Week 8 Lecture 1 - Key PointsManagement of Information Systems.docx

Week 8 Lecture 1 - Key Points
Management of Information Systems
Key Points
Key Points to remember are:
Business information systems
· Some information systems have become strategic tools as a
result of strategic planning; others have evolved into strategic
tools
· Strategic information systems help companies gain strategic
advantage
· Company achieves strategic advantage by using strategy to
maximize its strength, resulting in a competitive advantage
Strategic uses of information systems
· Various initiatives for establishing strategic advantage:
· Cost reduction, raising barriers to competitors, establishing
high switching costs, new products, differentiating products,
enhancing products, alliances, and locking in clients or
suppliers
· Creating standards often establishes strategic advantage in
software industry
· Reengineering: the process of redesigning a business process
from scratch to significantly reduce costs
· Strategic advantages of information systems are short-lived;
new opportunities must always be sought
· Must keep systems on the leading edge to maintain strategic
advantage
· Bleeding edge is the undesirable result of a failed innovation
effort
Business functions and supply chains
· Effectiveness is the degree to which a task is accomplished
· Efficiency is the ratio of output to input
· Productivity is the measure of people’s efficiency
· Information systems have been integrated into accounting

services
· Financial information systems help managers track cash
· Computer-aided design (CAD) systems help engineers design
new projects
· Computer-aided manufacturing (CAM) systems direct
machines that assemble parts
· Supply chain management (SCM) systems optimize workload,
speed, and cost in supply chains
· Customer relationship management (CRM) includes the entire
cycle of relationships with customers
· Human resource management systems facilitate staff selection
and record keeping
· Multiple companies’ SCM systems can be linked, facilitating
cooperation, which requires trust
· An enterprise resource planning (ERP) system can encompass
all business processes, but is expensive and challenging
Business hardware
· Understanding hardware is important for purchasing decisions
· Computers are classified according to power
· All computers have a CPU to process instructions
· Clock rate measures the speed of a CPU
· Data word: the number of bits the computer can process in a
single cycle
· Computer power: measured by its speed, memory size, and
number of processor cores
· RAM: volatile memory
· ROM is nonvolatile; it does not require power
· Imaging devices help process text and graphics
· When evaluating external storage, consider transfer rate,
capacity, portability, and form of data organization supported
· Data is organized sequentially on tapes
· Direct access storage devices such as RAM, magnetic disks,
and optical discs allow random access
· Databases require direct access storage devices
· When purchasing hardware, professionals should consider
cost, power, scalability, compatibility, etc.

· Information technology may pose health risks such as carpal
tunnel syndrome
Business software
· Software: a collective term for computer programs
· Two categories of software: system or application
· Programming languages and software development tools are
used to develop software
· Increasing amount of software is linked to the Internet
· Code written in non-machine language must be translated by
compilers or interpreters
· Some application programs are custom-designed; many are
packaged
· Office productivity tools such as word processors and
spreadsheets help improve worker efficiency
· Hypermedia and multimedia technology are useful for
training, education, research, and business
· Groupware combines hypermedia and multimedia with web
technologies for collaboration
· Three-dimensional geographic software helps model maps and
locations
· Many applications support web services and access to
information on the web
· Most important system software is operating systems
· Open source software is distributed freely via the web
· Nearly all software is licensed; SaaS is an alternative to
traditional software licensing
· Ready-made software purchase decisions should evaluate
many factors, e.g., suitability, ease of learning, ease of use,
vendor reputation, expected quality of vendor support, etc.
· Software piracy is still a significant problem
Business networks and telecommunications
· Telecommunications is communication over distance
· Telecommunications technology has changed the business
environment
· Different media have different bandwidths
· Networks are classified according to reach and complexity

