4/15/2025
Introduction
• The use of IS is widespread in many industries and organizations, and
Sixteenth Edition
these systems often contain sensitive and valuable information that needs
to be protected.
• With the increasing use of digital technology and the internet, more and
Chapter 8 more sensitive information is being stored and transmitted electronically,
Securing Information making it an attractive target for attackers.
Systems • Outsiders may infiltrate a company IS and make a lot of damage by
stealing or destroying sensitive data related to intellectual property, trade
secrets, confidential customer information, confidential payment data, etc.
Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved
Introduction Why IS are Vulnerable ?
• Cyber attacks are more common and more sophisticated (1 million attack
• Accessibility of networks: As information systems in different locations
per day over the world; 78% of companies in US were attacked in 2018).
are interconnected, the potential for unauthorized access, abuse, or fraud
71% of attacks were financially motivated and 25% were motivated by
is not limited to a single location but can occur at any access point in the
espionage. The list of cyber attacks victims include Uber, yahoo, facebook,
network. Threats to IS can have technical, organizational or environmental
equifax..
origins
• The costs of cybercrime to the global economy is estimated to $600 billion
• Hardware problems (breakdowns, improper use, configuration errors…)
each year. The cost of a cyber attack ranges from 200 thousand dollar to
1.3 million for SME and can reach up to $ 27 million for large US firms. • Software problems (programming errors, installation errors, unauthorized
changes)
• Without proper security, IS are vulnerable to various threats that can result
in financial losses, legal liabilities, reputational damage, and other • Use of networks/computers outside of firm’s control or loss and theft of
negative consequences for the business. portable devices
Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved
1
4/15/2025
Figure 8.1 Contemporary Security Internet Vulnerabilities
Challenges and Vulnerabilities • Internet is open to anyone. Its size means abuses can have a wide impact
• Use of fixed Internet addresses creates fixed targets for attackers
• Public and open wireless networks are much more vulnerable
• Many VOIP are unencrypted or use weak encryption (whatsapp, viber,
messenger, facetime). Skype, teams and zoom use good encryption.
• E-mail, File Sharing Programs, Instant Messages
– Interception
– Attachments with malicious software
– Transmitting trade secrets
Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved
Wireless Networks Vulnerabilities Types of attacks to Wireless Networks
• Wireless networks use radio frequency bands that can be intercepted
• War driving: eavesdroppers drive by buildings equipped with a laptop, an
easily by anyone with the right equipment.
antenna, a GPS receiver and a sniffing program searching for open or
• Service set identifiers (SSIDs) are unique names that identify wireless vulnerable wireless networks. Sniffing programs intercept network traffic to
access points on a network. extract sensitive information such as usernames, passwords, etc.
• These SSIDs are broadcast multiple times by access points in order to help • Rogue access points: A rogue access point is a wireless access point
clients locate and connect to the network. that has been installed on a network without the knowledge or permission
• It is recommended to disable SSID broadcasting on your wireless network of the network administrator. Rogue access points are often set up in public
which makes it less visible to potential attackers, as devices must manually places and are designed to look like legitimate access points. Once users
search for and connect to the network. connect to it, the attacker can intercept their traffic.
Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved
2
4/15/2025
Types of Malware Types of Malware
• Worms: a self-replicating malware that can spread across a network • Ransomware: a malware designed to encrypt a user's files, and then
without any user action. Worms typically exploit security vulnerabilities in demand payment (usually in cryptocurrency) in exchange for the
operating systems or software to gain access to a network, and then use decryption key.
that access to spread to other systems.
• Trojan horse: a malware that disguises itself as a legitimate program or
• Viruses: a malware that infects a computer by inserting its code into file. Once installed, it can open a backdoor for attackers to gain
legitimate programs or files. Once a user opens the infected program or unauthorized access to a computer or network.
file, the virus can then modify, delete, or steal data, or even take control of
• SQL injection attacks: hackers inject an SQL code to access databases
the infected computer. Viruses cannot run independently, require a host
that support web applications, such as sales, e-commerce financial data,
program.
and other classified information.
