1. Chapter 3 Ethics, Privacy & Security
Describe the major ethical issues related to information technology and identify situations in which they occur.
Identify the many threats to information security
Understand the various defense mechanisms used to protect information systems.
Explain IT auditing and planning for disaster recovery.

2. Case Study TJX
SWOT

3. Ethical Issues
Fundamental tenets of ethics include responsibility, accountability, and liability
unethical is not necessarily illegal.
Should organizations monitor employees’ Web surfing and ?
Should organizations sell customer information to other companies?

4. Ethical Issues
Should organizations audit employees’ computers for unauthorized software or illegally downloaded music or video files?
Privacy issues
Accuracy issues
Property issues
Accessibility issues

5. Protecting Privacy
The right of privacy is not absolute. Privacy must be balanced against the needs of society
The public’s right to know supersedes the individual’s right of privacy
International Aspects of Privacy

6. IT’s About Business
Security Outside the Perimeter: LexisNexis

7. Threats to Information Security
Today’s interconnected, interdependent, wirelessly networked business environment
Governmental legislation
Smaller, faster, cheaper computers and storage devices
Decreasing skills necessary to be a computer hacker
International organized crime taking over cybercrime
Downstream liability
Increased employee use of unmanaged devices
Lack of management support

8. Threats to Information Systems
Unintentional acts
Natural disasters
Technical failures
Management failures
Deliberate acts

9. IT’s About Business
The “Hack, Pump, and Dump” Scheme

10. Protecting Information Resources
Risk management
Risk analysis
Risk mitigation
Risk acceptance
Risk limitation
Risk transference

11. Protecting Information Resources
Controls
The Difficulties in Protecting Information Resources
Physical Controls
Access Controls

13. Protecting Information Resources
Authentication
Something the User Is
Something the User Has
Something the User Does
Something the User Knows

14. IT’s About Business
Providing Least Privilege at UPS

15. Protecting Information Resources
Communications (network) controls
Firewalls.
Anti-malware systems.

17. Protecting Information Resources
Whitelisting and Blacklisting
Intrusion Detection Systems
Encryption.
Virtual Private Networking
Secure Socket Layer

18. IT’s About Business
Using Encryption to Reduce Security Risks at Harvard Pilgrim

19. Ethics, Privacy, and Information Security

20. Ethics, Privacy, and Information Security
Vulnerability Management Systems
Employee Monitoring Systems
Application Controls

21. Business Continuity Planning, Backup, and Recovery
hot site
warm site
cold site
off-site data storage

22. IT’s About Business
The Baltimore Ravens Plan for Business Continuity

23. Information Systems Auditing
Types of Auditors and Audits
How Is Auditing Executed?