· Public network can be turned into a virtual private network
(VPN)
· Network protocols are sets of rules to which all devices on a
network must adhere
· The Internet adheres to the TCP/IP protocol
· Wireless technologies make it easy and affordable to create
wireless LANs and hotspots
· Organizations and individuals have variety of choices when
subscribing to networking services
· As Internet links become faster, Internet telephony, also
known as Voice over Internet Protocol (VoIP), is gaining in
popularity
· Wireless technologies support the increasingly popular RFID
technologies
· Much like hardware, telecommunications technologies are
merging
· Increasing numbers of employees now telecommute
Databases and warehouses
· Databases organizations collect vast amounts of data
· Database approach has several advantages over traditional file
approach
· Character: smallest piece of data
· Field: made up of multiple characters
· Record: collection of related fields
· File: collection of related records
· Database management system (DBMS): tool to construct
databases
· Relational and object-oriented database models have different
advantages
· Keys are used to form links among entities
· Primary keys are unique identifiers
· Object-oriented database maintains objects that contain data
and procedures that process them
· Structured Query Language (SQL) is an international standard
for querying databases
· Database designer must construct a schema to construct a

database
· Database designers conduct data modeling and create entity
relationship diagrams to plan databases
· Many databases are linked to the Web
· Data warehouses contain huge collections of historical
transaction data
· Data warehouse data requires extraction, transformation,
loading (ETL)
· Invasion of privacy is exacerbated by database technology
· Big Data is the collection and storage of ever-more-detailed
quantities of data
The web-enabled enterprise
· Some industries have changed drastically due to web
technologies
· HTTP is an Internet standard controlling web server addresses
· HTTPS is a secure version of HTTP
· XML is a standard for description of data
· Blogs enable people to create discussion Web pages
· Cookies help websites personalize the visitor’s experience
· Many web technologies are proprietary
· A business can maintain its own web server or use a web
hosting service
· Organizations should consider several factors when selecting a
web host
· Web-enabled commerce is classified into B2B and B2C
· B2B trading relies on electronic data interchange (EDI) and
XML
· Mobile commerce needs to be considered in any online
business strategy
· Online businesses must adhere to several factors to be
successful
· Spam and spyware are online annoyances
· Phishing is a pervasive fraud crime
Week 8 Lecture 2 - Key Points Continued

Management of Information Systems
Key Points Continued
Key points to remember:
Challenges of global information systems
· Companies conducting web-based business must accommodate
non-English speaking audiences
· Companies must tailor to local preferences
· Organizations must be aware of cultural differences and
payment preferences
· Businesses must be aware of tariff and legal issues
· Linguistic, cultural, economic, and political challenges must
be addressed
· Laws governing the collection and manipulation of personal
data in the U.S. and the European Union are different
· The U.S. and EU have incompatible data privacy laws, which
restrict the flow of personal data between the U.S. and EU
Decision support and expert systems
· Decision aids include decision support systems, expert
systems, group decision support systems, geographic
information systems, etc.
· Three major phases of decision-making process: intelligence,
design, and choice
· Types of problems: spectrum from unstructured to structured
· Most DSSs have three components: data management module,
model management module, and dialog module
· Sensitivity analysis measures how parameters affect results,
and allow “what if” analysis
· Spreadsheets allow users to create DSSs without expertise
· Expert systems are designed to emulate the knowledge of an
expert, using artificial intelligence techniques
· Neural network software may be integrated into an expert
system to emulate learning
· Expert systems are used in narrow domains where decisions
are unstructured
· Geographic information systems are used when decisions
involve locations and routes

