# data[].attributes.body
QUESTION 1
Security isn’t simply a technology issue, it’s a business issue. Discuss.

Information or data is a business enabler, it enables operations and productivity so, the security of it should be viewed as essential and promoted throughout the company, but in most cases it is not. IT Security should be seen as a task to minimize risk for an organization. This risk management is not just limited to the IT department or within the office because many people do work a little when we get home even if its just checking thier emails. Employees use of unauthorized personal mobile devices can be a threat because it is an unknown object on the IT network. For example, if a user was to save business data onto an unauthorized device and then it was infected by malware, the data could end up in the wrong hands. However, it is not about the IT department forbidding personal devices. If devices are approved then it is safe to have on the network. It’s all about having policies in place and training employees on how to access business data securely. The training should not be limited to the use of mobile devices but, general IT security practices such as always encrypting email containing sensitive data or never write log-in credentials on a piece of paper. It is also important to ensure staff are aware of ‘Social Engineering’ because no matter how protected an IT Network is, there is always the possibility of external threats getting in that will encrypt your files and demand a ransom.

QUESTION 2

Who poses the biggest security threat: insiders or outsiders?

Insiders poses the greatest security threat as they have access to sensitive information on a regular basis, and may know how that information is protected. If they want to steal it or leak it they can usually do so with far greater ease than outsiders. Furthermore, insiders may also accidentally leak data or otherwise put it at risk which is something that outsiders typically cannot do. Whether by attaching the wrong file to an email being sent, oversharing on social media, losing a laptop or USB drive, or through some other mistake, insiders can put an organization's data at risk with little effort. Policies and technology can help address this risk, but without it, problems are likely to occur. Also, from a practical standpoint, any sizeable organization is likely to have some employees who are unhappy at work – meaning that there may be people who have access to data and who have a motive for leaking it.

QUESTION 3

Suppose your business had an e-commerce Web site where it sold goods and accepted credit card payments. Discuss the major security threats to this Web site and their potential impact. What can be done to minimize these threats

E-commerce involves transactions of any kind of business done over an electronic system. This kind of business involves transactions that take place over the Internet. Therefore, e-commerce utilizes internal networks that interface with the World Wide Web. The nature of this kind of business, introduces internal and external risks to both the website and the business systems to which it is connected to. An E-commerce website can be faced with security threats such as fraud incidents that include credit card fraud, which exposes the website to threat from clients and any other external sources and internal fraud. Such transactions can also be introduced into the system by hackers or Trojan Horses, which resemble the real customers’ transactions. To prevent fraud, Fraud scoring must be used. It is a system of predictive fraud detection models or technologies that payment processors use to identify the highest-risk transactions in card-not-present environment that require additional verification. All card-not-present transactions must be authorized before they are processed. A website that has been invaded by viruses and malicious software, can come crushing which will make the website lose the entire information which causes loss to the e-commerce business. This can cause the clients to lose trust in the business, and as a result they can close their accounts on the website. Loss of information on a website can be devastating for both the business owner and the client especially if the information was not backed up.

Moreover, ,alicious software and computer viruses are some of the biggest security threats to any E-commerce website. Viruses are normally from external sources and can corrupt files on website if introduced into the internal network. Viruses can completely destroy a computer system and disrupt the operations of the website. Trojan horse is malicious software that has the ability to capture the clients’ information, before any encryption software can take effect. They can also impersonate a customer and pass over bad and malicious codes into the server running the website. To avoid these viruses, users should exercise reasonable precautions in order to minimize the introduction and spread of computer viruses. Virus scanning software should be used to check any software downloaded from the Internet or obtained from any questionable sources. Virus protection software should also be installed on the computer; virus signature updates should be checked frequently and files should be scanned on the PC to prevent these threats from occurring.

# data[].attributes.body
QUESTION 1

Is cyberwarfare a serious problem? Why or why not?

