Ethics in Information

Technology, Fourth Edition

Chapter 3
Computer and Internet Crime
 Objectives

• As you read this chapter, consider the following

questions:
– What key trade-offs and ethical issues are
associated with the safeguarding of data and
information systems?
– Why has there been a dramatic increase in the
number of computer-related security incidents in
recent years?
– What are the most common types of computer
security attacks?

2
 Objectives (cont’d.)
– Who are the primary perpetrators of computer crime,
and what are their objectives?
– What are the key elements of a multilayer process
for managing security vulnerabilities based on the
concept of reasonable assurance?
– What actions must be taken in response to a security
incident?
– What is computer forensics, and what role does it
play in responding to a computer incident?

3
IT Security Incidents: A Major Concern
‫ مصدر قلق كبير‬:‫حوادث أمن تكنولوجيا المعلومات‬
• Security of information technology is of utmost
importance‫أمن تكنولوجيا المعلومات له أهمية قصوى ولذلك يجب‬
– Safeguard ‫ حماية‬:
• Confidential business data‫بيانات األعمال السرية‬
• Private customer and employee data ‫بيانات العمالء والموظفين من‬
‫القطاع الخاص‬
– Protect against malicious acts of theft or disruption ‫الحماية من أعمال‬
‫السرقة أو التعطيل الخبيثة‬
– Balance against other business needs and issues ‫التوازن مع‬
‫احتياجات وقضايا العمل األخرى‬
• Number of IT-related security incidents is increasing
around the world ‫يتزايد عدد الحوادث األمنية المتعلقة بتكنولوجيا‬
‫المعلومات في جميع أنحاء العالم‬
4
 Why Computer Incidents Are So
Prevalent ‫منتشر‬
• Increasing complexity increases vulnerability‫زيادة التعقيد تزيد من الضعف‬
– Computing environment is enormously complex‫بيئة الحوسبة معقدة للغاية‬
• Continues to increase in complexity
• Number of entry points expands continuously ‫عدد نقاط الدخول يتوسع‬
‫باستمرار‬
• Cloud computing and virtualization software
• Higher computer user expectations‫توقعات أعلى لمستخدمي الكمبيوتر‬
– Computer help desks under intense pressure ‫مكاتب مساعدة الكمبيوتر تحت‬
‫ضغط شديد‬
• Forget to verify users’ IDs or check authorizations ‫نسيت التحقق من‬
‫هويات المستخدمين أو التحقق من التصاريح‬
• Computer users share login IDs and passwords ‫يتشارك مستخدمو‬
‫الكمبيوتر معرفات تسجيل الدخول وكلمات المرور‬

5
 Why Computer Incidents Are So
Prevalent (cont’d.)
• Expanding/changing systems equal new risks
– Network era
• Personal computers connect to networks with
millions of other computers
• All capable of sharing information
– Information technology
• Ubiquitous ‫موجودة في كل مكان‬
• Necessary tool for organizations to achieve goals
• Increasingly difficult to match pace of
technological change ‫أصبح من الصعب بشكل متزايد مواكبة‬
‫سرعة التغير التكنولوجي‬
6
 Why Computer Incidents Are So
Prevalent (cont’d.)
• Increased reliance on commercial software with
known vulnerabilities
– Exploit
• Attack on information system
• Takes advantage of system vulnerability
• Due to poor system design or implementation
– Patch
• “Fix” to eliminate the problem
• Users are responsible for obtaining and installing
• Delays expose users to security breaches
7
 Why Computer Incidents Are So
Prevalent (cont’d.)
• Zero-day attack
– Before a vulnerability is discovered or fixed
• U.S. companies rely on commercial software with
known vulnerabilities

8
 Types of Exploits‫أنواع االستغالالت‬

• Computers as well as smartphones can be target

• Types of attacks
– Virus
– Worm
– Trojan horse
– Distributed denial of service
– Rootkit
– Spam
– Phishing (spear-phishing, smishing, and vishing)