· Computerized decision aids may overlook important
circumstances, leading to inaccuracies or unfairness to
individuals
Business intelligence and knowledge management
· Business intelligence (BI) is any information about
organization, its customers, or its suppliers that can help firms
make decisions
· Data mining is the process of selecting, exploring, and
modeling large amounts of data to discover previously unknown
relationships
· Data mining is useful for predicting customer behavior and
detecting fraud
· Online analytical processing (OLAP) puts data into two-
dimensional tables
· OLAP either uses dimensional databases or calculates desired
tables on the fly
· Drilling down means moving from a broad view to a specific
view of information
· Dashboards interface with BI software tools to provide quick
information such as business metrics
· Knowledge management involves gathering, organizing,
sharing, analyzing, and disseminating knowledge
· The main challenge of knowledge management is identifying
and classifying useful information from unstructured sources
· Most unstructured knowledge is textual
· Employee knowledge networks are software tools to help
employees find other employees with specific expertise
· Autocategorization is the automatic classification of
information
Systems planning and development
· IT planning is important because of high investment costs and
high risk in implementing enterprise applications
· Standardization is an important part of IT planning
· Systems development life cycle (SDLC) has well-defined
phases: analysis, design, implementation, and support
· Purpose of systems analysis is to determine what needs the

system will satisfy
· Feasibility studies determine if a proposed system is possible
and desirable
· System requirements detail the features needed
· Developers outline system components graphically and
construct the software
· Models of the desired system are created using tools, e.g., data
flow diagrams and Unified Modeling Language (UML)
· Implementation includes training and conversion from the old
system to the new system
· Support entails maintenance and satisfying changing needs
· Agile methods are a popular alternative to traditional systems
development life cycle
· Tools help plan and manage development projects
· Systems integration may be more complicated than systems
development
· Great responsibility of IS professionals results in the
desirability of certification
Choices and system acquisition
· Several alternatives to having applications developed in-house
include outsourcing, licensing ready-made software, using
software as a service, and allowing users to develop their own
software
· Outsourcing can mean commissioning development or
assigning services to vendor
· Outsourcing custom-designed applications might afford the
organization a good fit of software to need
· Outsourcing IT services offers possible benefits, such as
reduced cost and shortened time implementing new technologies
· Outsourcing IT services has potential risks, such as loss of
control, loss of experienced employees, and loss of competitive
advantage
· Licensing software advantages include software being
immediately available and low-priced
· Disadvantage of licensing software is often a loose fit to the
organization’s needs

· Software as a service, from an ASP, is a popular method of
obtaining software for a monthly fee
· User application development has advantages, e.g., short lead
time, good fit, and freeing IT staff
· User application development disadvantages include poor
quality, islands of information, security problems, and poor
documentation
· Policies must be established to prevent computer abuse by
employees
· Employees should not use their computers for anything but
work
Risks, security, and disaster recovery
· The purpose of controls and security measures is to maintain
the functionality of ISs
· Risks to ISs include risks to hardware, data, and networks
· Risks to hardware include natural disasters and vandalism
· Risks to data and applications include theft of information,
identity theft, data alteration, data destruction, defacement of
websites, viruses, worms, logic bombs, and non-malicious
mishaps
· Risks to online systems include denial of service and computer
hijacking
· Controls are used to minimize disruption
· Access controls require information to be entered before
resources are made available
· Atomic transactions ensure data integrity
· Firewalls protect against Internet attacks
· Encryption schemes scramble messages to protect them on the
Internet
· A key is used to encrypt and decrypt messages
· SSL, TLS, and HTTPS are encryption standards designed for
the web
· Keys and digital certificates can be purchased from a
certificate authority
· Many organizations use the services of organizations that
provide hot sites

· Careful evaluation of the amount spent on security measures is
necessary
· Redundancy reduces the probability of downtime
· Governments are obliged to protect citizens against crime and
terrorism
© Cengage Learning 2015
1
Figure 8.8 The components of a web-based retailing operation
Several elements are essential to conducting business on the
Web, some of them are
An Inquiry interface that connects to database to allow a user to
search a catalog of products or services
An order processing application that includes credit-card
verification
and an order-fulfillment system that picks, packs, and ships
Business success depends on availability and use of proper
software
Elements needed to support B2C commerce
A method of targeting customers
Capture of the customer’s complete experience
Personalizing the service
Shortening the business cycle
Letting customers help themselves
Being proactive and preventing a product from becoming a
commodity
Target the customers needing your products and services