• Spyware: malware that install themselves secretly on computers to
• These are just a few examples of the many types of malware that exist.
monitor user internet browsing history, emails, chat logs, keystrokes, etc.
Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved
Computer Crimes Computer Crimes
• Social engineering: tricking people into divulging sensitive information or
• Denial-of-service attacks (DoS): a cyber attack that aims to disrupt the
providing access to systems using psychological manipulation. This can be
normal functioning of a website, server, or network by overwhelming it
done through tactics like phishing.
with traffic to prevent legitimate users from accessing or using the
targeted system. • Phishing: sending fraudulent emails that appear to be from a trusted
source, such as a bank or an employer. The messages often contain links
• Botnet: a network of computers that have been infected with a malware
or attachments that, when clicked, install malware or direct the user to a
which allows them to be controlled remotely by the botmaster. The
fake website where they are asked to enter confidential information.
botmaster can then use the collective computing power of the botnet to
carry out attacks • Pharming: redirecting users from a legitimate website to a fake one
without the user's knowledge or consent
Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved
3
4/15/2025
Computer Crimes Internal Threats
• Click fraud: a type of online advertising fraud that involves generating • Internal threats refer to the risks posed by employees or other individuals
illegitimate clicks on ads with the purpose of artificially inflating the number who have legitimate access to the organization's IS and who may
of clicks on an ad. compromise its security intentionally or unintentionally.
• Cyberterrorism: a type of attack that is carried out with the intention of • Users lack of knowledge or lack of security awareness which can result in
causing harm to individuals or governments for political or ideological actions like using weak passwords, sharing login credentials, or failing to
reasons. update software and systems.
• Cyberwarfare: cyberattacks by one nation or group against another nation • Human errors and mistakes like misconfiguring systems, accidentally
or group with the intention of causing damage, disruption, or destruction of deleting important data, or falling victim to a phishing attack.
military systems or critical infrastructure such as power grids, transportation • Both end users and information systems specialists are sources of risk
systems, and communication networks.
Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved
Software Vulnerability Software Vulnerability
• Software vulnerability is a weakness or flaw in software code or design. • To protect against zero-day vulnerabilities, organizations can take several
These vulnerabilities can exist in any type of software, including operating measures, including:
systems, web browsers, mobile apps, and enterprise applications.
• Conducting regular vulnerability assessments and penetration testing to
• Bugs, or program code defects, are errors in software code that can be identify and remediate vulnerabilities before they can be exploited.
exploited by attackers to gain unauthorized access to a system or network.
• Keeping software up to date with the latest security patches and updates,
• Zero defects cannot be achieved in software development as many vendors release patches for zero-day vulnerabilities as soon as
• Zero-day vulnerabilities are vulnerabilities in software that are unknown to they become aware of them.
the vendor, and for which there is no patch. They can be discovered by
attackers, security researchers, or other third parties. Once discovered, the
vulnerability can be sold on the dark web or to government agencies for a
high price, or it can be used for malicious purposes.
Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved
4
4/15/2025
Information Systems Security Technical Controls
• Effective IS security requires a combination of technical, administrative, • Firewall: Combination of hardware and software that prevents
and physical controls. unauthorized users from accessing private networks. The firewall acts like
1. Technical controls provide the first line of defense against security a gatekeeper that examines user’s credentials before granting access to a
threats. Technical controls include firewalls, intrusion detection systems, network.
encryption, antivirus, access controls, and network segmentation.
2. Administrative controls include access control policies, password
policies, incident response plans, risk assessments and IS audit.
3. Physical controls include access controls, security cameras, biometric
authentication, etc.
Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved
Technical Controls
Technical Controls
• Intrusion detection system (IDS): a software that monitors traffic moving
on networks searching for suspicious activity such as unusual account • Encryption: Modern encryption systems use a variety of cryptographic
activity, traffic from an unusual geographic location or outside of normal algorithms and protocols to protect data and communications. Quantum
business hours. The IDS send alerts to system administrators and even computers pose a potential threat to current encryption algorithms, but
shut down sensitive parts of a network if it detects unauthorized traffic. researchers are working on developing new encryption algorithms that
can resist quantum attacks.
• Virtual Private Network (VPN): a technology that provides a secure,
encrypted connection between two networks over the internet. It creates • Network segmentation: dividing a computer network into smaller
an encrypted tunnel between your computer and the VPN server. segments, each with its own unique security policies and access controls.
The goal is to improve security by limiting the impact of security breaches,
• Unified threat management (UTM) systems: a type of security appliance
isolating sensitive data, and reducing the attack surface of the network.
that integrates multiple security features into one single solution (firewall,
IDS, antivirus, web filtering, spam filtering, VPN…).
Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved
5
4/15/2025
Administrative Controls Administrative Controls
• Password policies: establish rules for creating and managing • Incident response plans: provide a framework for responding to security
passwords, such as password length, complexity, and expiration. incidents and specify the roles and responsibilities of different
• Access control policies: rules that define who has access to what IS stakeholders in the response process. They include:
resources, based on their job roles and responsibilities. Disaster recovery plan: plan to restore critical IT infrastructure and data
after a natural disaster, a cyberattack or a power outage. The goal is to
minimize downtime and data loss and get the organization back to normal
Depending on his security activity quickly .
profile, every user would
have certain restrictions on Business continuity planning: a plan to keep core business processes
access to various systems, running during a disruption or disaster, even if IT systems are temporarily
locations, or data in an unavailable. This include developing alternate processes, identifying
organization. critical personnel, and establishing communication protocols.
Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved
Administrative Controls
Table 8.5 Online Order Processing Risk
• Risk assessment: it involves: Assessment
identifying potential security threats
Exposure Probability of Loss Range Expected Annual
Occurrence (Average) ($) Loss ($)
evaluating the probability of occurrence of each threat based on historical
Power failure 30% $5,000 − $200,000 $30,750
data, industry norms, or expert opinion. ($102,500)
Embezzlement 5% $1,000 − $50,000 $1,275
determining the potential losses associated with each threat. This could ($25,500)
include direct costs (such as repair or replacement costs), indirect costs User error 98% $200 − $40,000 $19,698
($20,100)
(such as lost revenue or productivity), and intangible costs (such as
damage to reputation or loss of customer trust).
calculating the expected annual loss for each threat by multiplying the
probability of occurrence by the potential losses.
Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved
6
4/15/2025
Administrative Controls Physical Controls
• Information security audit: a systematic evaluation of firm’s information • Authentication tools
security policies, procedures, and practices to ensure that they meet – Password systems, tokens, smart cards…
established standards and best practices. Auditing provides an objective
– Biometric authentication:systems that read and interpret individual
assessment of the effectiveness of security controls and identifies areas for
human traits, such as fingerprints, irises, and voices to grant or deny
improvement.
access.
– Two-factor authentication increases security by validating users
through two means of identification. Example:Withdrawing money from
an ATM requires a debit card and a PIN
Sample Auditor’s List
of Control Weaknesses
Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved
How to secure wireless networks ?
• Use a VPN to encrypt the traffic between your wireless device and the
internet. This will protect your data from interception and unauthorized
access.
• Change the default login credentials of your router to a strong password
• Use WPA2 or WPA3 encryption to protect your wireless network from
eavesdropping and data theft.
• Turn off the broadcast of the Service Set Identifier (SSID) to prevent your
wireless network from being visible to unauthorized users.
• Segment your network into subnets to isolate sensitive data and limit the
scope of a security breach.
Copyright © 2020, 2018, 2016 Pearson Education, Inc. All Rights Reserved