Objectives
What key trade-offs and ethical issues are
Ethics in Information
Technology, Second Edition
Chapter 3
Computer and Internet Crime
Objectives (continued)
What are some characteristics of common computer
criminals, including their objectives, available
resources, willingness to accept risk, and frequency
of attack?
What are the key elements of a multilayer process
for managing security vulnerabilities, based on the
concept of reasonable assurance?
What actions must be taken in response to a security
incident?
Ethics in Information Technology, Second Edition
associated with the safeguarding of data and
information systems?
Why has there been a dramatic increase in the
number of computer-related security incidents in
recent years?
What are the most common types of computer
security attacks?
Ethics in Information Technology, Second Edition 2
IT Security Incidents: A Worsening
Problem
Security of information technology is of utmost
importance
Protect confidential data
Safeguard private customer and employee data
Protect against malicious acts of theft or disruption
Must be balanced against other business needs and
issues
Number of IT-related security incidents is
increasing around the world
3 Ethics in Information Technology, Second Edition 4
 IT Security Incidents: A Worsening
Problem (continued)
Computer Emergency Response Team
Coordination Center (CERT/CC)
Established in 1988 at the Software Engineering
Institute (SEI)
Charged with
Coordinating communication among experts
during computer security emergencies
Helping to prevent future incidents
Ethics in Information Technology, Second Edition
Higher Computer User Expectations
Computer help desks
Under intense pressure to provide fast responses to
users questions
Sometimes forget to
Verify users identities
Check whether users are authorized to perform
the requested action
Computer users share login IDs and passwords
Ethics in Information Technology, Second Edition
Increasing Complexity Increases
Vulnerability
Computing environment is enormously complex
Continues to increase in complexity
Number of possible entry points to a network
expands continuously
5 Ethics in Information Technology, Second Edition 6
Expanding and Changing Systems
Introduce New Risks
Network era
Personal computers connect to networks with
millions of other computers
All capable of sharing information
Information technology
Ubiquitous
Necessary tool for organizations to achieve goals
Increasingly difficult to keep up with the pace of
technological change
7 Ethics in Information Technology, Second Edition 8
 Increased Reliance on Commercial
Increased Reliance on Commercial
Software with Known Vulnerabilities
Software with Known Vulnerabilities
(continued)
Exploit Zero-day attack
Attack on information system Takes place before a vulnerability is discovered or
Takes advantage of a particular system vulnerability fixed
Due to poor system design or implementation U.S. companies rely on commercial software with
Patch known vulnerabilities
Fix to eliminate the problem
Users are responsible for obtaining and installing
patches
Delays in installing patches expose users to security
breaches

Ethics in Information Technology, Second Edition 9 Ethics in Information Technology, Second Edition 10

Number of Vulnerabilities Reported to

Types of Attacks
CERT/CC
Most frequent attack is on a networked computer
from an outside source
Types of attacks
Virus
Worm
Trojan horse
Denial of service

Ethics in Information Technology, Second Edition 11 Ethics in Information Technology, Second Edition 12
 Viruses Viruses (continued)

Pieces of programming code Does not spread itself from computer to computer
Usually disguised as something else Must be passed on to other users through
Cause unexpected and usually undesirable events Infected e-mail document attachments
Often attached to files Programs on diskettes
Deliver a payload Shared files
Macro viruses
Most common and easily created viruses
Created in an application macro language
Infect documents and templates

Ethics in Information Technology, Second Edition 13 Ethics in Information Technology, Second Edition 14

Worms Cost Impact of Worms

Harmful programs
Reside in active memory of a computer
Duplicate themselves
Can propagate without human intervention
Negative impact of virus or worm attack
Lost data and programs
Lost productivity
Effort for IT workers

