CHAPTER FOUR
ETHICS AND
INFORMATION
SECURITY
MIS Business
Concerns
©The McGraw-Hill Companies, All Rights Reserved
2
CHAPTER OVERVIEW
SECTION 4.1 – Ethics
• Information Ethics
• Developing Information Management Policies
SECTION 4.2 – Information Security
• Protecting Intellectual Assets
• The First Line of Defense - People
• The Second Line of Defense - Technology
SECTION 4.1
Ethics
©The McGraw-Hill Companies, All Rights Reserved
4
LEARNING OUTCOMES
1. Explain the ethical issues in the use of the
information age
2. Identify the six epolicies an organization
should implement to protect themselves
5
INFORMATION ETHICS
Ethics – The principles and
standards that guide our behavior
toward other people
Information ethics – Govern the
ethical and moral issues arising
from the development and use of
information technologies, as well
as the creation, collection,
duplication, distribution, and
processing of information itself
6
INFORMATION ETHICS
Business issues related to information ethics
• Intellectual property
• Copyright
• Pirated software
• Counterfeit software
• Digital rights management
7
INFORMATION ETHICS
Privacy is a major ethical issue
• Privacy – The right to be left alone when
you want to be, to have control over your
own personal possessions, and not to be
observed without your consent
• Confidentiality – the assurance that
messages and information are available
only to those who are authorized to view
them
8
INFORMATION ETHICS
Individuals form the only ethical
component of MIS
• Individuals copy, use , and distribute software
• Search organizational databases for sensitive
and personal information
• Individuals create and spread viruses
• Individuals hack into computer systems to
steal information
• Employees destroy and steal information
9
INFORMATION ETHICS
Acting ethically and legally are not always the
same
10
Information Does Not Have Ethics,
People Do
Information does not care how it is used, it will
not stop itself from sending spam, viruses, or
highly-sensitive information
Tools to prevent information misuse
• Information management
• Information governance
• Information compliance
• Information Secrecy
• Information Property
11
DEVELOPING INFORMATION
MANAGEMENT POLICIES
Organizations strive to build a corporate culture
based on ethical principles that employees can
understand and implement
12
Ethical Computer Use Policy
Ethical computer use policy –
Contains general principles to
guide computer user behavior
The ethical computer user policy
ensures all users are informed
of the rules and, by agreeing to
use the system on that basis,
consent to abide by the rules
13
Information Privacy Policy
The unethical use of information typically
occurs “unintentionally” when it is used for new
purposes
Information privacy policy - Contains
general principles regarding information
privacy
14
Acceptable Use Policy
Acceptable use policy (AUP) – Requires a
user to agree to follow it to be provided access
to corporate email, information systems, and the
Internet
Nonrepudiation – A contractual stipulation to
ensure that ebusiness participants do not deny
their online actions
Internet use policy – Contains general
principles to guide the proper use of the Internet
15
Email Privacy Policy
Organizations can mitigate the risks of email
and instant messaging communication tools by
implementing and adhering to an email privacy
policy
Email privacy policy – Details the extent to
which email messages may be read by others
16
Email Privacy Policy
17
Email Privacy Policy
Spam – Unsolicited email
Anti-spam policy – Simply states
that email users will not send
unsolicited emails (or spam)
18
Social Media Policy
Social media policy –
Outlines the corporate
guidelines or principles
governing employee online
communications
19
WORKPLACE MONITORING
POLICY
Workplace monitoring is a concern for many
employees
Organizations can be held financially
responsible for their employees’ actions
The dilemma surrounding employee monitoring
in the workplace is that an organization is
placing itself at risk if it fails to monitor its
employees, however, some people feel that
monitoring employees is unethical
20
WORKPLACE MONITORING
POLICY
Information technology
monitoring – Tracks people’s
activities by such measures as
number of keystrokes, error rate,
and number of transactions
processed
Employee monitoring policy –
Explicitly state how, when, and
where the company monitors its
employees
21
WORKPLACE MONITORING
POLICY
Common monitoring technologies include:
• Key logger or key trapper software
• Hardware key logger
• Cookie
• Adware
• Spyware
• Web log
• Clickstream
SECTION 4.2
INFORMATION
SECURITY
©The McGraw-Hill Companies, All Rights Reserved
23
LEARNING OUTCOMES
3. Describe the relationships and differences
between hackers and viruses
4. Describe the relationship between information
security policies and an information security
plan
5. Provide an example of each of the three
primary security areas: (1) authentication and
authorization, (2) prevention and resistance,
and (3) detection and response
24
PROTECTING INTELLECTUAL ASSETS
Organizational information is
intellectual capital - it must be
protected
Information security – The
protection of information from
accidental or intentional misuse by
persons inside or outside an
organization
Downtime – Refers to a period of
time when a system is unavailable
25
PROTECTING INTELLECTUAL
ASSETS
Sources of Unplanned Downtime
26
PROTECTING
INTELLECTUAL ASSETS
How Much Will Downtime Cost Your Business?