9
 Viruses
• Pieces of programming code
• Usually disguised as something else
• Cause unexpected and undesirable behavior
• Often attached to files
• Deliver a “payload” ‫تُح ّمل معظم الفيروسات "حمولة" أو برنام ًجا خبيث ًا‬
‫ قد يُبرمج‬،‫ على سبيل المثال‬.‫يُسبب سلو ًكا غير متوقع في جهاز الحاسوب‬
‫ أو حذف أو تعديل مستند‬،‫الفيروس لعرض رسالة معينة على شاشة الحاسوب‬
.‫معين‬
• Spread by actions of the “infected” computer user
• Infected e-mail document attachments
• Downloads of infected programs
• Visits to infected Web sites 10
 Worms

• Harmful programs
– Reside in active memory of a computer
– Duplicate themselves
• Can propagate without human intervention
• Negative impact of worm attack
– Lost data and programs
– Lost productivity
– Additional effort for IT workers

11
 Trojan Horses

• Malicious code hidden inside seemingly harmless

programs
• Users are tricked into installing them
• Delivered via email attachment, downloaded from a
Web site, or contracted via a removable media
device
• Logic bomb
– Executes when triggered by certain event

12
 Distributed Denial-of-Service (DDoS)
Attacks
• Malicious hacker takes over computers on the
Internet and causes them to flood a target site with
demands for data and other small tasks
– The computers that are taken over are called
zombies
– Botnet is a very large group of such computers
• Does not involve a break-in at the target computer
– Target machine is busy responding to a stream of
automated requests
– Legitimate users cannot access target machine

13
 Rootkits

• Set of programs that enables its user to gain

administrator-level access to a computer without
the end user’s consent or knowledge
• Attacker can gain full control of the system and
even obscure the presence(‫ )إخفاء وجوده‬of the rootkit
• Fundamental problem in detecting a rootkit is that
the operating system currently running cannot be
trusted to provide valid test results

14
 Spam

• Abuse of email systems to send unsolicited ‫غير‬

‫ مرغوب فيه‬email to large numbers of people
– Low-cost commercial advertising for questionable
products
– Method of marketing also used by many legitimate
organizations
• Controlling the Assault of Non-Solicited
Pornography and Marketing (CAN-SPAM) Act
– Legal to spam if basic requirements are met

15
 Spam (cont’d.)

• Completely Automated Public Turing Test to Tell

Computers and Humans Apart (CAPTCHA)
– Software generates tests that humans can pass but
computer programs cannot

16
 Phishing

• Act of using email fraudulently ‫احتياليا‬to try to get the

recipient to reveal personal data
• Legitimate-looking emails lead users to counterfeit
‫تزوير‬Web sites
• Spear-phishing‫التصيد الموجه‬
– Fraudulent emails to an organization’s employees
• Smishing
– Phishing via text messages
• Vishing
– Phishing via voice mail messages
17
Ethics in Information Technology, Fourth Edition 18
 Types of Perpetrators‫انواع الجناة‬

• Perpetrators include:
– Thrill seekers wanting a challenge‫الباحثون عن اإلثارة يريدون التحدي‬
– Common criminals looking for financial gain
– Industrial spies‫ جواسيس صناعيون‬trying to gain an advantage
– Terrorists seeking to cause destruction
• Different objectives and access to varying resources
‫وإمكانية الوصول لموارد متفاوتة‬
• Willing to take different levels of risk to accomplish an
objective

19
Types of Perpetrators (cont’d.)

20
 Hackers and Crackers

• Hackers
– Test limitations of systems out of intellectual
curiosity‫اختبار حدود األنظمة بدافع الفضول الفكري‬
• Some smart and talented
• Others inept‫ ;احمق‬termed “lamers” or “script
kiddies”
• Crackers
– Cracking is a form of hacking
– Clearly criminal activity

21
 Malicious Insiders
• Major security concern for companies
• Fraud‫ احتيال‬within an organization is usually due to
weaknesses in internal control procedures ‫ضعف في‬
‫إجراءات الرقابة الداخلية‬
• Collusion‫التواطؤ‬
– Cooperation between an employee and an outsider
• Insiders are not necessarily employees
– Can also be consultants and contractors‫االستشاريين والمقاولين‬
• Extremely difficult to detect or stop
– Authorized to access the very systems they abuse ‫صرح لهم‬
َّ ‫ُم‬
‫بالوصول إلى األنظمة التي يسيئون استخدامها‬
• Negligent insiders have potential to cause damage ‫إن‬
22
‫المطلعين المهملين لديهم القدرة على التسبب في الضرر‬
 Industrial Spies‫الجواسيس الصناعيون‬