Ethics in Information Technology, Second Edition 15 Ethics in Information Technology, Second Edition 16
 Trojan Horses
Program that a hacker secretly installs
Users are tricked into installing it
Logic bomb
Executes under specific conditions
Ethics in Information Technology, Second Edition
Denial-of-Service (DoS) Attacks
(continued)
Ingress filtering - When Internet service providers
(ISPs) prevent incoming packets with false IP
addresses from being passed on
Egress filtering - Ensuring spoofed packets dont
leave a network
Ethics in Information Technology, Second Edition
Denial-of-Service (DoS) Attacks
Malicious hacker takes over computers on the
Internet and causes them to flood a target site with
demands for data and other small tasks
The computers that are taken over are called
zombies
Does not involve a break-in at the target computer
Target machine is busy responding to a stream of
automated requests
Legitimate users cannot get in
Spoofing generates a false return address on
packets
17 Ethics in Information Technology, Second Edition 18
Perpetrators
Motives are the same as other criminals
Different objectives and access to varying
resources
Different levels of risk to accomplish an objective
19 Ethics in Information Technology, Second Edition 20
 Classifying Perpetrators of Computer
Crime Hackers and Crackers

Hackers
Test limitations of systems out of intellectual curiosity
Crackers
Cracking is a form of hacking
Clearly criminal activity

Ethics in Information Technology, Second Edition 21 Ethics in Information Technology, Second Edition 22

Malicious Insiders Industrial Spies

Top security concern for companies Illegally obtain trade secrets from competitors
Estimated 85 percent of all fraud is committed by Trade secrets are protected by the Economic
employees Espionage Act of 1996
Usually due to weaknesses in internal control Competitive intelligence
procedures
Uses legal techniques
Collusion is cooperation between an employee and
an outsider Gathers information available to the public
Insiders are not necessarily employees Industrial espionage
Can also be consultants and contractors Uses illegal means
Extremely difficult to detect or stop Obtains information not available to the public
Authorized to access the very systems they abuse
Ethics in Information Technology, Second Edition 23 Ethics in Information Technology, Second Edition 24
 Cybercriminals Cybercriminals (continued)
Hack into corporate computers and steal Smart cards
Engage in all forms of computer fraud Contain a memory chip
Chargebacks are disputed transactions Are updated with encrypted data every time the card
Loss of customer trust has more impact than fraud is used
To reduce the potential for online credit card fraud Used widely in Europe
sites: Not widely used in the U.S.
Use encryption technology
Verify the address submitted online against the
issuing bank
Request a card verification value (CVV)
Use transaction-risk scoring software
Ethics in Information Technology, Second Edition 25 Ethics in Information Technology, Second Edition 26

Legal Overview:
The Check Clearing for the 21st Cyberterrorists
Century Act
Intimidate or coerce governments to advance
Requires that banks accept paper documents
political or social objectives
In lieu of original paper checks
Launch computer-based attacks
Speeds clearing of checks
Seek to cause harm
New opportunities for check fraud
Rather than gather information
Bankers dont fully realize the extent of possible
increased fraud Many experts believe terrorist groups pose only a
limited threat to information systems

Ethics in Information Technology, Second Edition 27 Ethics in Information Technology, Second Edition 28
 Reducing Vulnerabilities Risk Assessment

Security Organizations review of:

Combination of technology, policy, and people Potential threats to computers and network
Requires a wide range of activities to be effective Probability of threats occurring
Assess threats to an organizations computers and Identify investments that can best protect an
network organization from the most likely and serious
Identify actions that address the most serious threats
vulnerabilities Reasonable assurance
Educate users Improve security in areas with:
Monitor to detect a possible intrusion Highest estimated cost
Create a clear reaction plan Poorest level of protection
Ethics in Information Technology, Second Edition 29 Ethics in Information Technology, Second Edition 30

Risk Assessment for a Hypothetical

Establishing a Security Policy
Company
A security policy defines
Organizations security requirements
Controls and sanctions needed to meet the
requirements
Delineates responsibilities and expected behavior
Outlines what needs to be done
Not how to do it
Automated system policies should mirror written
policies

