internal control by providing another segregation of duties.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart87 of 222 PREVENTIVE CONTROLS Modems are cheap and easy to install, so employees are often tempted to install them on their desktops without seeking permission or notifying anyone. –Creates a huge hole in perimeter security, especially because employees seldom configure any strong authentication controls. –A single rogue modem creates a “back door” through which attackers can successfully compromise the system. –information security or internal audit staff should periodically check for the existence of rogue modems. –War dialing software (also used by hackers) can dial every phone number assigned to the organization to identify those connected to modems.War dialing –Rogue modems should be disconnected and sanctions applied to offending employees.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart88 of 222 PREVENTIVE CONTROLS Wireless access –Many organizations also provide wireless access to their information systems. It’s convenient and easy. But anyone with a wireless NIC can attempt to connect to the network. Ease of access provides another venue for attack and extends the perimeter that must be protected. Wireless signals can often be picked up from miles away by perpetrators in cars, nearby buildings, etc.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart89 of 222 PREVENTIVE CONTROLS Dial-up connections –Many organizations still allow employees to dial into their network from remote locations. –Dial-in access often bypasses the firewalls. –It is important to verify the identity of these users. –Remote Authentication Dial-In User Service (RADIUS) is a standard method for doing that. Users connect to a remote-access server and submit log-in credentials. The remote-access server passes the credentials to the RADIUS server, which does compatibility tests to authenticate the user’s identity.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart90 of 222 PREVENTIVE CONTROLS To secure wireless access, all wireless access points (devices that accept incoming wireless communications and permit connection to the network) should be located in the DMZ. Treats all wireless access as if it was coming in from the Internet and forces it to go through the main firewall and intrusion prevention systems.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart91 of 222 PREVENTIVE CONTROLS The following procedures should also be followed to adequately secure wireless access: –Turn on available security features. Most wireless devices are sold and installed with these features disabled. Example: Encryption is usually turned off. –Authenticate all devices attempting to establish wireless access to the network before assigning them an IP address. To do this, treat incoming wireless connections as dial-up attempts and route them first through a RADIUS server or other authorization device.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart92 of 222 PREVENTIVE CONTROLS –Configure all authorized wireless NICs to operate only in infrastructure mode. Forces the device to connect only to wireless access points. Wireless NICs configured in ad hoc mode can communicate directly with any other device that has a wireless NIC. Creates a security threat because it creates peer-to-peer networks with no authentication controls. –Use non-informative address for the access point’s address, called a service set identifier (SSID). SSIDs like "payroll," "finance," or "R&D" are more obvious targets to attack than devices with generic SSIDs like "A1," or "X2."

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart93 of 222 PREVENTIVE CONTROLS –Predefine a list of authorized MAC addresses and configure wireless access points to only accept connections from those MAC addresses. –Reduce broadcast strength of wireless access points to make unauthorized reception more difficult off premises. –Locate wireless access points in the interior of the building and use directional antennae to make unauthorized access and eavesdropping more difficult.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart94 of 222 PREVENTIVE CONTROLS –As with modems, it’s easy and inexpensive for employees to set up rogue wireless access points. Should be periodically tested for and handled in the same manner as rogue modems.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart95 of 222 PREVENTIVE CONTROLS Host and Application Hardening –The fourth layer of defense is host and application hardening.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart96 of 222 PREVENTIVE CONTROLS Routers, firewalls, and intrusion prevention systems are designed to protect the network perimeter. Information security is enhanced by supplementing preventive controls on the network perimeter with additional preventive controls on the workstations, servers, printers, and other devices (collectively referred to as hosts) that comprise the organization’s network. Three areas deserve special attention: –Host configuration –User accounts –Software design

