# data[].attributes.headline
Chapter 7/8 Securing Information Systems

# data[].attributes.subject
Chapter 7/8 Securing Information Systems

# data[].attributes.body
Question 1
Briefly explain the following computer crimes.

a) Sniffer - A software that commonly used to monitor and analyze network traffic in order to detect problems and keep things flowing efficiently. But a sniffer can also be used for ill intent. Sniffers track everything that goes through them, including unencrypted passwords and usernames so hackers who can access a sniffer can access any accounts that go through them. Additionally, a sniffer can be installed on any computer connected to a local network without needing to be installed on the device itself or in other words, it can go undetected for the duration of the connection.

b) Phishing - A cyber crime in which a target or targets are contacted by email, telephone or text message by someone posing as a legitimate institution to lure individuals into providing sensitive data such as personally identifiable information, banking and credit card details, and passwords.

c) Pharming - Pharming refers to redirecting website traffic through hacking, whereby the hacker implements tools that redirect a search to a fake website. Pharming may cause users to find themselves on an illegitimate website without realizing they have been redirected to an impostor site, which may look exactly like the real site

d) Spoofing - An umbrella term that includes IP address spoofing (sending messages to a computer using an IP address that makes it look as if the message is coming from a trusted source), email spoofing (forging an e-mail header to make it look like it came from somewhere or someone other than the actual source) and DNS spoofing (modifying the DNS server in order to reroute a specific domain name to a different IP address).

Question 2

a)  Distinguish the TWO (2) methods for encrypting network traffic on the Web.

SSL (Secure Sockets Layer) is the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral. SSL is an industry standard and is used by millions of websites in the protection of their online transactions with their customers.

TLS is a cryptographic protocol that provides end-to-end communications security over networks and is widely used for internet communications and online transactions. It is an IETF standard intended to prevent eavesdropping, tampering and message forgery. Common applications that employ TLS include Web browsers, instant messaging, e-mail and voice over IP.

b)  Briefly explain the following terms.
i. Cyber warfare - Cyber warfare involves the actions by a nation-state or international organization to attack and attempt to damage another nation's computers or information networks through, for example, computer viruses or denial-of-service attacks. RAND research provides recommendations to military and civilian decision makers on methods of defending against the damaging effects of cyber warfare on a nation's digital infrastructure.

ii. Computer Forensic - Computer forensics is the practice of collecting, analyzing and reporting on digital data in a way that is legally admissible. It can be used in the detection and prevention of crime and in any dispute where evidence is stored digitally. Computer forensics follows a similar process to other forensic disciplines, and faces similar issues.

Question 3
a) Without protection against malware and intruders, connecting to the Internet could be very dangerous. Firewalls, intrusion detection system and antivirus software have become the tools to overcome this problem. Briefly explain these THREE (3) tools.

Firewalls - A firewall is a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules. Firewalls have been a first line of defense in network security for over 25 years. They establish a barrier between secured and controlled internal networks that can be trusted and untrusted outside networks, such as the Internet.

Intrusion detection system -  An intrusion detection system (IDS) is a type of security software designed to automatically alert administrators when someone or something is trying to compromise information system through malicious activities or through security policy violations.

Antivirus software - Antivirus software is a program or set of programs that are designed to prevent, search for, detect, and remove software viruses, and other malicious software like worms, trojans, adware, and more.

b) Information systems controls is one of the components of an organizational framework for security and control. Information systems controls consist of two - general and application control. A company must know how and where to deploy security tools and security personnel must know what controls a company must have in place to protect its information system. Contrast between General Controls and Application Controls.

General controls apply to a wide range of exposures that systematically threaten the integrity of all applications processed within the CBIS environment. Some examples of general controls are controls against viruses and controls to protect the hardware from vandalism. Meanwhile, application controls are narrowly focused on exposures within specific systems. Some examples of application controls are controls to make sure that each employee only receives one paycheck per pay period and controls to ensure that each invoice gets paid only once.

Question 4
Malicious Software programs are referred to as Malware. Describe FOUR (4) types of malicious software.

1. Rootkits - Rootkits are a set of software tools used by an intruder to gain and maintain access to a computer system without the user's knowledge. These tools conceal covert running processes, files and system data making them difficult to detect. There are rootkits to penetrate a wide variety of operating systems including Linux, Solaris and versions of Microsoft Windows. A computer with rootkits on it is called a rooted computer.

