Accounting Essay 2 pages must answer all questions
noel001
romney_ais14_stppt_09.pptxAccounting Information Systems
Fourteenth Edition
Chapter 9
Confidentiality and Privacy Controls
Copyright © 2018 Pearson Education, Inc. All Rights Reserved
Copyright © 2018 Pearson Education, Inc.
Chapter 9: Confidentiality and Privacy Controls
Slide 1 - ‹#›
If this PowerPoint presentation contains mathematical equations, you may need to check that your computer has the following installed:
1) MathType Plugin
2) Math Player (free versions available)
3) NVDA Reader (free versions available)
1
Learning Objectives
Describe the controls that can be used to protect the confidentiality of sensitive information.
Explain the controls that organization’s use to protect the privacy of personal information they collect from customers, suppliers, and employees, and discuss how the Generally Accepted Privacy Principles (GAPP) framework provides guidance in developing a comprehensive approach to protecting privacy.
Discuss how different types of encryption systems work, and explain how digital signatures provide the means for creating legally-enforceable contracts.
Copyright © 2018 Pearson Education, Inc.
Chapter 9: Confidentiality and Privacy Controls
Slide 1 - ‹#›
2
Protecting Confidentiality and Privacy of Sensitive Information
Identify and classify information to protect
Where is it located and who has access?
Classify value of information to organization
Encryption
Protect information in transit and in storage
Access controls
Information Rights Management (IRM)
Data loss prevention (DLP)
Digital watermarks
Training
Copyright © 2018 Pearson Education, Inc.
Chapter 9: Confidentiality and Privacy Controls
Slide 1 - ‹#›
3
Privacy Concerns
Spam-unsolicited e-mail that contains either advertising or offensive content.
Identity theft-assuming someone’s identity, usually for financial gain.
Copyright © 2018 Pearson Education, Inc.
Chapter 9: Confidentiality and Privacy Controls
Slide 1 - ‹#›
4
Generally Accepted Privacy Principles
Management
Procedures and policies with assigned responsibility and accountability
Notice
Provide notice of privacy policies and practices prior to collecting data
Choice and consent
Opt-in versus opt-out approaches
Collection
Only collect needed information
Use, retention, and disposal
Use information only for stated business purpose. When no longer useful, dispose in a secure manner.
Access
Customer should be able to review, correct, or delete information collected on them
Disclosure to third parties
Security
Protect from loss or unauthorized access
Quality
Monitoring and enforcement
Procedures in responding to complaints
Compliance
Copyright © 2018 Pearson Education, Inc.
Chapter 9: Confidentiality and Privacy Controls
Slide 1 - ‹#›
5
Encryption
Preventative control
Factors that influence encryption strength:
Key length (longer = stronger)
Algorithm
Management policies
Stored securely
Copyright © 2018 Pearson Education, Inc.
Chapter 9: Confidentiality and Privacy Controls
Slide 1 - ‹#›
Encryption Steps
Takes plain text and with an encryption key and algorithm, converts to unreadable ciphertext (sender of message)
To read ciphertext, encryption key reverses process to make information readable (receiver of message)
Copyright © 2018 Pearson Education, Inc.
Chapter 9: Confidentiality and Privacy Controls
Slide 1 - ‹#›
Types of Encryption
Symmetric
Asymmetric
Uses one key to encrypt and decrypt
Both parties need to know the key
Need to securely communicate the shared key
Cannot share key with multiple parties, they get their own (different) key from the organization
Uses two keys
Public—everyone has access
Private—used to decrypt (only known by you)
Public key can be used by all your trading partners
Can create digital signatures
Copyright © 2018 Pearson Education, Inc.
Chapter 9: Confidentiality and Privacy Controls
Slide 1 - ‹#›
8
Digital Signatures
Used to create legally binding agreements (two steps to create)
Document creator uses a hashing algorithm to generate a hash of the original document
Document creator uses private key to encrypt step 1 above
Copyright © 2018 Pearson Education, Inc.
Chapter 9: Confidentiality and Privacy Controls
Slide 1 - ‹#›
9
Virtual Private Network
Securely transmits encrypted data between sender and receiver
Sender and receiver have the appropriate encryption and decryption keys.
Copyright © 2018 Pearson Education, Inc.
Chapter 9: Confidentiality and Privacy Controls
Slide 1 - ‹#›
Key Terms
Information rights management (IRM)
Data loss prevention (DLP)
Digital watermark
Data masking
Tokenization
Spam
Identity theft
Cookie
Encryption
Plaintext
Ciphertext
Decryption
Symmetric encryption systems
Asymmetric encryption systems
Public key
Private key
Key escrow
Hashing
Hash
Nonrepudiation
Digital signature
Digital certificate
Certificate authority
Public key infrastructure (PKI)
Virtual private network (VPN)
Copyright © 2018 Pearson Education, Inc.
Chapter 9: Confidentiality and Privacy Controls
Slide 1 - ‹#›
11
Copyright © 2018 Pearson Education, Inc.
Chapter 9: Confidentiality and Privacy Controls
Slide 1 - ‹#›
12