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart97 of 222 PREVENTIVE CONTROLS Host configuration –Hosts can be made more secure by modifying their configurations. Default configurations of most devices typically turn on a large number of optional settings that are seldom, if ever used. Default installations of many operating systems turn on many special purpose programs, called services, which are not essential. –Turning on unnecessary features and extra services: Maximizes the likelihood of successful installation without the need for customer support. But the cost is that it creates security weaknesses.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart99 of 222 PREVENTIVE CONTROLS Encrypting sensitive stored data provides one last barrier that must be overcome by an intruder. Also strengthens authentication procedures and plays an essential role in ensuring and verifying the validity of e-business transactions. Therefore, accountants, auditors, and systems professionals need to understand encryption.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart100 of 222 PREVENTIVE CONTROLS This is a contract for... Encryption algorithm Xb&j &m 2 ep0%fg... Decryption algorithm This is a contract for... Plaintext Plain- text Cipher- text Key Encryption is the process of transforming normal text, called plaintext, into unreadable gibberish, called ciphertext. Decryption reverses this process. To encrypt or decrypt, both a key and an algorithm are needed. + + Key

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart101 of 222 PREVENTIVE CONTROLS Encryption strength –Three important factors determine the strength of any encryption system: Key length; Longer keys provide stronger encryption by reducing the number of repeating blocks of ciphertext. Makes it harder for a would-be perpetrator to spot patterns.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart102 of 222 PREVENTIVE CONTROLS Encryption strength –Three important factors determine the strength of any encryption system: Key length Key management policies If the key is compromised, encryption is easily broken. But, must have a way to decrypt data if employee leaves –Build-in master key in software. –Key escrow stores a copy of key securely.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart103 of 222 PREVENTIVE CONTROLS Encryption strength –Three important factors determine the strength of any encryption system: Key length Key management policies The nature of the encryption algorithm The nature of the algorithm also affects encryption strength. –A strong algorithm is difficult, if not impossible, to break with brute-force guessing techniques. –Secrecy is not necessary for strength. –Procedures used by the most accepted and widely-used encryption algorithms are publicly available.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart104 of 222 PREVENTIVE CONTROLS Types of encryption systems –There are two basic types of encryption systems: Symmetric encryption systems Asymmetric encryption systems

