1. Misbahuddin Azzuhri SE. MM. CPHR.
MANAGEMENT2013
Misbahuddin Azzuhri SE. MM. CPHR.    
Department of Management FEB UB
D Building 1st Floor, Jalan Mayjen Haryono 165 B Malang 65145
Phone : , Fax :

2. MIS | SECURING INFORMATION SYSTEM
Misbahuddin Azzuhri SE. MM. CPHR.
Department of Management
FEB | UB
New Face | New Hope | New Inspiration

3. Management Information Systems Securing Information System
OBJECTIVES
Explain why information systems need special protection from destruction, error, and abuse
Assess the business value of security and control
Evaluate elements of an organizational and managerial framework for security and control
Department of Management
FEB | UB

4. Management Information Systems
Securing Information System
OBJECTIVES (Continued)
Evaluate the most important tools and technologies for safeguarding information resources
Identify the challenges posed by information systems security and control and management solutions
Department of Management
FEB | UB

5. Management Information Systems Securing Information System
Wesfarmers Limited Case
Challenge: provide network and infrastructure security to a financial services firm in a Web-enabled high-threat environment
Solutions: outsource to a well-known security firm the task of providing 24 x 7 network and infrastructure monitoring and reporting
Real-time security monitoring 24 x 7, best practices, online security portal, data mining of network transactions
Illustrates the role of system and network security in providing customers with service and managing corporate risk in online environments
Department of Management
FEB | UB

6. Why Systems Are Vulnerable
Management Information Systems
Securing Information System
SYSTEM VULNERABILITY AND ABUSE
Why Systems Are Vulnerable
Contemporary Security Challenges and Vulnerabilities
Figure 10-1
Department of Management
FEB | UB

7. Why Systems Are Vulnerable (Continued) Internet Vulnerabilities:
Management Information Systems
Securing Information System
SYSTEM VULNERABILITY AND ABUSE
Why Systems Are Vulnerable (Continued)
Internet Vulnerabilities:
Use of fixed Internet addresses through use of cable modems or DSL
Lack of encryption with most Voice over IP (VoIP)
Widespread use of and instant messaging (IM)
Department of Management
FEB | UB

8. Wireless Security Challenges:
Management Information Systems
Securing Information System
SYSTEM VULNERABILITY AND ABUSE
Wireless Security Challenges:
Radio frequency bands are easy to scan
The service set identifiers (SSID) identifying the access points broadcast multiple times
Department of Management
FEB | UB

9. Wi-Fi Security Challenges
Management Information Systems
Securing Information System
SYSTEM VULNERABILITY AND ABUSE
Wi-Fi Security Challenges
Figure 10-2
Department of Management
FEB | UB

10. Malicious Software: Viruses, Worms, Trojan Horses, and Spyware
Management Information Systems
Securing Information System
SYSTEM VULNERABILITY AND ABUSE
Malicious Software: Viruses, Worms, Trojan Horses, and Spyware
Hackers and Cybervandalism
Computer viruses, worms, trojan horses
Spyware
Spoofing and Sniffers
Denial of Service (DoS) Attacks
Identity theft
Cyberterrorism and Cyberwarfare
Vulnerabilities from internal threats (employees); software flaws
Department of Management
FEB | UB

11. Worldwide Damage from Digital Attacks
Management Information Systems
Securing Information System
SYSTEM VULNERABILITY AND ABUSE
Worldwide Damage from Digital Attacks
Figure 10-3
Department of Management
FEB | UB

12. Inadequate security and control may create serious legal liability.
Management Information Systems
Securing Information System
BUSINESS VALUE OF SECURITY AND CONTROL
Inadequate security and control may create serious legal liability.
Businesses must protect not only their own information assets but also those of customers, employees, and business partners. Failure to do so can lead to costly litigation for data exposure or theft.
A sound security and control framework that protects business information assets can thus produce a high return on investment.
Department of Management
FEB | UB

13. Security Incidents Continue to Rise
Management Information Systems
Securing Information System
BUSINESS VALUE OF SECURITY AND CONTROL
Security Incidents Continue to Rise
Figure 10-4
Source: CERT Coordination Center, accessed July 6, 2004.