• Use illegal means to obtain trade secrets from

competitors
• Trade secrets are protected by the Economic
Espionage Act of 1996
• Competitive intelligence‫االستخبارات التنافسية‬
– Uses legal techniques
– Gathers information available to the public
• Industrial espionage‫التجسس الصناعي‬
– Uses illegal means
– Obtains information not available to the public
23
 Cybercriminals‫مجرمو االنترنت‬

• Hack into corporate computers to steal

• Engage in all forms of computer fraud
• Loss of customer trust has more impact than
fraud‫فقدان ثقة العمالء له تأثير أكبر من االحتيال‬
• To reduce potential for online credit card fraud:
– Use encryption technology
– Verify the address submitted online against the
issuing bank
– Request a card verification value (CVV)
– Use transaction-risk scoring software ‫برنامج تقييم مخاطر‬
‫المعامالت‬
24
 Cybercriminals (cont’d.)

• Smart cards
– Contain a memory chip
– Updated with encrypted data each time card is used
– Used widely in Europe
– Not widely used in the U.S.

25
 Hacktivists and Cyberterrorists

• Hacktivism(hacking and activism)

– Hacking to achieve a political or social goal
• Cyberterrorist
– Attacks computers or networks in an attempt to
intimidate or coerce a government in order to
advance certain political or social objectives ‫مهاجمة‬
‫أجهزة الكمبيوتر أو الشبكات في محاولة لترهيب أو إكراه الحكومة من أجل‬
‫تحقيق أهداف سياسية أو اجتماعية معينة‬
– Seeks to cause harm rather than gather information
– Uses techniques that destroy or disrupt services

26
Federal Laws for Prosecuting
Computer Attacks

27
 Implementing Trustworthy ‫تنفيذ أعمال‬
‫جديرة بالثقة‬
• Trustworthy computing‫الحوسبة الجديرة بالثقة‬
– Delivers secure, private, and reliable computing
(1- security, 2- confidentiality, 3- integrity, 4-
availability )
– Based on sound business practices ‫مبنية على ممارسات‬
،‫أعمال سليمة‬

28
 Implementing Trustworthy Computing
(cont’d.)
• Security of any system or network
– Combination of technology, policy, and people
– Requires a wide range of activities to be
effective .ً‫ويتطلب مجموعة واسعة من األنشطة ليكون فعاال‬
• Systems must be monitored to detect possible
intrusion‫يجب مراقبة األنظمة للكشف عن أي اختراق محتمل‬
• Clear reaction plan addresses ‫خطة رد فعل واضحة تتناول‬
‫في حال تم االختراق‬:
– Notification, evidence protection, activity log
maintenance, containment ‫االحتواء‬,
eradication ‫االستئصال‬, and recovery
29
 Risk Assessment‫تقييم المخاطر‬

• Process of assessing security-related risks:

– To an organization’s computers and networks
– From both internal and external threats
• Identifies investments that best protect from most
likely and serious threats ‫يحدد االستثمارات التي توفر أفضل‬
‫حماية من التهديدات األكثر احتمالية وخطورة‬
• Focuses security efforts on areas of highest ‫يركز‬
‫جهود األمن على المجاالت ذات العائد األعلى‬payoff