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart105 of 222 PREVENTIVE CONTROLS Symmetric encryption systems –Use the same key to encrypt and decrypt. –Examples: DES and AES.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart106 of 222 PREVENTIVE CONTROLS Asymmetric encryption systems –Use two keys: The public key is publicly available. The private key is kept secret and known only to the owner of that pair of keys. –Either key can be used to encrypt. –Whichever key is used to encrypt, the other key must be used to decrypt.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart107 of 222 PREVENTIVE CONTROLS Asymmetric encryption solves several problems with symmetric keys. –It doesn’t matter who knows the public key, because any text encrypted with it can only be decrypted using the private key. –The public key can be distributed by email or posted on a Website for anyone who wants to send an encrypted message to the entity. –Any number of parties can use the same public key to send messages, because only the owner of the key can decrypt them. –Because only one party has the private key, it’s possible to prove who created a document, which provides a means for legally- binding electronic agreements.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart108 of 222 PREVENTIVE CONTROLS The main drawback to asymmetric encryption is speed. –Much (thousands of times) slower then symmetric encryption. –Too slow to exchange large amounts of data over the Internet.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart109 of 222 PREVENTIVE CONTROLS So, e-business uses both types of encryption systems: –Symmetric encryption to encode most of the data being exchanged. –Asymmetric encryption to safely send the symmetric key to the recipient for use in decrypting the ciphertext. –Asymmetric encryption can also be used in combination with a process called hashing to create digital signatures.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart110 of 222 PREVENTIVE CONTROLS Hashing –Hashing takes plaintext of any length and transforms it into a short code called a hash. –SHA-256 creates 256 bit hash regardless of text length. –Hashing differs from encryption in that: Encryption always produces ciphertext similar in length to the plaintext, but hashing produces a hash of a fixed short length. Encryption is reversible, but hashing is not; you cannot transform a hash back into its original plaintext.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart111 of 222 PREVENTIVE CONTROLS The hash is not only efficient but also provides a means for establishing that the message was not altered in transmission to the recipient. –Hashing algorithms use every bit in the original plaintext to calculate the hash value. –If any character is changed in the document, a different hash value will be produced. –So, when the recipient receives the document and the digital signature and proceeds to decrypt both, he can create a new hash of the document using the same hashing algorithm. –If the new hash value matches the decrypted digital signature, the recipient is assured that the plaintext document matches the document the sender originally created.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart112 of 222 PREVENTIVE CONTROLS Successfully using a public key to decrypt a document or file proves that it was created by the entity possessing the corresponding private key. –But how can you know whether the entity with the private key is really who they purport to be? –Also, how do you get hold of the entity’s public key to decrypt it in the first place? –If you have the sender provide their public key to you directly, you are not protected from an impersonation. –Answers involve the use of digital certificates and the creation of a public key infrastructure.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart113 of 222 PREVENTIVE CONTROLS A digital certificate is an electronic document, created and digitally signed by a trusted third party. –Certifies the identity of the owner of a particular public key. –Contains that party’s public key. –These certificates can be stored on Websites. –Browsers are designed to automatically obtain a copy of that digital certificate and use the public key contained therein to communicate with the Website. –You can manually examine the contents of a Website’s digital certificate by double-clicking on the lock icon that appears in the lower, right-hand corner of the browser window. –Digital certificates provide an automated method for obtaining an organization’s or individual’s public key.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart114 of 222 PREVENTIVE CONTROLS The term public key infrastructure (PKI) refers to the system and processes used to issue and manage asymmetric keys and digital certificates. –An organization that issues public and private keys and records the public key in a digital certificate is called a certificate authority. –E-business typically uses commercial certificate authorities, such as Thawte or Verisign. –The certificate authority: Hashes the information stored on a digital certificate Encrypts that hash with its private key Appends that digital signature to the digital certificate –Provides a means for validating the authenticity of the certificate.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart115 of 222 PREVENTIVE CONTROLS Organizations can create their own digital certificates for internal use. Though not likely to be used externally, they do enable the organization to use public and private keys to provide stronger authentication of users.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart116 of 222 PREVENTIVE CONTROLS The Trust Services framework contains a list of criteria that can be used to evaluate the overall reliability of a particular certificate authority. –One important factor concerns the procedures use by the CA to verify the identify of an applicant for a digital certification. Several classes of digital certificates exist: –Cheapest and least trustworthy may only verify the applicant’s email address. –Most expensive may require verification of the applicant’s identity through credit checks and tax returns. –Second issue is the CA’s procedures for updating certificates and revoking expired certificates.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart117 of 222 PREVENTIVE CONTROLS EXAMPLE OF ENCRYPTION IN E-BUSINESS –Let’s go through an example of how the encryption process would work in a transaction where Northwest Industries (a fictional company) is submitting a competitive bid to the federal government. –Keep in mind that this is serious business. Defense contractors regularly submit bids to the federal government for contracts in the millions and billions of dollars. At the time of bid submission, the contractors themselves may have spent hundreds of thousands or millions of dollars just developing the bids.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart118 of 222 PREVENTIVE CONTROLS –The stakes can be very high and protection measures are very tight. Prior to electronic submission of these bids, serious physical measures were taken to deliver bids. One defense contractor, for example, would send 3–6 different employees on different flights to Washington, D.C., to deliver a single bid to the Pentagon. An employee of this contractor revealed that bids were intercepted on more than one occasion.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart119 of 222 PREVENTIVE CONTROLS NW USAUSA CA The NW employee connects to the government agency’s Website and clicks on the button for submitting bids on open contracts.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart120 of 222 PREVENTIVE CONTROLS NW USAUSA CA The browser moves to a secure Web page displaying the lock icon.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart121 of 222 PREVENTIVE CONTROLS NW USAUSA CA The software on NW’s computer: –Obtains the digital certificate for the federal agency; –Verifies the validity of the certificate; and –Opens the certificate to get the federal agency’s public key. Digital certificate for USA Public key for USA

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart122 of 222 PREVENTIVE CONTROLS NW USAUSA CA The federal computer does the same with NW’s digital certificate and key. Digital certificate for NW Public key for NW

