case study 4-5 Pages + charts

Mbab4

romney_ais14_inppt_09.pptx

Home >Business & Finance homework help >Accounting homework help >case study 4-5 Pages + charts

Accounting Information Systems

Fourteenth Edition

Chapter 9

Confidentiality and Privacy Controls

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

If this PowerPoint presentation contains mathematical equations, you may need to check that your computer has the following installed:

1) MathType Plugin

2) Math Player (free versions available)

3) NVDA Reader (free versions available)

Learning Objectives

Describe the controls that can be used to protect the confidentiality of sensitive information.

Explain the controls that organization’s use to protect the privacy of personal information they collect from customers, suppliers, and employees, and discuss how the Generally Accepted Privacy Principles (GAPP) framework provides guidance in developing a comprehensive approach to protecting privacy.

Discuss how different types of encryption systems work, and explain how digital signatures provide the means for creating legally-enforceable contracts.

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

Protecting Confidentiality and Privacy of Sensitive Information

Identify and classify information to protect

Where is it located and who has access?

Classify value of information to organization

Encryption

Protect information in transit and in storage

Access controls

Information Rights Management (IRM)

Data loss prevention (DLP)

Digital watermarks

Training

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

Confidentiality relates to organizational intellectual property which includes strategic plans, trade secrets, cost information, legal documents, and so on.

Privacy focuses on protecting personal information on customers, vendors, employees, and business partners (it does not apply to organizational data, i.e., confidentiality).

It is worthwhile to note that encryption is good to use for data storage and transmission; however, it cannot be useful for data processing as data must be decrypted to be processed. That is why a “defense in depth” approach is needed by supplementing encryption with access controls and training.

Trust Services Framework

Security (Chapter 8)

Access to the system and its data is controlled and restricted to legitimate users.

Confidentiality (Chapter 8)

Sensitive organizational information (e.g., marketing plans, trade secrets) is protected from unauthorized disclosure.

Privacy

Personal information about customers is collected, used, disclosed, and maintained only in compliance with internal policies and external regulatory requirements and is protected from unauthorized disclosure.

Processing Integrity (Chapter 10)

Data are processed accurately, completely, in a timely manner, and only with proper authorization.

Availability (Chapter 10)

System and its information are available to meet operational and contractual obligations.

9-4

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

Steps in Securing IP

9-5

Where is the information, who has access to it?

Classify value of information

The process of obscuring information to make it unreadable without special knowledge, key files, or passwords.

Information rights management: control who can read, write, copy , delete, or download information.

Most important! Employees need to know what can or can’t be read, written, copied, deleted, or downloaded

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

Identification and Classification

Encryption

Controlling Access

Trainingj

Privacy

Deals with protecting customer information vs. internal company information

Same controls

Identification and classification

Encryption

Access control

Training

9-6

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

Privacy Concerns

SPAM

Unsolicited e-mail that contains either advertising or offensive content

CAN-SPAM (2003)

Criminal and civil penalties for spamming

Identity Theft

The unauthorized use of someone’s personal information for the perpetrator’s benefit.

Companies have access to and thus must control customer’s personal information.

9-7

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

Generally Accepted Privacy Principles

Management

Procedures and policies with assigned responsibility and accountability

Notice

Provide notice of privacy policies and practices prior to collecting data

Choice and consent

Opt-in versus opt-out approaches

Collection

Only collect needed information

Use, retention, and disposal

Use information only for stated business purpose. When no longer useful, dispose in a secure manner.

Access

Customer should be able to review, correct, or delete information collected on them

Disclosure to third parties

Security

Protect from loss or unauthorized access

Quality

Monitoring and enforcement

Procedures in responding to complaints

Compliance

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

Generally Accepted Privacy Principles (GAPP) are 10 best practices recommended for protecting privacy of customer’s personal information.

Encryption

Preventative control

Factors that influence encryption strength:

Key length (longer = stronger)

Algorithm

Management policies

Stored securely

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

Encryption Steps

Takes plain text and with an encryption key and algorithm, converts to unreadable ciphertext (sender of message)

To read ciphertext, encryption key reverses process to make information readable (receiver of message)

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

Types of Encryption

Symmetric

Asymmetric

Uses one key to encrypt and decrypt

Both parties need to know the key

Need to securely communicate the shared key

Cannot share key with multiple parties, they get their own (different) key from the organization

Uses two keys

Public—everyone has access

Private—used to decrypt (only known by you)

Public key can be used by all your trading partners

Can create digital signatures

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

The text refers to examples of symmetric and asymmetric encryption algorithms:

Examples of symmetric encryption are DES (data encryption standard) which was superseded by AES (advanced encryption standard).

Examples of asymmetric encryption are RSA (Rivest-Shamir-Adleman) and PGP (Pretty Good Privacy).

A good example for understanding asymmetric encryption is this:

I want to buy a book online, this purchase information with my credit card uses the online bookstore’s public key to encrypt the information. Only the online bookstore can decrypt this information using their private key which is known to them. That way, I can feel safe when purchasing online with the bookstore.

Now that we understand encryption better and that information is encrypted in transit, why is it that hackers can get credit card data?

It’s usually due to the fact that the private encryption key is stolen because it is not secured properly. Many times the private key is stored on the same server as the data itself, so when hackers gain access to the server, they are able to decrypt the data!

Digital Signatures

Used to create legally binding agreements (two steps to create)

Document creator uses a hashing algorithm to generate a hash of the original document

Document creator uses private key to encrypt step 1 above

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

The digital hash created in step 1 provides assurance that someone cannot enter into a digital transaction and then subsequently deny they had done so and refuse to fulfill their side of the contract.

The comparison of the hash created to the hash generated from the receiver of the document after the document was opened by the creator’s public key and then saved using the same hashing algorithm. Figure 9-4 on page 274 provides and excellent example.

Digital Signature

Hash of a document

Using document creators key

Provides proof:

That document has not been altered

Of the creator of the document

9-13

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

Digital Certificate

Electronic document that contains an entity’s public key

Certifies the identity of the owner of that particular public key

Issued by Certificate Authority

9-14

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

Virtual Private Network

Securely transmits encrypted data between sender and receiver

Sender and receiver have the appropriate encryption and decryption keys.

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

Key Terms

Information rights management (IRM)

Data loss prevention (DLP)

Digital watermark

Data masking

Tokenization

Spam

Identity theft

Encryption

Plaintext

Ciphertext

Decryption

Symmetric encryption systems

Asymmetric encryption systems

Public key

Private key

Key escrow

Hashing

Hash

Nonrepudiation

Digital signature

Digital certificate

Certificate authority

Public key infrastructure (PKI)

Virtual private network (VPN)

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›

Chapter 9: Confidentiality and Privacy Controls

Slide 1 - ‹#›