1 Pertemuan 23 & 24 Security and Ethical Challenges Matakuliah: J0454 / Sistem Informasi Manajemen...
-
date post
19-Dec-2015 -
Category
Documents
-
view
242 -
download
2
Transcript of 1 Pertemuan 23 & 24 Security and Ethical Challenges Matakuliah: J0454 / Sistem Informasi Manajemen...
1
Pertemuan 23 & 24Security and Ethical Challenges
Matakuliah : J0454 / Sistem Informasi Manajemen
Tahun : 2006
Versi : 1 / 1
2
Learning Outcomes
Pada akhir pertemuan ini, diharapkan mahasiswa
akan mampu :
• Mahasiswa akan dapat memilih strategi penerapan dan pengembangan manajemen keamanan teknologi informasi C4
3
Outline Materi
• Security, Ethical and Societal Challenges of IT
• Computer Crime
• Privacy Issues
• Security Management of IT
• Tools of Security Management
• Internetworked Security Defenses
4
Security and Ethics
Business/IT Security, Ethics, and SocietyBusiness/IT Security, Ethics, and Society
Employment
Health
Individuality
Privacy
WorkingConditions
Crime
Business/ITSecurity
Ethics andSociety
5
Security and Ethics
• Business Ethics• Stockholder Theory• Social Contract Theory• Stakeholder Theory
Ethical ResponsibilityEthical Responsibility
6
Security and Ethics
Ethical ResponsibilityEthical Responsibility
7
Security and Ethics
Technology EthicsTechnology Ethics
8
Security and Ethics
Ethical GuidelinesEthical Guidelines
9
Security Management
• Security is 6 to 8% of IT Budget in Developing Countries
• 63% Have or Plan to Have Position of Chief Privacy or Information Officer in the Next Two Years
• 40% Have a Chief Privacy Officer and Another 6% Intend One in the Next Two Years
• 39% Acknowledge that their Systems Have Been Compromised in the Past Year
• 24% Have Cyber Risk Insurance and 5% Intend to Acquire Such Coverage
10
Antivirus 96%
Virtual Private Networks86%
Intrusion-Detection Systems85%
Content Filtering/Monitoring77%
Public-Key Infrastructure 45%
Smart Cards43%
Biometrics19%
Security Technology UsedSecurity Technology Used
Security Management
11
PayPal, Inc. Cybercrime on the InternetPayPal, Inc. Cybercrime on the Internet
• Online Payment Processing Company• Observed Questionable Accounts Being
Opened• Froze Accounts Used to Buy Expensive
Goods For Purchasers in Russia• Used Sniffer Software and Located Users
Capturing PayPal Ids and Passwords• More than $100,000 in Fraudulent
Charges• Crooks Arrested by FBI
Security Management
12
Computer CrimeComputer Crime• Hacking• Cyber Theft• Unauthorized Use of
Work• Piracy of Intellectual
Property• Computer Viruses and
Worms
Security Management
13
Examples of Common HackingExamples of Common Hacking
Security Management
14
Recourse Technologies: Insider Computer CrimeRecourse Technologies: Insider Computer Crime
• Link Between Company Financial Difficulty and Insider Computer Crimes
• Use of “Honey Pots” Filled with Phony Data to Attract Hackers
• Software Catches Criminal Activity in Seconds
• Crime Exposed and Stopped
Security Management
15
Internet Abuses in the WorkplaceInternet Abuses in the Workplace
Security Management
16
Network Monitoring SoftwareNetwork Monitoring Software
Security Management
17
Copying Music CDs: Intellectual Copying Music CDs: Intellectual Property ControversyProperty Controversy
• RIAA Crack Down on Music Piracy
• Web Sites Fighting Back• 140 Million Writable Drives In
Use• Billions of Blank CDs Sold
While Music CD Sales Are Going Down
• Pirates Reluctant to Go Away
Security Management
18
Facts About Recent Computer Facts About Recent Computer Viruses and WormsViruses and Worms
Security Management
19
University of Chicago: The University of Chicago: The Nimda WormNimda Worm
• Nimda Worm Launch Sept. 18, 2001 Mass Mailing of Malicious Code Attacking MS-Windows
• Took Advantage of Back Doors Previously Left Behind
• In Four Hours the University of Chicago’s Web Servers were Scanned by 7,000 Unique IP Addresses Looking for Weaknesses
• Many Servers Had to Be Disconnected
Security Management
20
Right to PrivacyRight to Privacy• Computer Profiling• Computer Matching• Privacy Laws• Computer Libel and Censorship
• Spamming• Flaming
Privacy Issues
21
Other ChallengesOther Challenges
• Employment Challenges
• Working Conditions
• Individuality Issues
• Health Issues
Privacy Issues
22
ErgonomicsErgonomicsPrivacy Issues
23
ErgonomicsErgonomics• Job Stress• Cumulative Trauma
Disorders (CTDs)• Carpal Tunnel