The most important effort of marketing is identifying the sites
that your audience frequently visits
Consider blogs and podcasting sites for advertisement
placement
Capture the Customer’s Total Experience by using cookies to
record shopper’s movements within the site
Use CRM software to create consumer profiles
Shopper experience becomes an asset of business, allowing for:
Fine-tuning of the product portfolio
Tailoring of web pages to individual customers
Individual e-mails to shopper offering products of interest
Personalize the service. CRM software and web page
customization software can be combined to:
Personalize web pages shown to a customer
Allow the customer to select the type of e-mail content desired
Respect visitor privacy by offering opt-in rather than opt-out
Allow the customer to tailor products to be purchased
Shorten the business cycle. Customers like saving time via web
business
Fulfillment is a major challenge for businesses
Activities after a customer places order are important.
Fast shipping is desired because:
It produces higher customer satisfaction
And, the business will collect payments faster
The entire fulfillment process can be outsourced to fulfillment
organizations such as:
UPS’s e-Logistics
FedEx’s Supply Chain Services
Let customers help themselves. Self-service is a concept that
uses the customer’s ability to determine the timing and services
of their consumer needs through a website
Self-service saves labor, and encourages customer loyalty

E-mail messages sent to customers with information about
orders and how to track them
Online FAQs allow customers to find answers to common
questions
Be proactive and De-commoditize. Prompt e-mail replies
expected
Proactive alerts are expected for changes in orders or services,
or product recalls
Automatic reordering features are desirable
Businesses must take initiatives to de-commoditize products
A commodity is a product sold at roughly the same price by
many vendors (no differentiation)
Addition of features or services prevents a product from
becoming a commodity by creating differentiation
E-commerce is every commerce. Web technologies have been
highly integrated into the business world
It is difficult to identify which business activities are on the
Internet and which are not
The Web has been highly integrated into daily activities of
customers.
Commerce and e-commerce generally have the same meaning
today
1
2
Figure 8.1 HTML and XML code: XML provides a method for
describing or classifying data in a webpage
Web business is growing and changing.

Ford Motor Company is a world leader in automobile
manufacturing
It employs 197,000 people, in 67 plants around the world
In 2010, Ford targeted a younger, tech-savvy audience in its
social marketing strategy of the Ford Fiesta
Response was a positive online attitude An anonymous authors
stated that with social media, if you aren’t using, you’re losing.
Let’s discuss a few Web technologies.
Several standards and technologies enable the Web to deliver
rich information
HTTP, HTML, XML
File Transfer
Blogs
Wikis
Podcasting
IM
Cookies
Hypertext Transfer Protocol (HTTP) is used to transfer and
download web information
HTTPS (HTTP Secure) is used for confidential data exchange
A Uniform Resource Locator (URL) is a unique address given to
each web site
An IP address is a special numeric address
A Domain name is a unique name for a web site, constructed
with letters
A Top-level domain (TLD) is the last part of URL
Hypertext Markup Language (HTML) helps developers create
Web page. It determines look and location of content on a
webpage.
Extensible Markup Language (XML) enables creation of various
data types. It conveys the meaning or content of data
XHTML is a combination of XML and HTML. It uses opening
and closing tags to control the format
HTML5 is the newest version of HTML/XML
File Transfer Protocol (FTP) transmits whole digital files