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart123 of 222 PREVENTIVE CONTROLS NW. USAUSA NW.now has the federal agency’s public key, and the federal agency now has NW’s public key. USA Public N.W. Public

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart124 of 222 PREVENTIVE CONTROLS NW USAUSA The NW employee clicks a button to attach and submit the company’s bid. NW’s Bid USA Public NW Public

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart125 of 222 PREVENTIVE CONTROLS NW USAUSA Before submitting the bid, NW’s encryption software goes through several steps. The encryption software first creates a hash of the bid, using a publicly available hashing algorithm like SHA-256. Hash of NW Bid NW’s Bid USA Public NW Public

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart126 of 222 PREVENTIVE CONTROLS NW USAUSA Next, the hash is encrypted using NW’s private key. This encrypted hash is NW’s digital signature. Digital signature Hash of NW Bid NW’s Bid Coded w/ NW private key USA Public NW Public

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart127 of 222 PREVENTIVE CONTROLS NW USAUSA The bid itself is then encrypted with a symmetric key, such as AES. Coded w/ NW private key Hash of NW Bid NW’s Bid Coded w/ symmetric key USA Public NW Public

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart128 of 222 PREVENTIVE CONTROLS NW USAUSA NW also needs to send a copy of the symmetric key to the federal agency. Coded w/ NW private key Hash of NW Bid NW’s Bid Coded w/ symmetric key Symmetric Key USA Public NW Public

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart129 of 222 PREVENTIVE CONTROLS NW USAUSA They encrypt the symmetric key using the federal agency’s public key. Coded w/ NW private key Hash of NW Bid NW’s Bid Coded w/ symmetric key Symmetric Key Coded w/ USA public key USA Public NW Public

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart130 of 222 PREVENTIVE CONTROLS NW USAUSA A package is then electronically transmitted to the federal agency including: –The bid encrypted with a symmetric key. –The symmetric key encrypted with the federal agency’s public key. –The digital signature (encrypted hash). Coded w/ NW private key Hash of NW Bid NW’s Bid Coded w/ symmetric key Symmetric Key Coded w/ USA public key USA Public NW Public

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart131 of 222 PREVENTIVE CONTROLS NW USAUSA A package is then electronically transmitted to the federal agency including: –The bid encrypted with a symmetric key. –The symmetric key encrypted with the federal agency’s public key. –The digital signature (encrypted hash). Coded w/ NW private key Hash of NW Bid NW’s Bid Coded w/ symmetric key Symmetric Key Coded w/ USA public key Coded w/ NW private key Hash of NW Bid NW’s Bid Coded w/ symmetric key Symmetric Key Coded w/ USA public key Coded w/ NW private key Hash of NW Bid NW’s Bid Coded w/ symmetric key Symmetric Key Coded w/ USA public key Coded w/ NW private key Hash of NW Bid NW’s Bid Coded w/ symmetric key Symmetric Key Coded w/ USA public key Coded w/ NW private key Hash of NW Bid NW’s Bid Coded w/ symmetric key Symmetric Key Coded w/ USA public key Coded w/ NW private key Hash of NW Bid NW’s Bid Coded w/ symmetric key Symmetric Key Coded w/ USA public key USA Public NW Public

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart132 of 222 PREVENTIVE CONTROLS NW USAUSA The federal agency then uses NW’s public key to decrypt the digital signature. Coded w/ NW private key Hash of NW Bid NW’s Bid Coded w/ symmetric key Symmetric Key Coded w/ USA public key USA Public NW Public

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart133 of 222 PREVENTIVE CONTROLS NW USAUSA They use their own private key to decrypt the symmetric key. Hash of NW Bid NW’s Bid Coded w/ symmetric key Symmetric Key Coded w/ USA public key USA Public NW Public

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart134 of 222 PREVENTIVE CONTROLS NW USAUSA They use the symmetric key that they’ve just decrypted to decrypt the actual bid. Hash of NW Bid NW’s Bid Coded w/ symmetric key Symmetric Key USA Public NW Public