Cyberwarfare is a serious problem  because Non-state actors such as terrorist ore criminal groups can mount attacks, and it is often difficult to tell who is responsible. Cyberwarfare poses a unique and daunting set of challenges for security experts, not only in detecting and preventing intrusions but also in tracking down perpetrators and bringing them to justice. Less than two weeks later, Qatari natural gas company, Rasgas, was forced to shut down its website and e-email systems in an attack initially also attributed to Shammon. An investigative team concluded it was likely a copycat attack trying to look like the same perpetrator. U.S. government officials blamed Iranian hacker. Israeli officials attributed both attacks to Iran’s Cyber Corps, formed after Stuxnet. Previously released malware is recoverable and can be adapted and reused by both nation-state foes and unaffiliated cyber criminals. Stuxnet code has been adapted for use in financial cybercrime. Another drawback is uncontrollability. About 60 percent of known Stuxnet infections were in Iran, but 18 percent were in Indonesia, 8 percent in India, and the remaining 15 percent scattered around the world. In November 2012, Chevron admitted that its network had been infected with Stuxnet shortly after spread beyond Iran. So cyberwarfare is a serious problem because it can lead to other country from attack each other due to this virus that being spread.

QUESTION 2

What solutions are available for this problem? Do you think they will be effective? Why or why not?

Congress is considering legislation that would require all critical infrastructure companies to meet newer, tougher cybersecurity standards. As cyberwarfare technologies develop and become more advanced, the standards imposed by this legislation will likely be insufficient to defend against attacks.

·         Secretary of Defense Gates ordered the creation of Cybercom, the first headquarters designed to coordinate government cybersecurity efforts. It was activated in May 2010. It will coordinate the operation and protection of military and Pentagon computer networks. It will coordinate efforts to restrict access to government computers and protect systems that run the stock exchanges, clear global banking transactions, and manage the air traffic control system. Its ultimate goal will be to prevent catastrophic cyberattacks against the U.S. Some insiders suggest that it might not be able to effectively organize the governmental agencies without direct access to the President, which it currently lacks.

·         Because spy agencies like the CIA are prohibited by law from acting on American soil, some people are proposing to entrust some of the cyberwarfare work to private defense contractors. There is no effective way for a domestic agency to conduct computer operations without entering prohibited networks within the U.S. or even conduct investigations in countries that are American allies. Preventing terrorist or cyberwar attacks may require examining some email messages from other countries or giving intelligence agencies more access to networks or Internet service providers.

# data[].attributes.body
QUESTION 1

Sniffer:  Eavesdropping program that monitors information traveling over network and enables hackers to steal proprietary information such as e-mail, company files, and so on

Phishing:  Setting up fake Web sites or sending e-mail messages that look like legitimate businesses to ask users for confidential personal data

Pharming:  It is redirects users to a bogus Web page, even when individual types correct Web page address into his or her browser

Spoofing:  Misrepresenting oneself by using fake e-mail addresses or masquerading as someone else and redirecting Web link to address different from intended one, with site masquerading as intended destination

QUESTION 2
a) TWO (2) methods for encrypting network traffic on the Web.

Secure Sockets Layer (SSL) and successor Transport Layer Security (TLS) which is  enable client & server computers to manage encryption & decryption activities; so they communicate with each other during a secure web session

Secure Hypertext Transfer Protocol (SHTTP) which is  used for encrypt data flowing over the Internet but it is limited to individual messages, whereas SSL & TLS are designed to establish a secure connection between 2 computers.

b) Briefly explain the following terms.

Cyber warfare: It is  state-sponsored activity designed to cripple & defeat another state or nation by penetrating its computers or networks for the purposes of causing damage & disruption

Computer Forensic:  it is scientific collection, examination, authentication, preservation, and analysis of data from computer storage media for use as evidence in court of law and includes recovery of ambient and hidden data

QUESTION 3
a) Without protection against malware and intruders, connecting to the Internet could be very dangerous. Firewalls, intrusion detection system and antivirus software have become the tools to overcome this problem. Briefly explain these THREE (3) tools. (6 marks)

Identity management software: Automates keeping track of all users & privileges and authenticates users, protecting identities, controlling access

Authentication:  Password systems and Two-factor authentication

Firewalls: It is a combination of hardware and software that prevents unauthorized users from accessing private networks

b) Information systems controls is one of the components of an organizational framework for security and control. Information systems controls consist of two - general and application control. A company must know how and where to deploy security tools and security personnel must know what controls a company must have in place to protect its information system.
Contrast between General Controls and Application Controls.

General control  is about govern design, security, and use of computer programs and security of data  which apply to all computerized applications and with combination of hardware, software, and manual procedures to create overall control environment. Meanwhile, application control is specific controls unique to each computerized application - payroll or order processing and include automated and manual procedures like also include IPO controls

QUESTION 4
Malicious Software programs are referred to as Malware. Describe FOUR (4) types of malicious software.

Worms:  Independent programs -copy themselves from one computer to others over a network.

