Upgrade to remove ads
Only $35.99/year

IT360T Final

Terms in this set (175)

LinkedIn
One of the world's largest social networks with more than 225 million users.
Target for hackers as widely used "social" site.
Outdated security processes.
Although LinkedIn's security policies were adequate some years ago, in 2012 they were very inadequate.
Most social network malware attacks are "social engineering" attacks which rely on the gullibility of users.
The cost of ensuring adequate security would be far less than a multimillion dollar lawsuit.
- Problem: Security breach results in exposure of 6.5 million passwords. Reputational damage. Multimillion dollar lawsuit.
- Missing: Chief security officer. Even minimal password protection and encryption. Password salting techniques.
- Illustrates: Lack of liability for companies in social technology services.
- Demonstrates: Need for updating security policies continuously.
Internet vulnerabilities
- Network open to anyone
- Size of Internet means abuses can have wide impact
- Use of fixed Internet addresses with permanent connections to Internet eases identification by hackers
- E-mail attachments, file downloading, and sharing
- E-mail used for transmitting trade secrets
- IM messages lack security, can be easily intercepted
The Internet is so huge that when abuses do occur, they can have an enormously widespread impact. And when the Internet becomes part of the corporate network, the organization's information systems are even more vulnerable to actions from outsiders.
Safeguarding information systems
An unprotected computer connected to Internet may be disabled within seconds. When large amounts of data are stored digitally, on computers and servers and in databases, they are vulnerable to many more kinds of threats than when they were stored in manual form, on paper in folders and file cabinets. When data are available over a network, there are even more vulnerabilities.
Failed computer systems can lead to significant or total loss of business function.
Firms now more vulnerable than ever.
A security breach may cut into firm's market value almost immediately.
Inadequate security and controls also bring forth issues of liability.
Security: Prevent unauthorized access, alteration, theft, or physical damage to information systems
Controls: Ensure safety of organization's assets; accuracy and reliability of its accounting records; and operational adherence to management standards
Threats to information systems
Hardware problems: Breakdowns, configuration errors, damage from improper use or crime.
Software problems: Programming errors, installation errors, unauthorized changes.
Disasters: Power failures, flood, fires, and so on.
Use of networks, computers outside of firm's control: Domestic or offshore outsourcing vendors. Mobile devices.

Client (user): Unauthorized Access. Errors.
Communication lines: Tapping. Sniffing. Message alteration. Theft and fraud. Radiation.
Corporate servers: Hacking. Malware. Theft and fraud. Vandalism. Denial-of-service attacks.
Corporate systems (hardware, operating systems, software, databases): theft of data. Copying of data. Alteration of data. Hardware failure. Software failure.
Wireless security challenges
Local-area networks (LANs) using the 802.11 standard can be easily penetrated by outsiders armed with laptops, wireless cards, external antennae, and hacking software. Hackers use these tools to detect unprotected networks, monitor network traffic, and, in some cases, gain access to the Internet or to corporate networks.
- Radio frequency bands easy to scan
- SSIDs (service set identifiers)
Identify access points.
Broadcast multiple times.
- War driving
Eavesdroppers drive by buildings and try to intercept network traffic
With access to SSID, has access to network's resources
- Rogue access points
WiFi Security Challenges
Networks can be penetrated easily by intruders using sniffer programs to obtain an address to access the resources of a network without authorization. The service set identifiers (SSIDs) identifying the access points in a Wi-Fi network are broadcast multiple times and can be picked up fairly easily by intruders' sniffer programs.
Malicious Software (Malware)
- Viruses
- Worms
- Trojan horses
- SQL injection attacks
- Spyware
- Key loggers
There are now more than 3600 viruses and worms targeting mobile devices. Facebook, Twitter, and LinkedIn are also conduits for malware and spyware.
Viruses
Rogue software program that attaches itself to other software programs or data files in order to be executed
Worms
Independent computer programs that copy themselves from one computer to other computers over a network
Trojan Horses
Software program that appears to be benign but then does something other than expected.
SQL Injection Attacks
Malicious code is entered into the database by one or several users filling out typical online forms with the intent of taking over the database and downloading data to hacker Web sites. Prevented by installing proper security software and properly editing data input from user forms.
Spyware
Small programs install themselves surreptitiously on computers to monitor user Web surfing activity and serve up advertising
Key loggers
Record every keystroke on computer to steal serial numbers, passwords, launch Internet attacks
Computer crime
Any violations of criminal law that involve a knowledge of computer technology for their perpetration, investigation, or prosecution

Computer may be target of crime: Breaching confidentiality of protected computerized data. Accessing a computer system without authority.
Computer may be instrument of crime: Theft of trade secrets. Using e-mail for threats or harassment.

Most economically damaging types: Denial of service, introducing viruses, theft of services, disruption of computer systems.

Ponemon Institute's 2012 Annual Cost of Cyber Crime Study: the median annualized cost of cybercrime for the organizations in the study was $8.9 million per year.

Computer Fraud and Abuse Act (1986): illegal to access a computer system without authorization.

National Information Infrastructure Protection Act (1996): virus distribution and hacker attacks to disable Web sites federal crimes.

Cybercriminal activities are borderless: the global nature of the Internet makes it possible for cybercriminals to operate anywhere in the world.

- System intrusion
- Theft of goods and services
- System damage
- Cybervandalism
- Spoofing
- Sniffer
- Denial-of-service attacks (DoS)
- Distributed denial-of-service attacks (DDoS)
- Identity theft
- Phishing
- Evil twins
- Pharming
- Click fraud
- Global threats
Cybervandalism
Intentional disruption, defacement, destruction of Web site or corporate information system
Recommended textbook explanations

Advanced Engineering Mathematics

10th EditionErwin Kreyszig
4,134 explanations

Complex Analysis: A First Course with Applications

3rd EditionDennis G. Zill, Patrick D. Shanahan
1,433 explanations

Numerical Analysis

9th EditionJ. Douglas Faires, Richard L. Burden
873 explanations

Elementary Number Theory

7th EditionDavid Burton
776 explanations