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart135 of 222 PREVENTIVE CONTROLS NW USAUSA They use the same publicly- available hashing program that was used by NW (SHA- 256 in this case) to create their own hash of NW’s bid. Hash of NW Bid NW’s Bid Symmetric Key Hash of NW Bid USA Public NW Public

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart136 of 222 PREVENTIVE CONTROLS NW USAUSA They then compare their own hash of the bid to the hash that was transmitted by NW. What will it mean if the two hashes are not identical? Hash of NW Bid NW’s Bid Symmetric Key Hash of NW Bid USA Public NW Public

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart137 of 222 PREVENTIVE CONTROLS NW USAUSA Assuming everything is in order and the hashes do match, the federal agency then sends an acknowledgment to NW that their bid has been received. Hash of NW Bid NW’s Bid Symmetric Key Hash of NW Bid A-OK

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart138 of 222 PREVENTIVE CONTROLS Digital signatures vs. e-signature –Digital signatures use asymmetric keys to “sign” documents. –E-signatures use a cursive imprint of a person’s name applied to an electronic document. –Both are legally binding like a paper document.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart139 of 222 PREVENTIVE CONTROLS Effects of encryption on other layers of defense –Encryption protects the confidentiality and privacy of the transmission and provides for authentication and non-repudiation of transactions. –It also causes some problems. –The firewall cannot effectively inspect encrypted packets. –So one alternative is to have these packets routed to the DMZ, where they are decrypted and then passed back to the firewall.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart140 of 222 PREVENTIVE CONTROLS –The problem with the preceding approach is that it leaves the incoming packets vulnerable to sniffing attacks and therefore compromises their confidentiality and privacy. –Allowing them through the firewall without being encrypted compromises the organization’s security. –Anti-virus and intrusion detection systems also have difficulty dealing with encrypted packets. –Makes it important for the organization to consider these trade-offs in designing and implementing security procedures.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart141 of 222 DETECTIVE CONTROLS Preventive controls are never 100% effective in blocking all attacks. So organizations implement detective controls to enhance security by: –Monitoring the effectiveness of preventive controls; and –Detecting incidents in which preventive controls have been circumvented.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart142 of 222 DETECTIVE CONTROLS Authentication and authorization controls (both preventive and detective) govern access to the system and limit the actions that can be performed by authorized users. Actual system use (detective control) must be examined to assess compliance through: –Log analysis –Intrusion detection systems –Managerial reports –Periodically testing the effectiveness of existing security procedures

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart143 of 222 DETECTIVE CONTROLS Authentication and authorization controls represent the organization’s policies governing access to the system and limits the actions that can be performed by authorized users. Actual system use must be examined to assess compliance through: –Log analysis –Intrusion detection systems –Managerial reports –Periodically testing the effectiveness of existing security procedures