FTP facilitates downloads from websites
Can transfer most types of files,
And can be used to place files on a server for shared use,
Blog is the contraction of “web log”
Blogs invite visitors to post opinions and art
Blogs focus on a topic or set of topics
Trackback is a tool that notifies bloggers when their posts have
been mentioned elsewhere on the web
Blogs are often used by businesses
The importance of blogs to commercial organizations is to find
out what blog participants think and say about the organization
Wiki is derived from Hawaiian, meaning “quick.” It is a web
application that enables users to add to and edit the contents of
web pages
All the software required to edit the web pages is embedded in
the pages themselves
Wikipedia is a popular online encyclopedia
Wiki technology is a popular ingredient in groupware , software
used for collaboration
A Podcast is a published audio or video recording on the web
for download
Podcast are usually on a subscription basis
Some uses of podcast are:
“Time-shifted” broadcast of radio station programs for later
listening,
Audio tours in museums,
Lectures in distance learning courses,
Apple’s iTunes products and services,
Variety of content,
And many podcast media files are free
A Massively open online course, a (MOOC), is a new education
delivery approach that combines traditional course materials
with Web-enabled interactive forums for educators and students.

Instant messaging (IM) is “real-time” messaging that enables
chatting online through mobile and traditional devices. IM
enable chat room communication within a group
Examples of software applications with expanded
communication tools are
Skype,
ooVoo,
, and Wiggio
Some free applications for IM are
AIM: AOL instant Messenger,
Yahoo! Messenger,
MSN Messenger,
And ICQ,
Business uses include sales and support.
A Cookie is a small file that stores information about a web site
visitor on the visitor’s computer
Cookies can records the surfer’s ID,
Store a surfer’s preferences,
provide convenience to consumers,
Can be temporary (single session) or permanent,
And have potential for intrusion into surfer privacy
Clickstream tracking tracks a surfer’s clicking activities
Spyware traces and reports online behavior
Proprietary technology is intellectual property of the
developer; not free for all to use
Examples are
Local search engines,
Shopping cart applications,
Wish lists,
Video streaming tools,
and tools to analyze and predict web visitor behavior,
especially shopper behavior

2
Decision Support
An organization’s success depends on the decisions made by
employees
Computer-based systems are beneficial for:
Large amounts of information
Intensive processing
Types of decision support aids
Decision support systems (DSSs)
Expert systems (ESs)
Applications today may combine both types
Provide single optimal solution or set of solutions
3
3
An organization’s success depends on the decisions made by
employees
Computer-based systems are beneficial for:
Large amounts of information
Intensive processing
Types of decision support aids
Decision support systems (DSSs)
Expert systems (ESs)
Applications today may combine both types
Provide single optimal solution or set of s
Decision support modules today may be part of larger enterprise
applications
Also called business analysis tools or business intelligence
applications
Designed to streamline the decision-making process
Data warehouses and online processing (OLAP) technologies

have enhanced the ability to use data for decision making
A decision must be made whenever more than one possible
action is available
It can be difficult to make decisions when many reasonable
alternatives are present
In business, there may be dozens, hundreds, or even millions of
different courses of actions available to achieve a desired result
Decision making is a three-phase process
Intelligence phase: collect facts, beliefs, and ideas
Design phase: design the method for considering the collected
data, to reduce the alternatives to a manageable number
Choice phase: select an alternative from the remaining choices
Businesses collect data internally and externally
A model is an abstraction of reality, such as:
Tabletop representations of buildings
Maps: represent a geographical area
Mathematical equations representing relationships among
variables
Managers either choose universal models or design their own
models
A structured problem is one in which an optimal solution can be
reached through a single set of steps
An Algorithm is a sequence of steps to complete a task
Parameters are categories of data that are considered in an
algorithm
Most mathematical and physical problems are structured, but
many business problems are not
An Unstructured problem is one for which there is no algorithm
that leads to an optimal solution
May not be enough information
May be a large number of potential factors
Unstructuredness is closely related to uncertainty
Examples of unstructured problems