Trojan horses:  Software that appears benign but does something other than expected; e.g. Zeus Trojan

Viruses:  Rogue software program - attaches itself to other software programs / data files in order to be executed

Spyware: Small programs install themselves surreptitiously on computers to monitor user Web surfing activity and serve up advertising

QUESTION 5
a) Nowadays securing information systems has become an important issue in organization to protect itself against computer crime. Define computer crime and provide an appropriate example. (3 marks)

Computer crime can be defined  as “Any violations of criminal law - involve a knowledge of computer technology for their perpetration, investigation, or prosecution”  for example like  phishing which is setting up fake Web sites or sending e-mail messages that look like legitimate businesses to ask users for confidential personal data

b) Briefly explain THREE (3) reasons why information systems are vulnerable to destruction, error and abuse? (6 marks)

Accessibility of networks

Hardware problems and software problems

• Use of networks/computers outside of firm’s control

c) Discuss the THREE (3) most important tools and technology for safeguarding information resources. (6 marks)

Static packet filtering - examines selected fields in the header of data packet flowing back and forth between the trusted network & Internet, examining individual packets in isolation.

Stateful inspection – provides additional security by determine whether packets are part of an ongoing dialogue between sender & receiver.

Network address translation (NAT) – provide another layer of protection when static packet filtering and stateful inspection are employed.

QUESTION 6
a) Identity management software automates the process of keeping track of all information systems users and their system privileges, assigning each user a unique digital identity for accessing each system. Define authentication.

Authentication is The process of identifying an individual, usually based on a username and password. In security systems, authentication is distinct from authorization , which is the process of giving individuals access to system objects based on their identity

b) Identify and briefly describe FOUR (4) authentication technologies.

Password systems which most commonly used electrical authentication method across the globe. It does not require any physical device and has a very low implementation cost. It is reasonably good for low assurance applications. At the same time, these are also easy to share and can be guessed, stolen or hacked easily which makes it unsuitable for protecting confidential data.

Smart cards help to eliminate the threat of hackers stealing stored or transmitted information from a computer. The information is processed on the smart card, so it never has to leave the card or be transmitted to another machine.

Biometric authentication this uses a part of the body, like a retinal scan or fingerprint, to authenticate the user. This is completely unique to each user and nearly impossible to steal. These devices are usually expensive and highly invasive, besides increasing the complexity of administration. Also, while these are reasonably safe, even they are not completely foolproof.

Two factors authentication  is a widely used security process which involves two methods for security verification, one of which is very commonly used password verification.

QUESTION 7
a) Describe ransomware.

Ransomware is proliferating on both & mobile devices; tries to extort money from users by taking control of their computers or displaying annoying pop-up messages. For example is cryptolocker that encrypts an infected computer files, forcing users to pay hundreds of dollars to regain access.

b) State how do we prevent and protect our computer from ransomware.

Back up your computer

Backing up the files on your computer is one of the best ways to ensure that you are not affected too much if a cyber attack such as Petya infects your system. With your files backed up on an external hard disk or the cloud, you would have no difficulty whatsoever in accessing the files that are currently inaccessible on your computer system thanks to the encryption caused by the ransomware. However, it is important that you backup your computer on a regular basis so that the latest versions of all your files are readily available to you

Install protection programs

Another great means of stalling the progress of a malware and protecting your computer from its affects is installation of protection programs. These programs include anti-malware software, anti-virus programs and firewalls. Such protection software can help in notifying the threat posed by malware immediately and also safeguard the files stored on your computer from getting encrypted by the ransomware. It is also necessary to constantly update these programs too so that you have the most up-to-date protection from malware of all kinds.

Download patches

In the aftermath of cyber attacks such as WannaCry and Petya, Microsoft released patches that protected Windows users from the EternalBlue vulnerability that these ransomware targeted. These patches can help you from keeping your computer safe from these malware attacks. Most of the Window-run computers that are automatically updated have gotten this patch update by now. If you haven’t gotten this patch as of yet, you can download it from the Microsoft website as soon as possible.

c) Discuss the effects of computer crime to an organization.

Now we will discuss effect of computer crime on our world. Due to computer crime there is loss of billions of dollar annually. Computer crime is increasing every day and it is creating big losses and company level and at individual level stock losses. For example like fraud which dishonest way to make someone to do a loss which could make a profit for you in any case e.g. make a false webpage of a bank to retrieve information of account of someone.