BEC 4 Security and Internet implications for business Flashcards Preview

BEC > BEC 4 Security and Internet implications for business > Flashcards

Flashcards in BEC 4 Security and Internet implications for business Deck (90)
Loading flashcards...
1

Technologies and security management features

A. Safeguarding records and files
B. Back up files
1. Son-father-grandfather concept
2. Back up of systems that can be shut down
3. Backups of systems that do not shut down
4. Mirroring
C. Uninterrupted power supply
D. Program modification controls
E. Data encryption
1. Digital certificates
2. Digital signatures vs E-signatures
F. Managing passwords
1. Password length
2. Password complexity
3. Password age
4. Password reuse
G. User access
1. Initial passwords and authorization for system access
2. Changes in position

2

A. Safeguarding records and files

-inadequate protection may result in damage or loss
- data can be protected by the use of internal and external labels and file protection rings

3

B. Back up files

Back up files

1. Son-father-grandfather concept - the most recent file is called the son and the back up process includes reading the previous file, recording transactions being processed and then creating a new updated master file.There are always at least two back ups.

2. Back up of systems that can be shut down - updated when shut down

3. Backups of systems that do not shut down - recovery includes applying a transaction log and reapplying those transactions to get back to the point immediately before the failure

4. Mirroring - the use of a back up computer to duplicate all of the processes and transactions on the primary computer

4

C. Uninterrupted power supply

a device that maintains a continuous supply of electrical power to connected equipment. Called battery back up.

5

D. Program modification controls

Program modification controls are controls over the modification of programs being used in production applications. They include controls designed to prevent changes by unauthorized personnel and also controls that track program changes

6

E. Data encryption

E. Data encryption - an essential foundation for electronic commerce. Encryption involves using a password or a digital key to scramble a readable message into an unreadable message. Then intended recipient of the message then uses the same or another digital key to decrypt or decipher the ciphertext message back into plaintext.
1. Digital certificates - an electronic document, created and digitally signed by a trusted party, which certifies the identity of the owners of a particular public key.
- The public key infrastructure - the system and processes used to issue and manage asymmetric keys and digital certificates.
- Certificate authority - the organization that issues public and private keys and records the public key in a digital certificate.
2. Digital signatures vs E-signatures - use asymmetric encryption to create legally-blinding electronic documents. Web-based e-signatures are an alternative mechanism for accomplishing the same objectives. An e-signature - a cursive style imprint of a person’s name that is applied to an electronic document

7

F. Managing passwords

F. Managing passwords - every account needs one
1. Password length - 7-8 signs
2. Password complexity - upper, lowercase, numeric, ASCII characters !@#$
3. Password age - every 3 months
4. Password reuse - should not be reused (24 passwords)

8

G. User access

G. User access
1. Initial passwords and authorization for system access
2. Changes in position - Hr and IT communication

9

Brute force attack

the attacker simply tries every possible key until the right one is found

10

A. Security Policy defined

A. Security Policy defined - a document that states how an org plans to protect the org’s info.

11

B. Security Policy goal

B. Security Policy goal - requires people to protect info, which protects the org, its people, and customers.

12

C. States and Locations of information covered by security policies:

1. The security policy should seek to secure info that exists in 3 distinct states:
a. Stored information
b. Processed information
c. Transmitted information
2. Information resides in locations:
a. information technology systems
b. paper
c. human brain
3. Relationship between states and locations of info (Examples):
a. Info systems - stored hard drives - processed computers - transmitted via internet
b. Paper - file cabinets - copy machine - fax
c. Brain - memory - synapses - language

13

Types of policies

1. Program level policy - used for creating a management sponsored computer security program. A program level policy, at the highest level, might prescribe the need for information security and may delegate the creation and management of the program to a role within the IT department.
2. Program-framework policy - establishes the overall approach to computer security
3. Issue specific policy
4. System specific policy

14

Development and management of security policies

1. Security objectives - series of statements to describe meaningful actions about specific resources.
2. Operational security - defines the manner in which a specific data operation would remain secure
3. Policy implementation - security is enforced by a combination of technical and traditional management methods.

15

Policy support documents

1. Regulations - laws, rules, regulations represent governmentally imposed restrictions passed by regulators and lawmakers
2. Standards and baselines - topic specific (Standards) and system specific (baseline) documents that describe overall requirements for security
3. Guidelines - provide hints, tips, and best practices in implementation
4. Procedures - step by step instructions on how to perform a specific security activity

16

Decryption or decipherment

the intended recipient converts the cipher text into plain text

17

Digital signature

is a means of ensuring that a message is not altered in transmission. It is a form of data encryption

18

Electronic Commerce (E-Commerce)

- the electronic consummation of exchange transactions,
- can use a private network or the Internet as the communications provided
- may involve communication between previously known parties or between parties that have had no prior contract or agreements

19

Electronic Business (E-business)

- general term
- any use of information technology like networking and communications technology to perform business processes in an electronic form
- may or may not relate to selling or buying

20

Electronic Data Interchange (EDI)

the computer to computer exchange of business transaction documents

21

EDI -Reduced handling costs and increased processing speed

reduces transaction handling costs and speeds transaction processing

22

EDI- Standard data format

Standard data format
a. Mapping - process of determining the correspondence between data elements in an organization’s terminology and data elements in standard EDU terminology.
b. Standards - several different standards
- XML - extensible markup language - technology that has been developed to transmit data in flexible formats instead of the standard formats of EDI.

23

EDI - Communication

EDI can be implemented using direct links between the organizations exchanging information via communication intermediaries, VANs or networks of VANs, or over the Internet.

24

Features of EDI

- allows the transmission of electronic documents between compeer systems in different organizations
- reduces handling costs and speeds transaction processing compared to traditional paper based processing.
- requires that all transactions be submitted in a standard data format
- can be implemented using direct links between the trading partners, communication intermediaries, VANs or networks of VANs, or over the Internet.

25

Costs of EDI

5. Costs of EDI
a. Legal costs
b. Hardware costs
c. Costs of translation software
d. Costs of data transmission
e. Costs associated with security, monitoring and control procedures

26

EDI controls

Audit trails should include:
- activity logs of failed transactions
- network and sender/recipient acknowledgements

27

EDI Risks

unauthorized access to the organization’s system is the greatest risk

28

Comparison of EDI and E-Commerce

Which has higher?
Cost - EDI
Security - EDI
Speed - E-Commerce
Network - EDI - VAN (private), E-Commerce - Internet (public)

29

Business process reengineering

the analysis and redesign of business processes and information systems to achieve significant performance improvements.

30

Challenges faced in business process reengineering

1. Tradition - old ways of doing things do not die easily
2. Resistance - people don’t like changes
3. Time and cost requirements - takes 2 + years to complete
4. Lack of management support
5. Skepticism
6. Retraining
7. Controls