2. Trojan - A program in which malicious or harmful code is contained inside apparently harmless programming or data in such a way that it can get control and do its chosen form of damage, such as ruining the certain area on your hard disk. A Trojan horse may be widely redistributed as part of a computer virus.

3. Worm- a worm is a self-replicating virus that does not alter files but duplicates itself. It is common for worms to be noticed only when their uncontrolled replication consumes system resources, slowing or halting other tasks.

4. Virus- a virus is a program or programming code that replicates by being copied or initiating its copying to another program, computer boot sector or document. Viruses can be transmitted as attachments to an e-mail note or in a downloaded file, or be present on a diskette or CD

Question 5
a) Nowadays securing information systems has become an important issue in organization to protect itself against computer crime. Define computer crime and provide an appropriate example.

Computer crime describes a very broad category of offenses. Some of them are the same as non-computer offenses, such as fraud, except that a computer or the Internet is used in the commission of the crime. Others, like hacking, are uniquely related to computers. The example of computer crime is hacking, logic bombs and phishing.

b) Briefly explain THREE (3) reasons why information systems are vulnerable to destruction, error and abuse?

Security is hard and expensive. It is not easy to design systems that resist penetration,particularly in today's world where they are connected to open networks. It requires considerable skill and investment of resources, often involving dozens of engineers and scientists and years of work. Consequently, many systems have vulnerabilities which allow an intruder to bypass the security controls. In many cases, the security controls themselves introduce weaknesses.

Security is complex and fuzzy. We speak about information security as though it were well-defined and quantifiable. In fact, it is neither of these. Security policies are often complex, imprecise, sometimes conflicting, and subject to human judgment.

Security is a bottomless pit. It is often said that the only way to make a system secure is to pull
the plug. It is not practical, and usually impossible, to achieve 100% security. Not only is it too expensive, it is unachievable because not all weaknesses and attacks can be anticipated. Vulnerabilities can be found in even carefully designed products. New methods of attack are
continually being discovered. Thus, one settles for something less than perfect, say a 90% solution aimed at preventing the simplest and most common attacks

c) Discuss the THREE (3) most important tools and technology for safeguarding information resources.

antivirus and anti-spyware software - it checks  computers  for presence of malware and can often eliminate it as well ad it also require continual updating

Authentication - which is a system that checks the identification of an end user who wants to access it. Some types of authentications are token, smart cards, biometric authentication and two-factor authentication.

Firewalls - which is a combination of hardware and software that prevents unauthorized users from accessing private networks and provides additional security by determining whether packets are part of an on-going dialogue between sender & receiver.

Question 6
a) Identity management software automates the process of keeping track of all information systems users and their system privileges, assigning each user a unique digital identity for accessing each system. Define authentication.

The process of identifying an individual, usually based on a username and password. In security systems, authentication is distinct from authorization , which is the process of giving individuals access to system objects based on their identity. Authentication merely ensures that the individual is who he or she claims to be, but says nothing about the access rights of the individual.

b) Identify and briefly describe FOUR (4) authentication technologies.

Username/Password – Most commonly used electrical authentication method across the globe. It does not require any physical device and has a very low implementation cost. It is reasonably good for low assurance applications. At the same time, these are also easy to share and can be guessed, stolen or hacked easily which makes it unsuitable for protecting confidential data.

One-time Password Device – These generate a new password at fixed intervals of time, using which it is possible to access restricted data. They provide true dual-factor authentication which makes the password difficult to steal or share. Hacking the password also becomes comparatively difficult as the password is not only random but also valid only for a small duration. Even so, these devices are expensive and rank low on the washability index.

Biometric Authentication – This uses a part of the body, like a retinal scan or fingerprint, to authenticate the user. This is completely unique to each user and nearly impossible to steal. These devices are usually expensive and highly invasive, besides increasing the complexity of administration. Also, while these are reasonably safe, even they are not completely foolproof.

E-Token Based Technologies which is a small device that develop/generates a new odd/random value every time it is used. This random value becomes the basis for authentication (an alternative to a password). It can be implemented on a USB key fob or on a smart card. Data is protected on the device itself.

