1. Computer Crime and Information Technology Security
Chapter 15
Computer Crime and Information Technology Security
McGraw-Hill/Irwin
Copyright © 2010 by The McGraw-Hill Companies, Inc. All rights reserved.

2. Outline Objectives Carter’s taxonomy
Risks and threats to information systems
Computer criminals
Prevention and detection techniques
COBIT framework
15-2

3. Objectives When you finish this chapter, you should be able to:
Explain Carter’s taxonomy of computer crime
Identify and describe business risks and threats to information systems
Name and describe common types of computer criminals
Discuss ways to prevent and detect computer crime
Explain COBIT’s information criteria and accountability framework
Explain how COBIT can be used to strengthen internal controls against computer crime
15-3

4. Carter’s taxonomy Target: targets the system or its data
Instrumentality: computer furthers a criminal end
Incidental: computer is not required for the crime but is related to the criminal act
Associated: new versions of traditional crimes
15-4

5. Risks and threats to information systems
Fraud
Any illegal act for which knowledge of computer technology is used to commit the offense
Service interruptions and delays
Delay in processing information
Intrusions
Bypassing security controls or exploiting a lack of adequate controls
Information manipulation
Can occur at virtually any stage of information processing from input to output
15-5

6. Risks and threats to information systems
Denial of service attacks
Prevent computer systems and networks from functioning in accordance with their intended purpose
Error
Can vary widely
Disclosure of confidential information
Can have major impacts on an organization's financial health
Information theft
Targets the organization's most precious asset: information
15-6

7. Risks and threats to information systems
Malicious software
Virus, Trojan horse, worms, logic bombs
Web site defacements
Digital graffiti where intruders modify pages
Extortion
Threat to either reveal information to the public or to launch a prolonged denial of service if demands are not met
15-7

8. Computer criminals Script kiddies Hacker Cyber-criminals
Young inexperienced hacker who uses tools and scripts written by others for the purpose of attacking systems
Hacker
Someone who invades an information system for malicious purposes
Cyber-criminals
Hackers driven by financial gain
Organized crime
Spamming, phishing, extortion and all other profitable branches of computer crime
Corporate spies
Computer intrusion techniques to gather information
15-8

9. Computer criminals Terrorists Insiders
Target the underlying computers and networks of a nation’s critical infrastructure
Insiders
May be the largest threat to a company’s information systems and underlying computer infrastructure
15-9

10. Prevention and detection techniques
CIA triad
Confidentiality
Data integrity
Availability
Internal controls
Physical: locks, security guards, badges, alarms
Technical: firewalls, intrusion detection, access controls, cryptography
Administrative: security policy, training, reviews
15-10

11. COBIT framework
Control Objectives for Information and Related Technology
Published by Information Systems Audit and Control Association (
Three points of view
Business objectives
IT resources
IT processes
15-11

12. COBIT framework Four domains of knowledge Seven information criteria
Plan and organize
Acquire and implement
Deliver and support
Monitor and evaluate
Seven information criteria
Effectiveness
Efficiency
Confidentiality
Integrity
Availability
Compliance
Reliability of information
15-12

13. Accountability framework (Figure 15.3)
COBIT framework
Accountability framework (Figure 15.3)
15-13

14. 15-14