Download Ethical Computer Use Policy

Information Systems and
ETHICS
4-2
LEARNING OUTCOMES
1. Explain the ethical issues surrounding
information technology
2. Identify the differences between an ethical
computer use policy and an acceptable
computer use policy
3. Describe the relationship between an e-mail
privacy policy and an Internet use policy
4-3
LEARNING OUTCOMES
4. Explain the effects of spam on an
organization
5. Summarize the different monitoring
technologies and explain the importance
of an employee monitoring policy
4-4
ETHICS
• Ethics – the principles and standards that
guide our behavior toward other people
• Issues affected by technology advances
– Intellectual property
– Copyright
– Fair use doctrine
– Pirated software
– Counterfeit software
4-5
ETHICS
• Privacy is a major ethical issue
– Privacy – the right to be left alone when you
want to be, to have control over your own
personal possessions, and not to be
observed without your consent
– Confidentiality – the assurance that
messages and information are available only
to those who are authorized to view them
4-6
ETHICS
• One of the main ingredients in trust is privacy
• Primary reasons privacy issues lost trust for ebusiness
4-7
INFORMATION ETHICS
• Individuals form the only ethical component of IT
4-8
Information Has No Ethics
• Acting ethically and legally are not always
the same
4-9
Information Has No Ethics
• Information does not care how it is used
• Information will not stop itself from
sending spam, viruses, or highly-sensitive
information
• Information cannot delete or preserve
itself
4-10
DEVELOPING INFORMATION
MANAGEMENT POLICIES
• Organizations strive to build a corporate culture
based on ethical principles that employees can
understand and implement
• ePolicies typically include:
–
–
–
–
–
–
Ethical computer use policy
Information privacy policy
Acceptable use policy
E-mail privacy policy
Internet use policy
Anti-spam policy
4-11
Ethical Computer Use Policy
• Ethical computer use policy – contains
general principles to guide computer user
behavior
• The ethical computer user policy ensures
all users are informed of the rules and, by
agreeing to use the system on that basis,
consent to abide by the rules
4-12
Ethical Computer Use Policy
4-13
Information Privacy Policy
• The unethical use of information typically occurs
“unintentionally” when it is used for new
purposes
– For example, social security numbers started as a
way to identify government retirement benefits and
are now used as a sort of universal personal ID
• Information privacy policy - contains general
principles regarding information privacy
4-14
Information Privacy Policy
•
Information privacy policy guidelines
1. Adoption and implementation of a privacy
policy
2. Notice and disclosure
3. Choice and consent
4. Information security
5. Information quality and access
4-15
Acceptable Use Policy
• Acceptable use policy (AUP) – a policy that a
user must agree to follow in order to be
provided access to a network or to the Internet
• An AUP usually contains a nonrepudiation
clause
– Nonrepudiation – a contractual stipulation to ensure
that e-business participants do not deny (repudiate)
their online actions
4-16
Acceptable Use Policy
4-17
E-Mail Privacy Policy
• Organizations can mitigate the risks of email and instant messaging
communication tools by implementing and
adhering to an e-mail privacy policy
• E-mail privacy policy – details the extent
to which e-mail messages may be read by
others
4-18
E-Mail Privacy Policy
4-19
E-Mail Privacy Policy
4-20
Internet Use Policy
• Internet use policy – contains general principles to
guide the proper use of the Internet
4-21
Anti-Spam Policy
• Spam – unsolicited e-mail
• Spam accounts for 40% to 60% of most
organizations’ e-mail and cost U.S.
businesses over $14 billion in 2005
• Anti-spam policy – simply states that email users will not send unsolicited emails (or spam)
4-22
ETHICS IN THE WORKPLACE
• Workplace monitoring is a concern for many
employees
• Organizations can be held financially
responsible for their employees’ actions
• The dilemma surrounding employee monitoring
in the workplace is that an organization is
placing itself at risk if it fails to monitor its
employees, however, some people feel that
monitoring employees is unethical
4-23
Monitoring Technologies
4-24
Monitoring Technologies
• Monitoring – tracking people’s activities by
such measures as number of keystrokes, error
rate, and number of transactions processed
• Common monitoring technologies include:
–
–
–
–
–
–
–
Key logger or key trapper software
Hardware key logger
Cookie
Adware
Spyware
Web log
Clickstream
4-25
Employee Monitoring Policies
• Employee monitoring policies – explicitly state how,
when, and where the company monitors its employees
4-26
OPENING CASE QUESTIONS
Sarbanes-Oxley
1. Define the relationship between ethics
and the Sarbanes-Oxley Act
2. Why is records management an area of
concern for the entire organization and
not just the IT department?
3. Identify two policies an organization can
implement to achieve Sarbanes-Oxley
compliance?
4-27
OPENING CASE QUESTIONS
Sarbanes-Oxley
4. What ethical dilemmas are being solved
by implementing Sarbanes-Oxley?
5. What is the biggest roadblock for
organizations that are attempting to
achieve Sarbanes-Oxley compliance?
