1. CHAPTER FOUR OVERVIEW SECTION 4.1 - ETHICS
Information Ethics
Developing Information Management Policies
Ethics in the Workplace
SECTION INFORMATION SECURITY
Protecting Intellectual Assets
The First Line of Defense - People
The Second Line of Defense - Technology

2. ETHICS
Ethics – the principles and standards that guide our behavior toward other people
Issues affected by technology advances
Intellectual property
Copyright
Fair use doctrine
Pirated software
Counterfeit software
Privacy is a major ethical issue

3. INFORMATION ETHICS Individuals form the only ethical component of IT
Individuals copy, use , and distribute software
Search organizational databases for sensitive and personal information
Individuals create and spread viruses
Individuals hack into computer systems to steal information
Employees destroy and steal information

4. INFORMATION HAS NO ETHICS
Acting ethically and legally are not always the same

5. DEVELOPING INFORMATION MANAGEMENT POLICIES
Organizations strive to build a corporate culture based on ethical principles that employees can understand and implement
Epolicies typically include:
Ethical computer use policy
Information privacy policy
Acceptable use policy
privacy policy
Internet use policy
Anti-spam policy

6. MONITORING TECHNOLOGIES
Monitoring – tracking people’s activities by such measures as number of keystrokes, error rate, and number of transactions processed
Common monitoring technologies include:
Key logger or key trapper software
Hardware key logger
Cookie
Adware
Spyware
Web log
Clickstream

7. EMPLOYEE MONITORING POLICIES
Employee monitoring policies – explicitly state how, when, and where the company monitors its employees
Be specific
Enforce the policy
Enforce the policy the same for all employees
Communicate rights to monitor all employees
State when monitoring will be performed
State what will be monitored
Describe types of information collected
State consequences for violating policies
State provisions for policy updates
Specify scope and manner of monitoring
Obtain written signature acknowledging policies

8. PROTECTING INTELLECTUAL ASSETS
Organizational information is intellectual capital - it must be protected
Information security – the protection of information from accidental or intentional misuse by persons inside or outside an organization
Ebusiness automatically creates tremendous information security risks for organizations

9. THE FIRST LINE OF DEFENSE - PEOPLE
The first line of defense an organization should follow to help combat insider issues is to develop information security policies and an information security plan
Information security policies
Information security plan

10. THE FIRST LINE OF DEFENSE - PEOPLE
Five steps to creating an information security plan:
Develop the information security policies
Communicate the information security policies
Identify critical information assets and risks
Test and reevaluate risks
Obtain stakeholder support

11. THE SECOND LINE OF DEFENSE - TECHNOLOGY
Three primary information technology security areas
Authentication and authorization
Something the user knows; Something the user has; Something that is part of the user
Prevention and resistance
Content filtering, encryption, and firewalls
Detection and response
Antivirus software is the most common type of detection and response technology

12. DETECTION AND RESPONSE
Security threats to ebusiness include:
Elevation of privilege
Hoaxes
Malicious code
Spoofing
Spyware
Sniffer
Packet tampering