Q1: What Is the Goal of Information Systems Security?
A threat is a person or organization that seeks to obtain or alter data or other IS assets illegally, without the owner's permission and often without the owner's knowledge. A vulnerability is an opportunity for threats to gain access to individual or organizational assets. A safeguard is some measure that individuals or organizations take to block the threat from obtaining the asset. Finally, the target is the asset that's desired by the threat. Sources of threats are human error, computer crime, and natural events and disasters. Types of security loss are unauthorized data disclosure, incorrect data modification, faulty service, denial of service, and loss of infrastructure.
Q2: How Big Is the Computer Security Problem?
The full extent of the financial and data losses due to computer security threats is unknown. The losses due to human error are enormous but few organizations compute these losses and even fewer publish them. Losses due to natural disasters are also enormous and impossible to compute. Furthermore, no one knows the cost of computer crime. Second, all studies on the cost of computer crime are based on surveys. Different respondents interpret terms differently, some organizations don't report all their losses, and some won't report computer crime losses at all.
Q3: How Should You Respond to Security Threats?
An intrusion detection system (IDS) is a computer program that senses when another computer is attempting to scan the disk or otherwise access a computer. Don't use any word as part of your password. Use passwords with a mixture of upper and lower case letters and numbers and special characters. Such nonword passwords are still vulnerable to brute force attack in which the password cracker tries every possible combination of characters. Use different passwords for different sites, never send passwords, credit card data, or any other valuable data in email or IM, buy only from reputable vendors, and remove high-value assets from your computers. Cookies are small files that your browser stores on your computer when you visit Web sites.
Q4: How Should Organizations Respond to Security Threats?
Senior management needs to address two critical security functions: security policy and risk management. Senior management must establish a company wide security policy that states the organization's posture regarding data that it gathers about its customers, suppliers, partners, and employees. Senior management must also proactively balance the trade-off between risk and cost.
Q5: How Can Technical Safeguards Protect Against Security Threats?
Technical safeguards involve the hardware and software components of an information system. Every information system today should require users to sign on with a user name and password. The user name identifies the user (the process of identification), and the password authenticates that user (the process of authentication). Passwords have important weaknesses. Because of these problems, some organizations choose to use smart cards and biometric authentication in addition to passwords.
Q6: How Can Data Safeguards Protect Against Security Threats?
Data safeguards protect databases and other organizational data. Data administration refers to an organization-wide function that is in charge of developing data policies and enforcing data standards. Database administration refers to a function that pertains to a particular database. ERP, CRM, and MRP databases each have a database administration function. Data administration should define data policies. Then data administration and database administrations work together to specify user data rights and responsibilities. Third, those rights should be enforced by user accounts that are authenticated at least by passwords.
Q7: How Can Human Safeguards Protect Against Security Threats?
Human safeguards involve the people and procedure components of information systems. In general, human safeguards result when authorized users follow appropriate procedures for system use and recovery. Security considerations for employees are positive definitions, hiring and screening, dissemination and enforcement, and termination. The administration of user accounts, passwords, and help-desk policies and procedures are account management, password management, and help-desk policies.
Q8: How Should Organizations Respond to Security Incidents?
Every organization should have an incident-response plan as part of the security programs. No organization should wait until some asset has been lost or compromised before deciding what to do. The plan should include how employees are to respond to security problems, whom they should further contact, the reports they should make, and steps they can take to reduce further loss. The plan should provide centralized reporting of all security incidents. Such reporting will enable an organization to determine if it is under systematic attack or whether an incident is isolated.
No comments:
Post a Comment