10 Pages-Single-Spaced-Class Journal of off powerpoint

hoomanpb

IS531_Lecture-12.ppt

Home >Information Systems homework help >10 Pages-Single-Spaced-Class Journal of off powerpoint

http://www.csun.edu/~dn58412/IS531

Lecture 12

Information Security and Confidentiality

(Chapter 12)

Privacy, confidentiality, information privacy, and information security and the relationships among them.

How information system security affects privacy, confidentiality, and security.

The significance of security for information integrity

Potential threats to system security and information.

Security measures to protect information

IS 531 : Lecture 12

Learning Objectives

IS 531 : Lecture 12

Security Concern

Information security and confidentiality of personal information represent major concerns in today’s society amidst growing reports of stolen and compromised information.
Globalization and increased use of internet
Evolving technology and intrusion techniques
Information must be protected through a combination of electronic and manual methods

IS 531 : Lecture 12

Information Security

The protection of information against threats to its integrity, inadvertent disclosure, or availability determines the survivability of a system

IS 531 : Lecture 12

Privacy

Freedom from intrusion, or control over the exposure of self or of personal information
The right to determine what information is collected, how it is used, and the ability to review collected information for accuracy and security

IS 531 : Lecture 12

Confidentiality

The protection of healthcare information is mandated by the Health Insurance Portability and Accountability Act (HIPAA) and the Joint Commission requirements.
Must not disclose patient-related information without consent
Share info only with the parties requiring it for client treatment
Mostly due to careless communication in a public area or with appropriate person

IS 531 : Lecture 12

Information/Data Privacy

The storage and disclosure/dissemination of personally identifiable information
The right to choose the conditions and extent to which information and beliefs are shared
The right to ensure accuracy of information collected

IS 531 : Lecture 12

Consent

The process by which an individual authorizes healthcare personnel to process his or her information based on an informed understanding of how this information will be used
Entails making the individual aware of risks to privacy and measures to protect it

IS 531 : Lecture 12

Information System Security

Ongoing protection of both information stored in the system and the system itself from threats or disruption
Primary goals :
Protection of client confidentiality
Protection of information integrity
Timely availability of information when needed

IS 531 : Lecture 12

Security Planning

Safeguard against:
Downtime
Breeches in confidentiality
Loss of consumer confidence
Cybercrime
Liability
Lost productivity
Ensure compliance with HIPAA

IS 531 : Lecture 12

Steps to Security

Assessment of risks and assets
An organizational plan
A “culture” of security
The establishment and enforcement of policies

IS 531 : Lecture 12

Threats to System Security
and Information

Human threats
Thieves
Hackers and crackers
Denial of service attacks
Terrorists
Viruses, worms
Revenge attacks
Pirated Web sites

IS 531 : Lecture 12

Threats to System Security
and Information …

On-site threats
Poor password management
Compromised device
Human error
Unauthorized insider access
Flooding site
Power fluctuations
Fires and natural disasters

IS 531 : Lecture 12

Security Measures

Firewalls—barrier created from software and hardware
Antivirus and spyware detection
User sign-on and passwords or other means of identity management
Access on a need-to-know basis
Automatic sign-off
Physical restrictions to system access

IS 531 : Lecture 12

Authentication

Process of determining whether someone is who he or she claims to be
Methods:
access codes,
logon passwords,
digital certificates,
public or private keys used for encryption
biometric measures

IS 531 : Lecture 12

Password

String of alphanumeric characters to type in for system access
Inexpensive but not the most effective means of authentication
Do:
Choose 8-12 character passwords
Avoid obvious passwords
Using the first characters of your favorites verses / sayings.
Including special characters, lower and upper cases, numbers .

IS 531 : Lecture 12

Password …

Don’t:
Post or write down passwords.
Leave computers or applications running when not in use.
Re-use the same password for different systems.
Use the browser “save password” feature.
Never share passwords.
Change password frequently

IS 531 : Lecture 12

Biometrics

Identification based on a unique biological trait
fingerprint
voice
iris pattern / retinal scan
hand geometry / palmprint
face recognition
etc…

IS 531 : Lecture 12

Antivirus Software

Computer programs that can locate and eradicate viruses and other malicious programs from memory sticks, storage devices, individual computers, and networks
Detect and eliminate malwares / spywares that install themselves without the user’s permission to collect passwords, PIN numbers, account numbers then send them to another party

IS 531 : Lecture 12

Antivirus Software

IS 531 : Lecture 12

Source : http://anti-virus-software-review.toptenreviews.com/

IS 531 : Lecture 12

Proper Handling and Disposal

Acceptable uses
Audit trails to monitor access
Encourage review for accuracy
Establish controls for information use after-hours and off-site
Shred or use locked receptacles for the disposal of items containing personal health information

IS 531 : Lecture 12

Implications for Mobile Computing

Shared responsibility for information and information system security
Devices are easily stolen.
Devices should require authentication and encryption to safeguard information security.
Devices should never be left where information may be seen by unauthorized viewers.
Verify wireless networks before use.

IS 531 : Lecture 12

Firewall

IS 531 : Lecture 12

Physical vs. Logical
Access / Controls

IS 531 : Lecture 12

Encryption

IS 531 : Lecture 12

I S 5 3 1

01001001 01010011 00110101 00110011 00110001

10010101 00110011 01010011 00110011 00010100

01101010 11001100 10101100 11001100 11101011

Binary Codes

ASCII (American Standard Code for Information Interchange) : 8 bits

EBCDIC (Extended Binary-Coded Decimal Interchange Code ) : 16 bits

Unicode : 32 bits and more

IS 531 : Lecture 12

Encoding

IS 531 : Lecture 12

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

DROPBOX TONIGHT

F G H I J K L M N O P Q R S T U V W X Y Z A B C D E

IWTUGTC YTSNLMY

Normal sequence :

Encoded sequence :

Message :

Encoded message :

IS 531 : Lecture 12

Public Keys

IS 531 : Lecture 12

References

CMU - Security 101 (2011)

http ://www.cmu.edu/iso/aware/presentation/security101-v2.pdf

CMU - Governing for Enterprise Security (2005)

https://resources.sei.cmu.edu/asset_files/TechnicalNote/2005_004_001_14513.pdf

IS 531 : Lecture 12