Weather prediction
Stock market prediction
A Semistructured problem is one that is neither fully structured
nor totally unstructured
Professionals encounter semistructured problems almost daily in
many different industries
The goal is to choose the one alternative that will bring about
the best outcome
Challenges of
Global Information Systems
Global information systems face challenges such as:
Technological barriers
Regulations and tariffs
Electronic payment mechanisms
Different languages and cultures
Economic and political considerations
Different measurement and notation standards
Legal barriers
Different time zones
4
4
Global information systems face challenges such as:
Technological barriers
Regulations and tariffs
Electronic payment mechanisms
Different languages and cultures
Economic and political considerations
Different measurement and notation standards
Legal barriers
Different time zones

Technological Challenges
Not all countries have adequate information technology
infrastructure to allow companies to build an international IS
Broadband communication lines are needed to support today’s
graphics-rich webpages
Companies can offer two versions of their websites to
compensate for slower bandwidth
Language is another technological challenge
Eight-bit byte code is not sufficient for languages with large
character sets
Unicode allows for 65,536 characters
Must coordinate with databases and applications
Telephone number and postal code formats are different in
different countries
Regulations and Tarrifs
Countries have different import regulations and tariffs
Executives may be reluctant because of hassles of learning the
laws, taxes, tariffs, and regulations of other countries
Companies must comply with the laws of destination countries
NextLinx software helps importers and exporters using web
commerce
Differences in Payment Mechanisms
Easy payment for online purchases is expected
Credit cards are the preferred payment method in North
America
Not all countries have adopted this preference
High level of stolen credit cards in Eastern Europe
Europeans prefer debit cards
Most Japanese reluctant to use credit cards
Language Differences
International parties must agree on a common language for
communication

Data might not be transmittable internationally in real time
because it must first be translated
English is considered the de facto international language
Companies in the forefront of web-based
e-commerce translate their original websites into local
languages
Cultural Differences
People from different countries vary in their:
Tastes
Gestures
Preferred colors
Treatment of people of certain gender or age
Attitudes about work
Opinions about ethical issues
Conservative groups in other countries may dislike the
“Americanization” of their cultures
Web designers must be sensitive to cultural differences
5
Figure 11.1 Potential applications of data mining © Cengage
Learning 2015
A data warehouse is a large database containing historical
transactions and other data
Data warehouses are useless without software tools to process
the data into meaningful information
Business intelligence (BI) is information gleaned with
information analysis tools
Also called business analytics
Data mining is a the process of selecting, exploring, and

modeling large amounts of data
Data mining is used to discover relationships that can support
decision making
Data-mining tools may use complex statistical analysis
applications
Data-mining queries are more complex than traditional queries
Data-warehousing techniques and data-mining tools facilitate
the prediction of future outcomes
The objectives of data mining are:
Sequence or path analysis, which is finding patterns where one
event leads to another
Classification which is finding whether certain facts fall into
predefined groups
Clustering which is, finding groups of related facts not
previously known
And Forecasting which is discovering patterns that can lead to
reasonable predictions
Data mining techniques are applied to various fields, including
marketing, fraud detection, and targeted marketing to
individuals
Data mining techniques are used in predicting customer
behavior
Banking uses data mining to help find profitable customers,
detect patterns of fraud, and predict bankruptcies
Mobile phone services vendors use data mining techniques to
help determine factors that affect customer loyalty
Customer loyalty programs ensure a steady flow of customer
data into data warehouses
Many industries utilize loyalty programs, e.g., frequent-flier
programs and consumer clubs
Huge amounts of data about customers is amassed
UPS’ Customer Intelligence Group analyzes customer behavior
and predicts customer defections so that a salesperson can
intervene to resolve problems

Data mining techniques are used in identifying profitable
customer groups
Financial institutions dismiss high-risk customers
Companies attempt to define narrow groups of potentially
profitable customers
Data mining utilize loyalty programs
Companies develop customized email newsletters targeted to
individual customers
Targeted special offers and partner specials are tailored to each
customer
5
6
Figure 12.1 The steps associated with information systems
planning © Cengage Learning 2015
Enterprise ISs are gaining in popularity
IS resource investment considerations
Require a substantial investment
Carry a high risk in implementation
Successful integration of the system is vital
Must align IT strategies with the overall organization strategies
Careful planning of an IS implementation is necessary
Key steps in IT planning
Create a corporate and IT mission statement
Articulate the vision for IT within the organization
Create IT strategic and tactical plans
Create a plan for operations to achieve the mission and vision
Create a budget to ensure that resources are available to achieve
the mission and vision