14. Legal and Regulatory Requirements for Electronic Records Management
Management Information Systems
Securing Information System
BUSINESS VALUE OF SECURITY AND CONTROL
Legal and Regulatory Requirements for Electronic Records Management
Electronic Records Management (ERM): Policies, procedures and tools for managing the retention, destruction, and storage of electronic records
Department of Management
FEB | UB

15. Data Security and Control Laws:
Management Information Systems
Securing Information System
BUSINESS VALUE OF SECURITY AND CONTROL
Data Security and Control Laws:
The Health Insurance Portability and Accountability Act (HIPAA)
Gramm-Leach-Bliley Act
Sarbanes-Oxley Act of 2002
Department of Management
FEB | UB

16. Electronic Evidence and Computer Forensics
Management Information Systems
Securing Information System
BUSINESS VALUE OF SECURITY AND CONTROL
Electronic Evidence and Computer Forensics
Electronic Evidence: Computer data stored on disks and drives, , instant messages, and e-commerce transactions
Computer Forensics: Scientific collection, examination, authentication, preservation, and analysis of computer data for use as evidence in a court of law
Department of Management
FEB | UB

17. Types of Information Systems Controls
Management Information Systems
Securing Information System
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Types of Information Systems Controls
General controls:
Software and hardware
Computer operations
Data security
Systems implementation process
Department of Management
FEB | UB

18. Application controls:
Management Information Systems
Securing Information System
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Application controls:
Input
Processing
Output
Department of Management
FEB | UB

19. Management Information Systems
Securing Information System
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Risk Assessment:
Determines the level of risk to the firm if a specific activity or process is not properly controlled
Department of Management
FEB | UB

20. Acceptable Use Policy (AUP) Authorization policies
Management Information Systems
Securing Information System
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Security Policy:
Policy ranking information risks, identifying acceptable security goals, and identifying the mechanisms for achieving these goals
Acceptable Use Policy (AUP)
Authorization policies
Department of Management
FEB | UB

21. Security Profiles for a Personnel System
Management Information Systems
Securing Information System
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Security Profiles for a Personnel System
Figure 10-5

22. Ensuring Business Continuity
Management Information Systems
Securing Information System
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Ensuring Business Continuity
Downtime: Period of time in which a system is not operational
Fault-tolerant computer systems: Redundant hardware, software, and power supply components to provide continuous, uninterrupted service
High-availability computing: Designing to maximize application and system availability
Department of Management
FEB | UB

23. Ensuring Business Continuity (Continued)
Management Information Systems
Securing Information System
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Ensuring Business Continuity (Continued)
Load balancing: Distributes access requests across multiple servers
Mirroring: Backup server that duplicates processes on primary server
Recovery-oriented computing: Designing computing systems to recover more rapidly from mishaps
Department of Management
FEB | UB

24. Ensuring Business Continuity (Continued)
Management Information Systems
Securing Information System
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Ensuring Business Continuity (Continued)
Disaster recovery planning: Plans for restoration of computing and communications disrupted by an event such as an earthquake, flood, or terrorist attack
Business continuity planning: Plans for handling mission-critical functions if systems go down
Department of Management
FEB | UB

25. Management Information Systems
Securing Information System
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Auditing:
MIS audit: Identifies all of the controls that govern individual information systems and assesses their effectiveness
Security audits: Review technologies, procedures, documentation, training, and personnel
Department of Management
FEB | UB

26. Sample Auditor’s List of Control Weaknesses
Management Information Systems
Securing Information System
ESTABLISHING A MANAGEMENT FRAMEWORK FOR SECURITY AND CONTROL
Sample Auditor’s List of Control Weaknesses
Figure 10-6
Department of Management
FEB | UB