Syndrome• Human Factors
Engineering• Societal Solutions
Privacy Issues
24
Tools of Security Management
Security Management of Information Technology
25
Security Management of Information Technology
• Need for Security Management Caused by Increased Use of Links Between Business Units
• Greater Openness Means Greater Vulnerabilities
• Better Use of Identifying, Authenticating Users and Controlling Access to Data
• Theft Should Be Made as Difficult as Possible
Providence Health and Cervalis: Providence Health and Cervalis: Security Management IssuesSecurity Management Issues
26
Security Management of Information Technology
•Encryption–Public Key–Private Key
Graphically…Graphically…
Internetworked Security DefensesInternetworked Security Defenses
27
EncryptionEncryption
Security Management of Information Technology
28
FirewallsFirewalls
Security Management of Information Technology
Firewall
IntranetServer
Firewall
Router Router
IntranetServer
Host System
Internet
1
2
3
4
4 5
1 External FirewallBlocks Outsiders
2 Internal FirewallBlocks Restricted Materials
3 Use of Passwords and Browser Security
4 Performs Authentication and Encryption
5 Careful Network Interface Design
29
Security Management of Information Technology
• MTV.com Website Targeted for Distributed Denial of Service (DDOS) Attacks During Fall Peak Periods
• Some People Try to Crash MTV Sites
• Parent Viacom Installed Software to Filter out DDOS Attacks
• Website Downtime Reduced
MTV Networks: Denial of MTV Networks: Denial of Service DefensesService Defenses
30
Defending Against Denial of Defending Against Denial of Service AttacksService Attacks
Security Management of Information Technology
31
• e-Sniff Monitoring Device Searches e-Mail by Key Word or Records of Web Sites Visited
• 82% of Businesses Monitor Web Use
• Close to 100% of Workers Register Some Improper Use
Sonalysts, Inc.: Corporate e-Sonalysts, Inc.: Corporate e-Mail MonitoringMail Monitoring
Security Management of Information Technology
32
Security Management of Information Technology
• Much Software Was Unable to Stop Nimda Worm
• Software Alone is Often Not Enough to Clean System
• Until Better Software is Developed, A Complete System Disconnect and Purge May Be the Only Solution
TrueSecure and 724 Inc.: Limitations TrueSecure and 724 Inc.: Limitations of Antivirus Softwareof Antivirus Software
33
Example Security Suite InterfaceExample Security Suite Interface
Security Management of Information Technology
34
Other Security MeasuresOther Security Measures
Security Management of Information Technology
• Security Codes• Multilevel Password System
–Smart Cards• Backup Files
–Child, Parent, Grandparent Files
• System Security Monitors• Biometric Security
35
Example Security MonitorExample Security Monitor
Security Management of Information Technology
36
Evaluation of Biometric SecurityEvaluation of Biometric Security
Security Management of Information Technology
37
Computer Failure ControlsComputer Failure Controls
Security Management of Information Technology
• Fault Tolerant Systems–Fail-Over–Fail-Safe–Fail-Soft
• Disaster Recovery
38
Methods of Fault ToleranceMethods of Fault Tolerance
Security Management of Information Technology
39
Visa International: Fault Tolerant SystemsVisa International: Fault Tolerant Systems
Security Management of Information Technology
• Only 100% Uptime is Acceptable• Only 98 Minutes of Downtime in 12
Years• 1 Billion Transactions Worth $2
Trillion in Transactions a Year• 4 Global Processing Centers• Multiple Layers of Redundancy and
Backup• Software Testing and Art Form
40
Systems Controls and Audits
• Information System Controls• Garbage-In, Garbage-Out
(GIGO)• Auditing IT Security• Audit Trails• Control Logs
41
Systems Controls and Audits
Security CodesEncryption
Data Entry ScreensError SignalsControl Totals
Security CodesEncryption
Control TotalsControl Listings
End User Feedback
Security CodesEncryption
Backup FilesLibrary Procedures
Database Administration
InputControls
OutputControls
StorageControls
ProcessingControls
Software ControlsHardware Controls
FirewallsCheckpoints
42
Summary• Ethical and Societal
Dimensions• Ethical
Responsibility in Business
• Security Management
43
Sumber Materi PPT
• O’Brien, James A. (2005). Introduction to Information Systems (12th Edition). McGraw – Hill. Bab 11. Official PPT.