Mission statement: communicates the most important
overarching goal of organization
Includes how the goals will be achieved
IT mission statement: describes the role of IT in the
organization
Should be compatible with the organizational mission statement
Includes the ideal combination of hardware, software, and
networking to support the mission
CIO develops a strategic plan for implementation of IT in the
organization
Addresses what technology will be used by employees,
customers, and suppliers
Goals in the plan are broken down into objectives, such as:
Resources to be acquired or developed
Timetables for acquiring and implementing resources
Training
Objectives are broken down to operational details
IT planning is similar to planning of other resource acquisitions
Growing proportion of IT funds is spent on software in recent
years
More purchasing and adapting of software
Less developing in-house software
6
Goals of Information Security
Protecting IT resources is a primary concern
Securing corporate ISs is becoming increasingly challenging
Major goals of information security
Reduce the risk of systems ceasing operation
Maintain information confidentiality
Ensure the integrity and reliability of data resources
Ensure the uninterrupted availability of resources
Ensure compliance with policies and laws

7
7
Protecting IT resources is a primary concern
Securing corporate ISs is becoming increasingly challenging
Major goals of information security are to
Reduce the risk of systems ceasing operation,
Maintain information confidentiality,
Ensure the integrity and reliability of data resources,
Ensure the uninterrupted availability of resources,
And Ensure compliance with policies and laws
Laws passed by U.S. Congress setting standards for protecting
privacy
Health Insurance Portability and Accountability Act of 1996
(HIPAA)
Sarbanes-Oxley Act of 2002 (SOX)
CIA triad: foundational concepts of information systems
security
Confidentiality
Integrity
Availability
Risks associated with cloud computing and data storage
Downtime: the period of time during which an IS is not
available
$26 billion lost annually in the U.S. due to downtime
Costs of downtime vary depending on industry, the size of the
company, and other factors
There are also risk to hardware.
The #1 cause of system downtime is hardware failure
Major causes of hardware damage
Natural disasters
Fires, floods, earthquakes, hurricanes, tornadoes, and lightning
Blackouts and brownouts
Blackout: total loss of electricity
Brownout: partial loss of electricity

Uninterruptible power supply (UPS): backup power for a short
time
Major causes of hardware damage
Vandalism
Deliberate destruction
Deliberate alteration or destruction is often done as a prank, but
has a high cost
Online vandal’s target may be a company’s website
Hacking: unauthorized access
Honeytoken: a bogus record in a networked database used to
combat hackers
Honeypot: a server containing a mirrored copy of a database or
a bogus database
Educates security officers about vulnerable points
Virus: spreads from computer to computer
Worm: spreads in a network without human intervention
Antivirus software: protects against viruses
Trojan horse: a virus disguised as legitimate software
Logic bomb: software that is programmed to cause damage at a
specific time
Unintentional, non-malicious damage can be caused by:
Poor training
Lack of adherence to backup procedures
Unauthorized downloading and installation of software may
cause damage
Human error
There are risks to online operations. Many hackers try daily to
interrupt online businesses
Some types of attacks
Unauthorized access
Data theft
Defacing of webpages
Denial of service

Hijacking computers
Denial of service (DoS): an attacker launches a large number of
information requests
Slows down legitimate traffic to site
Distributed denial of service (DDoS): an attacker launches a
DoS attack from multiple computers
Usually launched from hijacked personal computers called
“zombies”
There is no definitive cure for this
A site can filter illegitimate traffic
Computer Hijacking is using some or all of a computer’s
resources without the consent of its owner
Often done for making a DDoS attack
Done by installing a software bot on the computer
Main purpose of hijacking is usually to send spam
Bots are planted by exploiting security holes in operating
systems and communications software
A bot usually installs e-mail forwarding software
Security Measures
Organizations can protect against attacks using various
approaches, including:
Firewalls
Authentication
Encryption
Digital signatures
Digital certificates
8
8