27. Biometric authentication
Management Information Systems
Securing Information System
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Access Control
Access control: Consists of all the policies and procedures a company uses to prevent improper access to systems by unauthorized insiders and outsiders
Authentication:
Passwords
Tokens, smart cards
Biometric authentication
Department of Management
FEB | UB

28. Firewalls, Intrusion Detection Systems, and Antivirus Software
Management Information Systems
Securing Information System
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Firewalls, Intrusion Detection Systems, and Antivirus Software
Firewalls: Hardware and software controlling flow of incoming and outgoing network traffic
Intrusion detection systems: Full-time monitoring tools placed at the most vulnerable points of corporate networks to detect and deter intruders
Department of Management
FEB | UB

29. Wi-Fi Protected Access specification
Management Information Systems
Securing Information System
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Firewalls, Intrusion Detection Systems, and Antivirus Software (Continued)
Antivirus software: Software that checks computer systems and drives for the presence of computer viruses and can eliminate the virus from the infected area
Wi-Fi Protected Access specification
Department of Management
FEB | UB

30. A Corporate Firewall Management Information Systems Figure 10-7
Securing Information System
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
A Corporate Firewall
Figure 10-7
Department of Management
FEB | UB

31. Encryption and Public Key Infrastructure
Management Information Systems
Securing Information System
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Encryption and Public Key Infrastructure
Public key encryption: Uses two different keys, one private and one public. The keys are mathematically related so that data encrypted with one key can be decrypted using only the other key
Message integrity: The ability to be certain that the message being sent arrives at the proper destination without being copied or changed
Department of Management
FEB | UB

32. Encryption and Public Key Infrastructure (Continued)
Management Information Systems
Securing Information System
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Encryption and Public Key Infrastructure (Continued)
Digital signature: A digital code attached to an electronically transmitted message that is used to verify the origin and contents of a message
Digital certificates: Data files used to establish the identity of users and electronic assets for protection of online transactions
Public Key Infrastructure (PKI): Use of public key cryptography working with a certificate authority

33. Encryption and Public Key Infrastructure (Continued)
Management Information Systems
Securing Information System
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Encryption and Public Key Infrastructure (Continued)
Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS): protocols for secure information transfer over the Internet; enable client and server computer encryption and decryption activities as they communicate during a secure Web session.
Secure Hypertext Transfer Protocol (S-HTTP): used for encrypting data flowing over the Internet; limited to Web documents, whereas SSL and TLS encrypt all data being passed between client and server.
Department of Management
FEB | UB

34. Public Key Encryption Management Information Systems Figure 10-8
Securing Information System
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Public Key Encryption
Figure 10-8
Department of Management
FEB | UB

35. Digital Certificates Management Information Systems Figure 10-9
Securing Information System
TECHNOLOGIES AND TOOLS FOR SECURITY AND CONTROL
Digital Certificates
Figure 10-9

36. Management Opportunities:
Management Information Systems
Securing Information System
MANAGEMENT OPPORTUNITIES, CHALLENGES AND SOLUTIONS
Management Opportunities:
Creation of secure, reliable Web sites and systems that can support e-commerce and e-business strategies
Department of Management
FEB | UB

37. Management Challenges:
Management Information Systems
Securing Information System
MANAGEMENT OPPORTUNITIES, CHALLENGES AND SOLUTIONS
Management Challenges:
Designing systems that are neither overcontrolled nor undercontrolled
Implementing an effective security policy
Department of Management
FEB | UB

38. Management Information Systems
Securing Information System
MANAGEMENT OPPORTUNITIES, CHALLENGES AND SOLUTIONS
Solution Guidelines:
Security and control must become a more visible and explicit priority and area of information systems investment.
Support and commitment from top management is required to show that security is indeed a corporate priority and vital to all aspects of the business.
Security and control should be the responsibility of everyone in the organization.

39. NEXT | ENHANCING DECISION MAKING
Misbahuddin Azzuhri SE. MM. CPHR.
Department of Management
FEB | UB
New Face | New Hope | New Inspiration