Embed Size (px)
Citation preview
CHAPTER 6Information Security
CHAPTER OUTLINE
4.1 Introduction to Information Security
4.2 Unintentional Threats to Information Security
4.3 Deliberate Threats to Information Security
4.4 What Organizations Are Doing to Protect
Information Resources
4.5 Information Security Controls
LEARNING OBJECTIVES
1. Identify the five factors that contribute to the
increasing vulnerability of information resources,
and provide a specific example of each one.
2. Compare and contrast human mistakes and
social engineering, and provide a specific
example of each one.
3. Discuss the nine types of deliberate attacks.
LEARNING OBJECTIVES (continued)
4. Define the three risk mitigation strategies, and
provide an example of each one in the context
of you owning a home.
5. Identify the three major types of controls that
organizations can use to protect their
information resources, and provide an example
of each one.
7.1 Introduction to Information Security
© Sebastian/AgeFotostock America, Inc.
Information security refers to all of the processes and policies designed to protect an organization’s information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.
Key Information Security Terms
A threat to an information resource
is any danger to which a system may
be exposed.
vulnerability is the possibility that
the system will suffer harm by a threat
exposure of an information resources is the harm, loss or damage that can result if a threat compromises that resource.
Smaller, Faster Devices
© PhotoEdit/Alamy Limited
© laggerbomber-Fotolia.com© Dragonian/iStockphoto
Decreasing Skills Needed to be a Hacker
New & Easier Tools make it very easy to attack the Network
Attacks are becoming increasingly sophisticated
© Sven Taubert/Age Fotostock America, Inc.
Organized Crime Taking Over Cybercrime
© Stockbroker xtra/AgeFotostock America, Inc.
Lack of Management Support
© Sigrid Olsson/Photo Alto/Age Fotostock
7.2 Unintentional Threats to Information Systems
George Doyle/ImageSource Limited
Security Threats
Human Errors
Carelessness with laptops and portable computing devices
Opening questionable e-mails
Careless Internet surfing
Poor password selection and use
And more
Social Engineering
2 examples
Tailgating
Shoulder surfing
© Purestock/Age Fotostock America, Inc
7.3 Deliberate Threats to Information Systems
There are many types of deliberate attacks including:
• Espionage or Trespass
• Information extortion
• Sabotage or vandalism
• Theft of equipment or information
• Identity theft
• Compromises to intellectual property
• Soft ware attacks
• Alien soft ware
• Supervisory control and data acquisition (SCADA) attacks
• Cyberterrorism and cyberwarfare
Deliberate Threats
Espionage or trespass• Competitive intelligence consists of legal information-
gathering techniques. • Industrial espionage crosses the legal boundary.
Information extortion
Sabotage or vandalism
Theft of equipment or information– For example, dumpster diving
© Diego Cervo/Age Fotostock America, Inc.
Deliberate Threats (continued)
Identify theft
Compromises to intellectual property• Compromises to intellectual property• Intellectual property. Property created by individuals or
corporations which is protected under trade secret, patent, and copyright laws.
• Trade secret. Intellectual work, such as a business plan, that is a company secret and is not based on public information.
Frederic Lucano/Stone/Getty Images, Inc.
• Patent. Document that grants the holder exclusive rights on an invention or process for 20 years.
• Copyright. Statutory grant that provides creators of intellectual property with ownership of the property for life of the creator plus 70 years.
• Piracy. Copying a software program without making payment to the owner.
• Virus is a segment of computer code that performs malicious actions by attaching to another computer program.
• Worm is a segment of computer code that performs malicious actions and will spread by itself without requiring another computer program.
• Trojan horse is a computer program that hides in another computer program and reveals its designated behavior only when it is activated.
• Logic bomb is a segment of computer code that is embedded inside an organization’s existing computer programs and is designed to activate and perform a destructive action at a certain time or date.
Deliberate Threats (continued)Software attacks
virus is a segment of
computer code that performs
malicious actions by
attaching to another
computer program.
worm is a segment of
computer code that spreads by
itself and performs malicious
actions without requiring another
computer program
Trojan horse is a software
program that hides in other
computer programs when
it is activated.Trojan
horse is to capture your
sensitive information
(e.g., passwords,
account numbers, etc.) and send them to the creator of
the Trojan horse.
A logic bomb is a segment of computer code
that is embedded within an
organization’s existing
computer programs and is
designed to activate and perform a
destructive action at a
certain time and date.
Software attacks (continued)Phishing attacks
• Phishing slideshow• Phishing quiz• Phishing example• Phishing example
Distributed denial-of-service attacks
• See botnet demonstration
Deliberate Threats (continued)
How to Detect a Phish E-mail
Is the email really from eBay, or PayPal, or a bank?
As Spammers get better, their emails look more genuine. How do you tell if it’s a scam and phishing for personal information? Here’s how ...
Is the email really from eBay, or PayPal,
or a bank? As an example, here is what the email said:
– Return-path: <[email protected]>– From: "PayPal"<[email protected]>– Subject: You have 1 new Security Message Alert !
Note that they even give
advice in the right column
about security
Example Continued – bottom of the email
How to see what is happening View Source
• In Outlook, right click on email, click ‘view source’.
• In GroupWise, open email and click on the Message Source tab.
• In Mozilla Thunderbird, click on View, and Source.
• Below is the part of the text that makes the email look official – the images came from the PayPal website.
View Source – The Real Link
• In the body it said, “If you are traveling, “Travelling Confirmation Here” .
• Here is where you are really being sent– href=3Dftp://futangiu:[email protected]/
index.htm.
• Notice that the link is not only not PayPal, it is an IP address, 2 giveaways of a fraudulent link.
Another Example – Amazon
Deliberate Threats (continued)Alien SoftwareSpyware collects personal information about users without their consent
Two types of spyware are :-Keystroke loggers record your keystrokes and your Web browsing history
Screen scrapers record a continuous “movie” of what you do on a screen.
The spyware video provides a nice overview of spyware and how to avoid
it.
Spamware is alien software that is designed to use your computer as a launchpad for spammers. Spam is
unsolicited e-mail.
Cookies
are small amounts of information that Web sites store on your computer.• The cookie demo will show you how much information your computer sends when you connect to a
Web site.
Cookies
Cookies
are small amounts of information that Web sites store on your computer.
The cookie demo will show you how much information your
computer sends when you connect to a Web site.
Example of CAPTCHA
