QUESTION 2 
a) TWO (2) methods for encrypting network traffic on the Web. 

b) Briefly explain the following terms. 

QUESTION 3
a) Without protection against malware and intruders, connecting to the Internet could be very dangerous. Firewalls, intrusion detection system and antivirus software have become the tools to overcome this problem. Briefly explain these THREE (3) tools. (6 marks)
                  

 b) Information systems controls is one of the components of an organizational framework for security and control. Information systems controls consist of two - general and application control. A company must know how and where to deploy security tools and security personnel must know what controls a company must have in place to protect its information system. 
Contrast between General Controls and Application Controls. 

QUESTION 4 
Malicious Software programs are referred to as Malware. Describe FOUR (4) types of malicious software. 

QUESTION 5 
a) Nowadays securing information systems has become an important issue in organization to protect itself against computer crime. Define computer crime and provide an appropriate example. (3 marks) 

b) Briefly explain THREE (3) reasons why information systems are vulnerable to destruction, error and abuse? (6 marks) 

c) Discuss the THREE (3) most important tools and technology for safeguarding information resources. (6 marks) 

QUESTION 6 
a) Identity management software automates the process of keeping track of all information systems users and their system privileges, assigning each user a unique digital identity for accessing each system. Define authentication.

b) Identify and briefly describe FOUR (4) authentication technologies. 

QUESTION 7 
a) Describe ransomware. 

b) State how do we prevent and protect our computer from ransomware.

Back up your computer

Install protection programs

Download patches

c) Discuss the effects of computer crime to an organization.

Now we will discuss effect of computer crime on our world. Due to computer crime there is loss of billions of dollar annually. Computer crime is increasing every day and it is creating big losses and company level and at individual level stock losses. For example like fraud which dishonest way to make someone to do a loss which could make a profit for you in any case e.g. make a false webpage of a bank to retrieve information of account of someone.

 

 

QUESTION 2

What solutions are available for this problem? Do you think they will be effective? Why or why not?

          Congress is considering legislation that would require all critical infrastructure companies to meet newer, tougher cybersecurity standards. As cyberwarfare technologies develop and become more advanced, the standards imposed by this legislation will likely be insufficient to defend against attacks.

·         Secretary of Defense Gates ordered the creation of Cybercom, the first headquarters designed to coordinate government cybersecurity efforts. It was activated in May 2010. It will coordinate the operation and protection of military and Pentagon computer networks. It will coordinate efforts to restrict access to government computers and protect systems that run the stock exchanges, clear global banking transactions, and manage the air traffic control system. Its ultimate goal will be to prevent catastrophic cyberattacks against the U.S. Some insiders suggest that it might not be able to effectively organize the governmental agencies without direct access to the President, which it currently lacks.

·         Because spy agencies like the CIA are prohibited by law from acting on American soil, some people are proposing to entrust some of the cyberwarfare work to private defense contractors. There is no effective way for a domestic agency to conduct computer operations without entering prohibited networks within the U.S. or even conduct investigations in countries that are American allies. Preventing terrorist or cyberwar attacks may require examining some email messages from other countries or giving intelligence agencies more access to networks or Internet service providers.

 

Information or data is a business enabler, it enables operations and productivity so, the security of it should be viewed as essential and promoted throughout the company, but in most cases it is not. IT Security should be seen as a task to minimize risk for an organization. This risk management is not just limited to the IT department or within the office because many people do work a little when we get home even if its just checking thier emails. Employees use of unauthorized personal mobile devices can be a threat because it is an unknown object on the IT network. For example, if a user was to save business data onto an unauthorized device and then it was infected by malware, the data could end up in the wrong hands. However, it is not about the IT department forbidding personal devices. If devices are approved then it is safe to have on the network. It’s all about having policies in place and training employees on how to access business data securely. The training should not be limited to the use of mobile devices but, general IT security practices such as always encrypting email containing sensitive data or never write log-in credentials on a piece of paper. It is also important to ensure staff are aware of ‘Social Engineering’ because no matter how protected an IT Network is, there is always the possibility of external threats getting in that will encrypt your files and demand a ransom.

 

 

Insiders poses the greatest security threat as they have access to sensitive information on a regular basis, and may know how that information is protected. If they want to steal it or leak it they can usually do so with far greater ease than outsiders. Furthermore, insiders may also accidentally leak data or otherwise put it at risk which is something that outsiders typically cannot do. Whether by attaching the wrong file to an email being sent, oversharing on social media, losing a laptop or USB drive, or through some other mistake, insiders can put an organization's data at risk with little effort. Policies and technology can help address this risk, but without it, problems are likely to occur. Also, from a practical standpoint, any sizeable organization is likely to have some employees who are unhappy at work – meaning that there may be people who have access to data and who have a motive for leaking it. 

 

 

QUESTION 3

Suppose your business had an e-commerce Web site where it sold goods and accepted credit card payments. Discuss the major security threats to this Web site and their potential impact. What can be done to minimize these threats

 

E-commerce involves transactions of any kind of business done over an electronic system. This kind of business involves transactions that take place over the Internet. Therefore, e-commerce utilizes internal networks that interface with the World Wide Web. The nature of this kind of business, introduces internal and external risks to both the website and the business systems to which it is connected to. An E-commerce website can be faced with security threats such as fraud incidents that include credit card fraud, which exposes the website to threat from clients and any other external sources and internal fraud. Such transactions can also be introduced into the system by hackers or Trojan Horses, which resemble the real customers’ transactions. To prevent fraud, Fraud scoring must be used. It is a system of predictive fraud detection models or technologies that payment processors use to identify the highest-risk transactions in card-not-present environment that require additional verification. All card-not-present transactions must be authorized before they are processed. A website that has been invaded by viruses and malicious software, can come crushing which will make the website lose the entire information which causes loss to the e-commerce business. This can cause the clients to lose trust in the business, and as a result they can close their accounts on the website. Loss of information on a website can be devastating for both the business owner and the client especially if the information was not backed up.

Moreover, ,alicious software and computer viruses are some of the biggest security threats to any E-commerce website. Viruses are normally from external sources and can corrupt files on website if introduced into the internal network. Viruses can completely destroy a computer system and disrupt the operations of the website. Trojan horse is malicious software that has the ability to capture the clients’ information, before any encryption software can take effect. They can also impersonate a customer and pass over bad and malicious codes into the server running the website. To avoid these viruses, users should exercise reasonable precautions in order to minimize the introduction and spread of computer viruses. Virus scanning software should be used to check any software downloaded from the Internet or obtained from any questionable sources. Virus protection software should also be installed on the computer; virus signature updates should be checked frequently and files should be scanned on the PC to prevent these threats from occurring.