27
Security Threats Caused by
Hackers and Viruses
Hacker – Experts in technology who use their
knowledge to break into computers and computer
networks, either for profit or just motivated by the
challenge
• Black-hat hacker
• Cracker
• Cyberterrorist
• Hactivist
• Script kiddies or script bunnies
• White-hat hacker
28
Security Threats Caused by
Hackers and Viruses
Virus - Software written with malicious intent to
cause annoyance or damage
• Backdoor program
• Denial-of-service attack (DoS)
• Distributed denial-of-service attack (DDoS)
• Polymorphic virus
• Trojan-horse virus
• Worm
29
Security Threats Caused by
Hackers and Viruses
How Computer Viruses Spread
30
Security Threats Caused by
Hackers and Viruses
Security threats to ebusiness include
• Elevation of privilege
• Hoaxes
• Malicious code
• Packet tampering
• Sniffer
• Spoofing
• Splogs
• Spyware
31
THE FIRST LINE OF DEFENSE - PEOPLE
Organizations must enable employees, customers,
and partners to access information electronically
The biggest issue surrounding information security
is not a technical issue, but a people issue
• Insiders
• Social engineering
• Dumpster diving
• Pretexting
32
THE FIRST LINE OF DEFENSE - PEOPLE
The first line of defense an organization should
follow to help combat insider issues is to develop
information security policies and an information
security plan
• Information security policies
• Information security plan
33
THE SECOND LINE OF DEFENSE -
TECHNOLOGY
There are three primary information technology
security areas
34
Authentication and Authorization
Identity theft – The forging of
someone’s identity for the purpose
of fraud
Phishing – A technique to gain
personal information for the
purpose of identity theft, usually by
means of fraudulent email
Pharming – Reroutes requests for
legitimate websites to false
websites
35
Authentication and Authorization
Authentication – A method for confirming users’
identities
Authorization – The process of giving someone
permission to do or have something
The most secure type of authentication involves
1. Something the user knows
2. Something the user has
3. Something that is part of the user
36
Something the User Knows Such As a User ID
and Password
This is the most common way to
identify individual users and
typically contains a user ID and a
password
This is also the most ineffective
form of authentication
Over 50 percent of help-desk
calls are password related
37
Something the User Knows Such As a User ID
and Password
Smart cards and tokens are more
effective than a user ID and a
password
• Tokens – Small electronic devices that
change user passwords automatically
• Smart card – A device that is around the
same size as a credit card, containing
embedded technologies that can store
information and small amounts of
software to perform some limited
processing
38
Something That Is Part Of The User Such As a
Fingerprint or Voice Signature
This is by far the best and most effective
way to manage authentication
• Biometrics – The identification of a user
based on a physical characteristic, such as a
fingerprint, iris, face, voice, or handwriting
Unfortunately, this method can be costly
and intrusive
39
Prevention and Resistance
Downtime can cost an organization anywhere
from $100 to $1 million per hour
Technologies available to help prevent and
build resistance to attacks include
1. Content filtering
2. Encryption
3. Firewalls
40
Prevention and Resistance
Content filtering - Prevents
emails containing sensitive
information from transmitting
and stops spam and viruses
from spreading
41
Prevention and Resistance
If there is an information security breach and
the information was encrypted, the person
stealing the information would be unable to
read it
• Encryption
• Public key encryption (PKE)
• Certificate authority
• Digital certificate
42
Prevention and Resistance
43
Prevention and Resistance
One of the most common
defenses for preventing a
security breach is a firewall
Firewall – Hardware and/or
software that guards a private
network by analyzing the
information leaving and
entering the network
44
Prevention and Resistance
Sample firewall architecture connecting systems
located in Chicago, New York, and Boston
45
Detection and Response
If prevention and resistance
strategies fail and there is a
security breach, an
organization can use detection
and response technologies to
mitigate the damage
Intrusion detection software
– Features full-time monitoring
tools that search for patterns in
network traffic to identify
intruders
46
LEARNING OUTCOME REVIEW
Now that you have finished the chapter
please review the learning outcomes in
your text