30
 ‫)‪Risk Assessment (cont’d.‬‬
‫‪• Eight-step risk assessment process‬‬
‫تحديد األصول األكثر إثارة للقلق‪– #1 Identify assets of most concern‬‬
‫تحديد أحداث الخسارة التي يمكن أن تحدث ‪– #2 Identify loss events that could occur‬‬
‫مثل االحتيال الداخلي‬
‫تقييم احتمالية كل تهديد محتمل مثال ‪– #3 Assess likelihood of each potential threat‬‬
‫االحتيال الداخلي مرجح للحدوث اكثر من غيره‬
‫تحديد تأثير كل تهديد‪– #4 Determine the impact of each threat‬‬
‫تحديد كيفية التخفيف من حدة ‪– #5 Determine how each threat could be mitigated‬‬
‫كل تهديدبحيث يقل احتمال حدوثه‪ ،‬أو في حال حدوثه‪ ،‬يقل تأثيره على المؤسسة‪.‬‬
‫تقييم جدوى خيارات التخفيف(مدى ‪– #6 Assess feasibility of mitigation options‬‬
‫تأثيرها)‬
‫إجراء تحليل التكلفة والفائدة‪– #7 Perform cost-benefit analysis‬‬
‫تحديد التدابير المضادة التي ‪– #8 Decide which countermeasures to implement‬‬
‫سيتم تنفيذها‬

‫‪31‬‬
Risk Assessment (cont’d.)

32
Risk Assessment (cont’d.)

33
 Establishing a Security Policy

• A security policy defines:

– Organization’s security requirements
– Controls and sanctions ‫عقوبات‬needed to meet the
requirements
• Delineates ‫ يحدد‬responsibilities and expected
behavior
• Outlines what needs to be done
– Not how to do it
• Automated system policies should mirror written
policies‫يجب أن تعكس سياسات النظام اآللي السياسات المكتوبة‬
34
Establishing a Security Policy (cont’d.)

• Trade-off between:
– Ease of use
– Increased security
• Areas of concern
– Email attachments
– Wireless devices
• VPN uses the Internet to relay communications but
maintains privacy through security features
• Additional security includes encrypting originating
and receiving network addresses
35
 Educating Employees,
Contractors‫المقاولون‬, and Part-Time
Workers
• Educate and motivate users to understand and
follow policy
• Discuss recent security incidents
• Help protect information systems by:
– Guarding passwords‫حماية كلمات المرور‬
– Not allowing sharing of passwords
– Applying strict access controls to protect data
– Reporting all unusual activity
– Protecting portable computing and data storage
devices
36
 Prevention‫منع‬
• Implement a layered security solution ‫تنفيذ حل أمني متعدد‬
‫الطبقات‬
– Make computer break-ins harder‫جعل عمليات اقتحام الكمبيوتر أكثر صعوبة‬
• Installing a corporate firewall
– Limits network access
• Intrusion prevention systems
– Block viruses, malformed packets, and other threats
• Installing antivirus software
– Scans for sequence of bytes or virus signature
– United States Computer Emergency Readiness Team (US-
CERT) serves as clearinghouse

37
Prevention (cont’d.)

38
Prevention (cont’d.)

39
 Prevention (cont’d.)

• Safeguards against attacks by malicious insiders

• Departing employees and contractors
– Promptly delete computer accounts, login IDs, and
passwords
• Carefully define employee roles and separate key
responsibilities
• Create roles and user accounts to limit authority

40
 Prevention (cont’d.)

• Defending against cyberterrorism

– Department of Homeland Security and its National
Cyber Security Division (NCSD) is a resource ‫وزارة‬
( ‫األمن الداخلي وقسم األمن السيبراني الوطني التابع لها‬NCSD)
• Builds and maintains a national security
cyberspace response system ‫بناء وصيانة نظام االستجابة‬
‫للفضاء اإللكتروني لألمن الوطني‬
• Implements a cyber-risk management program
for protection of critical infrastructure, including
banking and finance, water, government
operations, and emergency services ‫تنفيذ برنامج إدارة‬
‫ بما في ذلك الخدمات‬،‫المخاطر السيبرانية لحماية البنية التحتية الحيوية‬
‫ المصرفية والمالية والمياه والعمليات الحكومية وخدمات الطوارئ‬41
 Prevention (cont’d.)