Organizations can take security measures to protect against
attacks using various approaches, including:
Firewalls
Authentication
Encryption
Digital signatures
And Digital certificates
Firewall: hardware and software that blocks access to
computing resources
The best defense against unauthorized access over the Internet
Firewalls are now routinely integrated into routers
DMZ: demilitarized zone approach
One end of the network is connected to the trusted network, and
the other end to the Internet
Connection is established using a proxy server
Proxy server: “represents” another server for all information
requests from resources inside the trusted network
Can also be placed between the Internet and the trusted network
when there is no DMZ
Authentication: the process of ensuring that you are who you
say you are
Encryption: coding a message into an unreadable form
Messages are encrypted and authenticated to ensure security
Important when communicating confidential information, e.g.,
financial and medical records
A message may be text, image, sound, or other digital
information
Encryption programs scramble the transmitted information
Plaintext is the original message
Ciphertext is the encoded message
Encryption uses a mathematical algorithm and a key
A Key is a unique combination of bits that will decipher the

ciphertext
Public-key encryption uses two keys, one public and one private
Symmetric encryption is when the sender and the recipient use
the same key
Asymmetric encryption is when both a public and a private key
are used
Transport Layer Security (TLS) is a protocol for transactions on
the Web that uses a combination of public key and symmetric
key encryption
HTTPS is a the secure version of HTTP
A Digital signature is a means to authenticate online messages;
implemented with public keys
A Message digest is unique fingerprint of file
Digital certificates are computer files that associate one’s
identity with one’s public key
Issued by certificate authority
Certificate authority (CA) is a trusted third party
A digital certificate contains its holder’s name, a serial number,
its expiration dates, and a copy of holder’s public key
Also contains the digital signature of the CA
The downside of security measures are:
For Single sign-on (SSO) a user must enter his or her
name/password only once
Single sign-on saves employees time
Encryption slows down communication
Every message must be encrypted and then decrypted
IT specialists must clearly explain the implications of security
measures to upper management
Recovery Measures
Security measures may reduce mishaps, but no one can control
all disasters
Preparation for uncontrolled disasters requires that recovery

measures are in place
Redundancy may be used
Very expensive, especially in distributed systems
Other measures must be taken
9
9
Security measures may reduce mishaps, but no one can control
all disasters
Recovery measures are preparation for uncontrolled disasters
that require recovery of data and information.
Redundancy may be used
It is Very expensive, especially in distributed systems
Other measures must be taken
A Business recovery plan is a detailed plan about what should
be done and by whom if critical systems go down
Also called a disaster recovery plan, business resumption plan,
or business continuity plan
To develop a business recovery plan
Obtain management’s commitment to the plan
Establish a planning committee
Perform risk assessment and impact analysis
Prioritize recovery needs
Mission-critical applications: those without which the business
cannot conduct operations
Select a recovery plan
Select vendors
Develop and implement the plan
Test the plan
Continually test and evaluate
Can outsource recovery plans to firms that specialize in disaster
recover planning
Hot sites are alternative sites that a business can use when a
disaster occurs

Backup sites provide desks, computer systems, and Internet
links
Companies that implement hot sites
IBM
Hewlett-Packard
SunGard Availability Services

Week 8 Lecture 1 - Key PointsManagement of Information Systems.docx

More Related Content

Similar to Week 8 Lecture 1 - Key PointsManagement of Information Systems.docx

More from helzerpatrina

Recently uploaded

Week 8 Lecture 1 - Key PointsManagement of Information Systems.docx