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart144 of 222 DETECTIVE CONTROLS Log analysis –Most systems come with extensive capabilities for logging who accesses the system and what specific actions each user performed. Logs form an audit trail of system access. Are of value only if routinely examined. Log analysis is the process of examining logs to monitor security.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart145 of 222 DETECTIVE CONTROLS The log may indicate unsuccessful attempts to log in to different servers. The person analyzing the log must try to determine the reason for the failed attempt. Could be: –The person was a legitimate user who forgot his password. –Was a legitimate user but not authorized to access that particular server. –The user ID was invalid and represented an attempted intrusion.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart146 of 222 DETECTIVE CONTROLS Log analysis should be done regularly to detect problems in a timely manner. –Not easy because logs can quickly grow in size. –So system administrators use software tools to efficiently strip out routine log entries so that they can focus their attention on anomalous behavior. –Also supplement log analysis with software tools called intrusion detection systems to automate the monitoring process.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart148 of 222 DETECTIVE CONTROLS Intrusion detection systems –A major weakness of log analysis is that it is labor intensive and prone to human error. –Intrusion detection systems (IDS) represent an attempt to automate part of the monitoring.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart149 of 222 DETECTIVE CONTROLS An IDS creates a log of network traffic that was permitted to pass the firewall. –Analyzes the logs for signs of attempted or successful intrusions. –Most common analysis is to compare logs to a database containing patterns of traffic associated with known attacks. –An alternative technique builds a model representing “normal” network traffic and uses various statistical techniques to identify unusual behavior.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart150 of 222 DETECTIVE CONTROLS IDS sensors are usually located in several places. –Most common is just inside the main firewall. –Some may be placed inside each internal firewall to monitor the effectiveness of policies governing employee access to resources. –Sometimes located just outside the main firewall. Provides means to monitor the number of attempted intrusions that are blocked. Can provide early warning that the organization is being targeted. –May also be located on individual hosts to provide warnings of attempts to compromise those systems.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart152 of 222 DETECTIVE CONTROLS Managerial reports –Management reports are another important detective control. –Management can use COBIT to set up a report scorecard. –COBIT provides: –Management guidelines that identify crucial success factors associated with each objective. –Key performance indicators that can be used to assess their effectiveness.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart153 of 222 DETECTIVE CONTROLS COBIT key performance indicators: –Number of incidents with business impact –Percent of users who do not comply with password standards –Percent of cryptographic keys compromised and revoked

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart154 of 222 DETECTIVE CONTROLS Although regular review of periodic performance reports can help ensure that security controls are adequate, surveys indicate that many organizations fail to regularly monitor security.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart156 of 222 DETECTIVE CONTROLS Security testing –The effectiveness of existing security procedures should be tested periodically. One approach is vulnerability scans, which use automated tools designed to identify whether a system possesses any well-known vulnerabilities. Security Websites such as the Center for Information Security (www.cisecurity.org) provide:www.cisecurity.org –Benchmarks for security best practices. –Tools to measure how well a system conforms.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart157 of 222 DETECTIVE CONTROLS Penetration testing provides a rigorous way to test the effectiveness of an organization’s information security. This testing involves an authorized attempt by either an internal audit team or external security consulting firm to break into the organization’s IS.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart158 of 222 DETECTIVE CONTROLS The teams try every possible way to compromise a company’s system, including: –Masquerading as custodians, temporary workers, or confused delivery personnel to get into offices to locate passwords or access computers. –Using sexy decoys to distract guards. –Climbing through roof hatches and dropping through ceiling panels. Some claim they can get into 90% or more of the companies they attack.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart159 of 222 CORRECTIVE CONTROLS COBIT specifies the need to identify and handle security incidents. Two of the Trust Services framework criteria for effective security are the existence of procedures to: –React to system security breaches and other incidents. –Take corrective action on a timely basis.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart160 of 222 CORRECTIVE CONTROLS Three key components that satisfy the preceding criteria are: –Establishment of a computer emergency response team. –Designation of a specific individual with organization-wide responsibility for security. –An organized patch management system.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart162 of 222 CORRECTIVE CONTROLS Computer emergency response team –A key component to being able to respond to security incidents promptly and effectively is the establish of a computer emergency response team (CERT). Responsible for dealing with major incidents. Should include technical specialists and senior operations management. –Some potential responses have significant economic consequences (e.g., whether to temporarily shut down an e-commerce server) that require management input.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart163 of 222 CORRECTIVE CONTROLS The CERT should lead the organization’s incident response process through four steps: –Recognition that a problem exists Typically occurs when an IDS signals an alert or as a result of a system administrator’s log analysis.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart164 of 222 CORRECTIVE CONTROLS The CERT should lead the organization’s incident response process through four steps: –Recognition that a problem exists –Containment of the problem Once an intrusion is detected, prompt action is needed to stop it and contain the damage.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart165 of 222 CORRECTIVE CONTROLS The CERT should lead the organization’s incident response process through four steps: –Recognition that a problem exists –Containment of the problem –Recovery Damage must be repaired. May involve restoring data from backup and reinstalling corrupted programs (discussed more in Chapter 8).

