1. Chapter 12 Designing System Interfaces, Controls, and Security
Systems Analysis and Design in a Changing World, 3rd Edition

2. Identifying System Interfaces
Systems interfaces are broadly defined as inputs or outputs with minimal or no human intervention
Inputs from other systems (messages, EDI)
Highly automated input devices such as scanners
Inputs that are from data in external databases
Outputs that are to external databases
Outputs with minimal HCI
Outputs to other systems
Real-time connections (both input and output)

3. Full Range of Inputs and Outputs

4. eXtensible Markup Language (XML)
Extension of HTML that embeds self-defined data structures within textual messages
Transaction that contains data fields can be sent with XML codes to define meaning of data fields
XML provides common system-to-system interface
XML is simple and readable by people
Web services is based on XML to send business transactions over Internet

5. System-to-System Interface Based on XML

6. Design of System Inputs
Identify devices and mechanisms used to enter input
High-level review of most up-to-date methods to enter data
Identify all system inputs and develop list of data content with each
Provides link between design of application software and design of user and system interfaces
Determine controls and security necessary for each system input

7. Input Devices and Mechanisms
Capture data as close to origination source as possible
Use electronic devices and automatic entry whenever possible
Avoid human involvement as much as possible
Seek information in electronic form to avoid data reentry
Validate and correct information at entry point

8. Prevalent Input Devices to Avoid Human Data Entry
Magnetic card strip readers
Bar-code readers
Optical character recognition readers and scanners
Touch screens and devices
Electronic pens and writing surfaces
Digitizers, such as digital cameras and digital audio devices

9. Defining the Details of System Inputs
Ensure all data inputs are identified and specified correctly
Can use traditional structured models
Identify automation boundary
Use DFD fragments
Segment by program boundaries
Examine Structure Charts
Analyze each module and data couple
List individual data fields

10. Automation Boundary on a System-level DFD

11. Create New Order DFD with an Automation Boundary

12. List of Inputs for Customer Support System

13. Structure Chart for Create New Order

14. Data Flows, Data Couples, and Data Elements Making up Inputs

15. Using Object-Oriented Models
Identifying user and system inputs with OO approach has same tasks as traditional approach
OO diagrams are used instead of DFDs and structure charts
System sequence diagrams identify each incoming message
Design class diagrams identify and describe input parameters and contain pseudocode to verify characteristics of inputs

16. Partial System Sequence Diagram for Payroll System Use Cases

17. System Sequence Diagram for Create New Order

18. Input Messages and Data Parameters from RMO System Sequence Diagram

19. Designing System Outputs
Determine each type of output
Make list of specific system outputs required based on application design
Specify any necessary controls to protect information provided in output
Design and prototype output layout
Ad hoc reports – designed as needed by user

20. Defining the Details of System Outputs
Type of reports
Printed reports
Electronic displays
Turnaround documents
May use traditional structured models to identify outputs
Data flows crossing automation boundary
Data couples and report data requirements on structure chart

21. Table of System Outputs Based on Traditional Structured Approach

22. Using Object-Oriented Models
Outputs indicated by messages in sequence diagrams
Originate from internal system objects
Sent to external actors or another external system
Output messages based on an individual object are usually part of methods of that class object
To report on all objects within a class, class-level method is used that works on entire class

23. Table of System Outputs Based on OO Messages

24. Designing Reports, Statements, and Turnaround Documents
Printed versus electronic
Type of output reports
Detailed
Summary
Exception
Executive
Internal versus external
Graphical and multimedia presentation

25. RMO Summary Report with Drill Down to the Detailed Report

26. Sample Bar Chart and Pie Chart Reports

27. Formatting Reports What is objective of report?
Who is the intended audience?
What is media for presentation?
Avoid information overload
Format considerations such as meaningful headings, date of information, date report produced, page numbers

28. Designing Integrity Controls
Mechanisms and procedures built into a system to safeguard it and information contained within
Integrity controls
Built into application and database system to safeguard information
Security controls
Built into operating system and network

29. Objectives of Integrity Controls
Ensure that only appropriate and correct business transactions occur
Ensure that transactions are recorded and processed correctly
Protect and safeguard assets of the organization
Software
Hardware
Information

30. Points of Security and Integrity Controls

31. Input Integrity Controls
Used with all input mechanisms
Additional level of verification to help reduce input errors
Common control techniques
Field combination controls
Value limit controls
Completeness controls
Data validation controls

32. Database Integrity Controls
Access control
Data encryption
Transaction control
Update control
Backup and recovery protection

33. Output Integrity Controls
Ensures output arrives at proper destination and is correct, accurate, complete, and current
Destination controls - output is channeled to correct people
Completeness, accuracy, and correctness controls
Appropriate information present on output

34. Integrity Controls to Prevent Fraud
Three conditions are present in fraud cases
Personal pressure, such as desire to maintain extravagant lifestyle
Rationalization, such as person’s thoughts that “I will repay this money”
Opportunity, such as unverified cash receipts
Control of fraud requires both manual procedures and computer integrity controls

35. Fraud Risks and Prevention Techniques

36. Designing Security Controls
Security controls protect assets of organization from all threats
External threats such as hackers, viruses, worms, and message overload attacks
Security control objectives
Maintain stable, functioning operating environment for users and application systems (24 x 7)
Protect information and transactions during transmission outside organization (public carriers)

37. Security for Access to Systems
Used to control access to any resource managed by operating system or network
User categories
Unauthorized user – no authorization to access
Registered user – authorized to access system
Privileged user – authorized to administrate system
Organized so that all resources can be accessed with same unique ID/password combination

38. Users and Access Roles to Computer Systems

39. Managing User Access Most common technique is user ID / password
Authorization – Is user permitted to access?
Access control list – users with rights to access
Authentication – Is user who they claim to be?
Smart card – computer readable plastic card with embedded security information
Biometric devices – keystroke patterns, fingerprint, retinal scans, voice characteristics

40. Data Security Data and files themselves must be secure
Encryption – primary security method
Altering data so unauthorized users cannot view
Decryption
Altering encrypted data back to original state
Symmetric key – same key encrypts and decrypts
Asymmetric key – different key decrypts
Public key – public encrypts, private decrypts

41. Symmetric Key Encryption

42. Asymmetric Key Encryption

43. Digital signatures and certificates
Encryption of messages enables secure exchange of information between two entities with appropriate keys
Digital signature encrypts document with private key to verify document author
Digital certificate is institution’s name and public key that is encrypted and certified by third party
Certifying authority
Verisign or Equifax

44. Using a Digital Certificate

45. Secure Transactions
Standard set of methods and protocols for authentication, authorization, privacy, integrity
Secure Sockets Layer (SSL) renamed as Transport Layer Security (TLS) – protocol for secure channel to send messages over Internet
IP Security (IPSec) – newer standard for secure Internet message transmission
Secure Hypertext Transport Protocol (HTTPS or HTTP-S) – standard for transmitting Web pages securely (encryption, digital signing, certificates)

46. Summary System interfaces all inputs/outputs except (GUI)
Designing inputs to system is three-step process
Identify devices/mechanisms used to enter input
Identify system inputs, develop list of data content
Determine controls and security necessary for each system input
Traditional approach to design inputs and outputs
DFDs, data flow definitions, structure charts

47. Summary (continued) OO approach to design inputs and outputs
Sequence diagrams, class diagrams, DFDs
Integrity controls and security designed into system
Only appropriate and correct business transactions occur
Transactions are recorded and processed correctly
Protect and safeguard assets of the organization
Control access to resources