INFORMATION SYSTEM
and
SECURITY
4-29
LEARNING OUTCOMES
6. Describe the relationship between information
security policies and an information security plan
7. Summarize the five steps to creating an
information security plan
8. Provide an example of each of the three primary
security areas: (1) authentication and
authorization, (2) prevention and resistance, and
(3) detection and response
9. Describe the relationships and differences
between hackers and viruses
4-30
PROTECTING INTELLECTUAL ASSETS
• Organizational information is intellectual capital
- it must be protected
• Information security – the protection of
information from accidental or intentional
misuse by persons inside or outside an
organization
• E-business automatically creates tremendous
information security risks for organizations
4-31
PROTECTING INTELLECTUAL ASSETS
4-32
PROTECTING INTELLECTUAL ASSETS
4-33
THE FIRST LINE OF DEFENSE - PEOPLE
• Organizations must enable employees, customers,
and partners to access information electronically
• The biggest issue surrounding information security
is not a technical issue, but a people issue
• 33% of security incidents originate within the
organization
– Insiders – legitimate users who purposely or accidentally
misuse their access to the environment and cause some
kind of business-affecting incident
4-34
THE FIRST LINE OF DEFENSE - PEOPLE
• The first line of defense an organization
should follow to help combat insider issues
is to develop information security policies
and an information security plan
– Information security policies – identify the
rules required to maintain information security
– Information security plan – details how an
organization will implement the information
security policies
4-35
THE FIRST LINE OF DEFENSE - PEOPLE
•
Hackers frequently use “social engineering”
to obtain password
– Social engineering – using one’s social skills
to trick people into revealing access
credentials or other information valuable to the
attacker
4-36
THE FIRST LINE OF DEFENSE - PEOPLE
•
Five steps to creating an information
security plan:
1.
2.
3.
4.
5.
Develop the information security policies
Communicate the information security policies
Identify critical information assets and risks
Test and reevaluate risks
Obtain stakeholder support
4-37
THE FIRST LINE OF DEFENSE - PEOPLE
4-38
THE SECOND LINE OF DEFENSE TECHNOLOGY
•
There are three primary information
technology security areas
1. Authentication and authorization
2. Prevention and resistance
3. Detection and response
4-39
Authentication and Authorization
•
Authentication – a method for confirming users’
identities
•
Authorization – the process of giving someone
permission to do or have something
•
The most secure type of authentication
involves:
1. Something the user knows such as a user ID and
password
2. Something the user has such as a smart card or
token
3. Something that is part of the user such as a
fingerprint or voice signature
4-40
Something the User Knows Such As a User ID
and Password
•
This is the most common way to identify
individual users and typically contains a
user ID and a password
•
This is also the most ineffective form of
authentication
•
Over 50 percent of help-desk calls are
password related
4-41
Something the User Knows Such As a User ID
and Password
•
Identity theft – the forging of someone’s
identity for the purpose of fraud
•
Phishing – a technique to gain personal
information for the purpose of identity
theft, usually by means of fraudulent email
4-42
Something the User Knows Such As a User ID
and Password
4-43
Something the User Knows Such As a User ID
and Password
•
Smart cards and tokens are more
effective than a user ID and a password
– Tokens – small electronic devices that
change user passwords automatically
– Smart card – a device that is around the
same size as a credit card, containing
embedded technologies that can store
information and small amounts of software
to perform some limited processing
4-44
Something That Is Part Of The User Such As a
Fingerprint or Voice Signature
•
This is by far the best and most effective
way to manage authentication
– Biometrics – the identification of a user
based on a physical characteristic, such as
a fingerprint, iris, face, voice, or handwriting
•
Unfortunately, this method can be costly
and intrusive
4-45
Prevention and Resistance
•
Downtime can cost an organization
anywhere from $100 to $1 million per
hour
•
Technologies available to help prevent
and build resistance to attacks include:
1. Content filtering
2. Encryption
3. Firewalls
4-46
Content Filtering
•
Organizations can use content filtering
technologies to filter e-mail and prevent emails containing sensitive information from
transmitting and stop spam and viruses from
spreading.
–
–
–
Content filtering – occurs when organizations use
software that filters content to prevent the
transmission of unauthorized information
Spam – a form of unsolicited e-mail
Corporate losses caused by Spam
4-47
Encryption
•
If there is an information security breach
and the information was encrypted, the
person stealing the information would be
unable to read it
– Encryption – scrambles information into an
alternative form that requires a key or
password to decrypt the information
– Public key encryption (PKE) – an
encryption system that uses two keys: a
public key for everyone and a private key
for the recipient
4-48
Encryption
4-49
Firewalls
•
One of the most common defenses for
preventing a security breach is a firewall
– Firewall – hardware and/or software that
guards a private network by analyzing the
information leaving and entering the
network
4-50
Firewalls
•
Sample firewall architecture connecting
systems located in Chicago, New York,
and Boston
4-51
Detection and Response
•
If prevention and resistance strategies
fail and there is a security breach, an
organization can use detection and
response technologies to mitigate the
damage
•
Antivirus software is the most common
type of detection and response
technology
4-52
Detection and Response
•
Hacker - people very knowledgeable about
computers who use their knowledge to invade
other people’s computers
–
–
–
–
–
–
White-hat hacker
Black-hat hacker
Hactivist
Script kiddies or script bunnies
Cracker
Cyberterrorist
4-53
Detection and Response
•
Virus - software written with malicious
intent to cause annoyance or damage
–
–
–
–
–
–
Worm
Denial-of-service attack (DoS)
Distributed denial-of-service attack (DDoS)
Trojan-horse virus
Backdoor program
Polymorphic virus and worm
4-54
Detection and Response
• Security threats to e-business include:
– Elevation of privilege
– Hoaxes
– Malicious code
– Spoofing
– Spyware
– Sniffer
– Packet tampering