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart166 of 222 CORRECTIVE CONTROLS The CERT should lead the organization’s incident response process through four steps: –Recognition that a problem exists –Containment of the problem –Recovery –Follow-up Once recovery is in process, the CERT should lead analysis of how the incident occurred. Steps should be taken to modify existing security policy and minimize the likelihood of a similar incident. An important decision is whether to try to catch and punish the perpetrator. –If the perpetrator will be pursued, forensic experts should be involved immediately to ensure that all possible evidence is collected and maintained in a manner that makes it admissible in court.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart167 of 222 CORRECTIVE CONTROLS Communication is vital to all four steps, so multiple methods are needed for notifying members of CERT (e.g., email, phone, cell phone).

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart168 of 222 CORRECTIVE CONTROLS It is also important to practice the incident response plan, including the alert process, so that gaps can be discovered. Regular practice helps identify the need for change in response to technological changes. –EXAMPLE: A CERT practicing an incident response in Texas recently realized that the password to a Web address that was vital to the incident response had been changed. The CERT did not have the new password. Better to find this out on a trial run and make provision for the CERT to be immediately notified of any future password changes than to discover it in a live incident.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart170 of 222 CORRECTIVE CONTROLS A chief security officer (CSO): –Should be independent of other IS functions and report to either the COO or CEO. –Must understand the company’s technology environment and work with the CIO to design, implement, and promote sound security policies and procedures. –Disseminates info about fraud, errors, security breaches, improper system use, and consequences of these actions. –Works with the person in charge of building security, as that is often the entity’s weakest link. –Should impartially assess and evaluate the IT environment, conduct vulnerability and risk assessments, and audit the CIO’s security measures.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart172 of 222 CORRECTIVE CONTROLS Patch management –Another important corrective control involves fixing known vulnerabilities and installing latest updates to: Anti-virus software Firewalls Operating systems Application programs –The number of reported vulnerabilities rises each year.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart173 of 222 CORRECTIVE CONTROLS A primary cause of the rise in reported vulnerabilities is the ever-increasing size and complexity of software. Many widely-used programs contain millions of lines of code. Even if 99.9% error free, there would still be 100 vulnerabilities per million lines. Both hackers and security consultants constantly search for these vulnerabilities. Once discovered, the question is how to take advantage of them.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart174 of 222 CORRECTIVE CONTROLS Hackers usually publish instructions for doing so (known as exploits) on the Internet. Although it takes skill to discover the exploit, once published, it can be executed by almost anyone. Attackers who execute these programmed exploits are referred to as script kiddies. A patch is code released by software developers to fix vulnerabilities that have been discovered.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart175 of 222 CORRECTIVE CONTROLS Patch management is the process for regularly applying patches and updates to all of an organization’s software. Challenging to do because: –Patches can have unanticipated side effects that cause problems, which means they should be tested before being deployed. –There are likely to be many patches each year for each software program, which may mean that hundreds of patches will need to be applied to thousands of machines.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart176 of 222 CORRECTIVE CONTROLS Intrusion prevention systems may provide great promise if they can be quickly updated to respond to new vulnerabilities and block new exploits, so that the entity can buy time to: –Thoroughly test the patches. –Apply the patches.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart177 of 222 SUMMARY In this chapter, you’ve learned: –How security affects systems reliability. –The four criteria that can be used to evaluate the effectiveness of an organization’s information security. –What the time-based model of security is, as well as the concept of defense-in-depth. –The types of preventive, detective, and corrective controls that are used to provide information security. –How encryption contributes to security and how the two basic types of encryption systems work.

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart1 of 222 C HAPTER 7 Information Systems Controls for Systems.

Similar presentations

Presentation on theme: "© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart1 of 222 C HAPTER 7 Information Systems Controls for Systems."— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart1 of 222 C HAPTER 7 Information Systems Controls for Systems.

Similar presentations

Presentation on theme: "© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart1 of 222 C HAPTER 7 Information Systems Controls for Systems."— Presentation transcript:

Similar presentations

About project

Feedback