Ethics in Information Technology, Second Edition 31 Ethics in Information Technology, Second Edition 32
 Establishing a Security Policy Educating Employees, Contractors,
(continued) and Part-Time Workers
Trade-off between Educate users about the importance of security
Ease of use Motivate them to understand and follow security
Increased security policy
Areas of concern Discuss recent security incidents that affected the
E-mail attachments organization
Wireless devices Help protect information systems by:
VPN uses the Internet to relay communications but Guarding passwords
maintains privacy through security features
Not allowing others to use passwords
Additional security includes encrypting originating
and receiving network addresses Applying strict access controls to protect data
Reporting all unusual activity
Ethics in Information Technology, Second Edition 33 Ethics in Information Technology, Second Edition 34

Prevention Firewall Protection

Implement a layered security solution
Make computer break-ins harder
Firewall
Limits network access
Antivirus software
Scans for a specific sequence of bytes
Known as the virus signature
Norton Antivirus
Dr. Solomons Antivirus from McAfee

Ethics in Information Technology, Second Edition 35 Ethics in Information Technology, Second Edition 36
Popular Firewall Software for Personal
Prevention (continued)
Computers
Antivirus software
Continually updated with the latest virus detection
information
Called definitions
Departing employees
Promptly delete computer accounts, login IDs, and
passwords
Carefully define employee roles
Create roles and user accounts

Ethics in Information Technology, Second Edition 37 Ethics in Information Technology, Second Edition 38

Prevention (continued) Detection

Keep track of well-known vulnerabilities Detection systems

SANS (System Administration, Networking, and Catch intruders in the act
Security) Institute Intrusion detection system
CERT/CC Monitors system and network resources and
Back up critical applications and data regularly activities
Perform a security audit Notifies the proper authority when it identifies
Possible intrusions from outside the organization
Misuse from within the organization
Knowledge-based approach
Behavior-based approach
Ethics in Information Technology, Second Edition 39 Ethics in Information Technology, Second Edition 40
 Detection (continued) Detection (continued)

Intrusion prevention systems (IPSs) Honeypot

Prevent attacks by blocking Provides would-be hackers with fake information
Viruses about the network
Malformed packets Decoy server
Other threats Well-isolated from the rest of the network
Sits directly behind the firewall Can extensively log activities of intruders

Ethics in Information Technology, Second Edition 41 Ethics in Information Technology, Second Edition 42

Response Response (continued)

Response plan Incident notification defines

Develop well in advance of any incident Who to notify
Approved by Who not to notify
Legal department Security experts recommend against releasing
Senior management specific information about a security compromise in
Primary goals public forums
Regain control Document all details of a security incident
Limit damage All system events
Specific actions taken
All external conversations
Ethics in Information Technology, Second Edition 43 Ethics in Information Technology, Second Edition 44
 Response (continued) Response (continued)
Act quickly to contain an attack Review
Eradication effort Determine exactly what happened
Collect and log all possible criminal evidence from Evaluate how the organization responded
the system
Capture the perpetrator
Verify necessary backups are current and complete
Consider the potential for negative publicity
Create new backups
Legal precedent
Follow-up
Hold organizations accountable for their own IT
Determine how security was compromised
security weaknesses
Prevent it from happening again

Ethics in Information Technology, Second Edition 45 Ethics in Information Technology, Second Edition 46

Summary Summary (continued)

Ethical decisions regarding IT security include Perpetrators include:

determining which information systems and data Hackers
most need protection Crackers
65-fold increase in the number of reported IT Industrial spies
security incidents from 1997 to 2003 Cybercriminals
Most incidents involve a: Cyberterrorists
Virus
Worm
Trojan horse
Denial-of-service
Ethics in Information Technology, Second Edition 47 Ethics in Information Technology, Second Edition 48
 Summary (continued)
Key elements of a multilayer process for managing
security vulnerabilities include:
Assessment
User education
Response plan

Ethics in Information Technology, Second Edition 49