Computer Crime and Information Technology Security Chapter 15 Computer Crime and Information Technology Security McGraw-Hill/Irwin Copyright © 2010 by The McGraw-Hill Companies, Inc. All rights reserved.

Outline Objectives Carter’s taxonomy Risks and threats to information systems Computer criminals Prevention and detection techniques COBIT framework 15-2

Objectives When you finish this chapter, you should be able to: Explain Carter’s taxonomy of computer crime Identify and describe business risks and threats to information systems Name and describe common types of computer criminals Discuss ways to prevent and detect computer crime Explain COBIT’s information criteria and accountability framework Explain how COBIT can be used to strengthen internal controls against computer crime 15-3

Carter’s taxonomy Target: targets the system or its data Instrumentality: computer furthers a criminal end Incidental: computer is not required for the crime but is related to the criminal act Associated: new versions of traditional crimes 15-4

Risks and threats to information systems Fraud Any illegal act for which knowledge of computer technology is used to commit the offense Service interruptions and delays Delay in processing information Intrusions Bypassing security controls or exploiting a lack of adequate controls Information manipulation Can occur at virtually any stage of information processing from input to output 15-5

Risks and threats to information systems Denial of service attacks Prevent computer systems and networks from functioning in accordance with their intended purpose Error Can vary widely Disclosure of confidential information Can have major impacts on an organization's financial health Information theft Targets the organization's most precious asset: information 15-6

Risks and threats to information systems Malicious software Virus, Trojan horse, worms, logic bombs Web site defacements Digital graffiti where intruders modify pages Extortion Threat to either reveal information to the public or to launch a prolonged denial of service if demands are not met 15-7

Computer criminals Script kiddies Hacker Cyber-criminals Young inexperienced hacker who uses tools and scripts written by others for the purpose of attacking systems Hacker Someone who invades an information system for malicious purposes Cyber-criminals Hackers driven by financial gain Organized crime Spamming, phishing, extortion and all other profitable branches of computer crime Corporate spies Computer intrusion techniques to gather information 15-8

Computer criminals Terrorists Insiders Target the underlying computers and networks of a nation’s critical infrastructure Insiders May be the largest threat to a company’s information systems and underlying computer infrastructure 15-9

Prevention and detection techniques CIA triad Confidentiality Data integrity Availability Internal controls Physical: locks, security guards, badges, alarms Technical: firewalls, intrusion detection, access controls, cryptography Administrative: security policy, training, reviews 15-10

COBIT framework Control Objectives for Information and Related Technology Published by Information Systems Audit and Control Association (www.isaca.org) Three points of view Business objectives IT resources IT processes 15-11

COBIT framework Four domains of knowledge Seven information criteria Plan and organize Acquire and implement Deliver and support Monitor and evaluate Seven information criteria Effectiveness Efficiency Confidentiality Integrity Availability Compliance Reliability of information 15-12

Accountability framework (Figure 15.3) COBIT framework Accountability framework (Figure 15.3) 15-13

15-14