Question 7

a) Describe ransomware.
Ransom malware, or ransomware, is a type of malware that prevents users from accessing their system or personal files and demands ransom payment in order to regain access. The earliest variants of ransomware were developed in the late 1980s, and payment was to be sent via snail mail. Today, ransomware authors order that payment be sent via cryptocurrency or credit card.

b) State how do we prevent and protect our computer from ransomware.

1. Security awareness training

2. Updates, patches and configuration

3.  Up to date asset inventory

c) Discuss the effects of computer crime to an organization.

The effect of computer crime to an organization is Computer crime can damage business' reputation and erode the trust that customers have for the organization. This could potentially lead to loss of customer, loss of sales and reduction in profits. The effect of reputational damage can even impact on suppliers, or affect relationships with partners, investors and other third parties vested in the business.

# data[].attributes.body
Questions:

1. Security isn’t simply a technology issue, it’s a business issue. Discuss.

Security is an important business issue because it affects the competitive and strategic issues of the organization. As the lines between work and play blurs due to the advances of technology, it becomes more apparent that ‘Information Security’ within the workplace is not just the IT department’s issue. Information or data is a business enabler, it enables operations and productivity so, the security of it should be viewed as essential and promoted throughout the company – but, in most cases it is not.

2. Who poses the biggest security threat: insiders or outsiders?

There are a number of insider threats related to data leakage (accidental or on purpose), fraudulent action through an integrity breach, loss of availability, or business continuity as a result of insider mistakes or deliberate action. In general, insider threats can cause significant business impact, not only because of the privileges that employees have over information technology but also because the company theoretically has its employees under its control, being responsible for their actions, in contradiction to external threats. External threats, including cyber threats, are an evolving type of threat requiring organizations to improve their cyber security capability and ensure that the appropriate framework and especially cyber security skills are present. There is a third category with increasing importance. Those are the partners, services providers, and subcontractors of a company. In this category, the line between internal and external is sometimes barely visible. In any case, enterprises have to ensure that their threat model includes this category and take the necessary measures to mitigate the related risks

3. Suppose your business had an e-commerce Web site where it sold goods and accepted credit card payments. Discuss the major security threats to this Web site and their potential impact. What can be done to minimize these threats

Malicious software and computer viruses are some of the biggest security threats to any E-commerce website. Viruses are normally from external sources and can corrupt files on website if introduced into the internal network. Viruses can completely destroy a computer system and disrupt the operations of the website. Trojan horse is malicious software that has the ability to capture the clients’ information, before any encryption software can take effect. They can also impersonate a customer and pass over bad and malicious codes into the server running the website. to avoid these viruses, Users should exercise reasonable precautions in order to minimize the introduction and spread of computer viruses onto the Rhodes networks. Virus scanning software should be used to check any software downloaded from the Internet or obtained from any questionable source. Virus protection software has to be installed on the computer; check frequently for virus signature updates; and actually scan the files on the PC.

# data[].attributes.headline
CASE STUDY 1 : THE LOOMING THREAT OF CYBER

# data[].attributes.subject
CASE STUDY 1 : THE LOOMING THREAT OF CYBER

# data[].attributes.body
1. Is cyber warfare a serious problem? Why or why not?

Cyber warfare is a serious problem that should be addressed.  With technology being  utilized world wide to control missiles and warfare, having a cyber threat is as serious if not more serious than a physical threat.  Cyber warfare can also act as a catalyst and induce an all out strike of terror on other countries. Cyber warfare is more complex than conventional warfare. Although many potential targets are military a country’s power grids, financial systems, and a communication network can also be crippled. Non-state actors such as terrorist ore criminal groups can mount attacks, and it is often difficult to tell who is responsible. Nations must constantly to be on the alert for new malware and other technologies that could be used against them, and some of these technologies develop by skilled hacker groups are openly for sale to interested governments.

2. What solutions are available for this problem? Do you think they will be effective? Why or why not?

The solution that the country must take to prevent from this problem is Computer crimes or rules should therefore be established, maybe in combination with an organization monitoring the cyberspace, with large and serious consequences against states violating these rules. Cyber weapons won’t go away and their spread can’t be controlled. Instead, as we’ve done for other destructive technologies, the world needs to establish a set of principles to determine the proper conduct of governments regarding cyber conflict. They would dictate how to properly attribute cyber attacks, so that we know with confidence who is responsible, and they would guide how countries should respond.