• Conduct periodic IT security audits ‫إجراء عمليات تدقيق‬

‫دورية ألمن تكنولوجيا المعلومات‬
– Evaluate policies and whether they are followed
– Review access and levels of authority ‫مراجعة الوصول‬
‫ومستويات السلطة‬
– Test system safeguards‫اختبار إجراءات حماية النظام‬
– Information Protection Assessment kit is available
from the Computer Security Institute ‫تتوفر مجموعة تقييم‬
‫حماية المعلومات من معهد أمن الكمبيوتر‬

42
 Detection
• Detection systems
– Catch intruders in the act
• Intrusion detection system
– Monitors system/network resources and activities ‫مراقبة موارد‬
‫الشبكة‬/‫وأنشطة النظام‬
– Notifies the proper authority when it identifies: ‫يخطر الجهة المختصة‬
‫عند تحديده‬
• Possible intrusions from outside the organization ‫االختراقات‬
‫المحتملة من خارج المنظمة‬
• Misuse from within the organization‫سوء االستخدام من داخل المنظمة‬
– Knowledge-based approach
– Behavior-based approach

43
 Response

• Response plan
– Develop well in advance of any incident ‫قم بالتطوير جيدًا‬
‫قبل أي حادث‬
– Approved by:
• Legal department‫القسم القانوني‬
• Senior management‫االدارة العليا في المؤسسة‬
• Primary goals
– Regain control and limit damage ‫استعادة السيطرة والحد من‬
‫االضرار‬
– Not to monitor or catch an intruder
• Only 56% have response plan
44
 Response (cont’d.)

• Incident notification defines:

– Who to notify
– Who not to notify
• Security experts recommend against releasing
specific information about a security compromise in
public forums ‫يوصي معظم خبراء األمن بعدم نشر معلومات محددة‬
‫حول أي اختراق في المنتديات العامة‬
• Document all details of a security incident
– All system events
– Specific actions taken
– All external conversations
45
 Response (cont’d.)

• Act quickly to contain an attack

• Eradication effort‫جهود االستئصال‬
– Collect and log all possible criminal evidence ‫جمع‬
‫وتسجيل جميع األدلة الجنائية المحتملة‬
– Verify necessary backups are current and complete
– Create new backups
• Follow-up‫متابعة الحادث‬
– Determine how security was compromised
• Prevent it from happening again

46
 Response (cont’d.)

• Review‫مراجعة‬
– Determine exactly what happened
– Evaluate how the organization responded
• Weigh carefully the amount of effort required to
capture the perpetrator ‫قم بوزن مقدار الجهد المطلوب للقبض‬
‫على الجاني بعناية‬
• Consider the potential for negative publicity ‫خذ بعين‬
‫االعتبار إمكانية الدعاية السلبية‬
• Legal precedent‫سابقة قانونية‬
– Hold organizations accountable for their own IT
security weaknesses ‫تحميل المؤسسات مسؤولية نقاط الضعف في‬
47
‫أمن تكنولوجيا المعلومات الخاصة بها‬
 Computer Forensics‫الطب الشرعي للحاسوب‬

• Combines elements of law and computer science

to identify, collect, examine, and preserve data and
preserve its integrity so it is admissible as
evidence ‫يجمع بين عناصر القانون وعلوم الكمبيوتر لتحديد البيانات‬
‫وجمعها وفحصها وحفظها والحفاظ على سالمتها حتى تصبح مقبولة‬
‫كدليل‬
• Computer forensics investigation requires
extensive training and certification and knowledge
of laws that apply to gathering of criminal
evidence ‫يتطلب التحقيق في الطب الشرعي للكمبيوتر تدريبًا مكثفًا‬
‫وشهادة ومعرفة بالقوانين التي تنطبق على جمع األدلة الجنائية‬
48
 Summary

• Ethical decisions in determining which information

systems and data most need protection
• Most common computer exploits
– Viruses
– Worms
– Trojan horses
– Distributed denial-of-service attacks
– Rootkits
– Spam
– Phishing, spear-fishing, smishing, vishing
49
 Summary (cont’d.)

• Perpetrators include:
– Hackers
– Crackers
– Malicious insider
– Industrial spies
– Cybercriminals
– Hacktivist
– Cyberterrorists

50
 Summary (cont’d.)

• Must implement multilayer process for managing

security vulnerabilities, including:
– Assessment of threats
– Identifying actions to address vulnerabilities
– User education
• IT must lead the effort to implement:
– Security policies and procedures
– Hardware and software to prevent security breaches
• Computer forensics is key to fighting computer
crime in a court of law
51