1 pertemuan 4 identifying and risks in e-business matakuliah: >/ > tahun: > versi: >

1

Pertemuan 4Identifying and Risks in e-Business

Matakuliah : <<Kode>>/<<Nama mtkul>>

Tahun : <<Tahun Pembuatan>>

Versi : <<versi/revisi>>

2

Learning Outcomes

Pada akhir pertemuan, diharapkan mahasiswa

akan mampu :

• Menjelaskan apa yang dimaksud dengan Risks dalam suatu lingkungan e-Business (TIK-4)

• Menjelaskan area yang vulnerable dalam lingkungan e-Business (TIK-4)

• Menjelaskan jenis-jenis resiko (TIK-4)

3

Outline Materi

• Materi 1 Risks dalam suatu lingkungan e-Business

• Materi 2 Area yang vulnerable dalam lingkungan e-Business

• Materi 3 Jenis-jenis resiko

4

Chapter 4

Identifying and Managing the Risks of E-Business

5

Risk-risk is the likelihood that an unwanted or injurious event will occur.

From an investor’s standpoint, risk is usually associated with a reward, called a risk premium.As the risk of an investment increases, the the potential for favorable returns on the investment also increases.

E-Business may mitigate some risks, but it heightens other risks and even introduces new ones.

6

Risk in E-Business stems primarily from an organizations information systems and the way these systems interact with external parties.

“Internet Time” –the concept that business cycles and competitive threats are greatly accelerated has impacted risk for E-Business.

7

Deloitte and Touche’s common risk-increasing characteristics of firms engaged in E-Business

Rapid GrowthMergers and AcquisitionsFormations of new partnershipsIPOs (Initial public offerings)Upgrading/Installing new technologyTaking new products to marketComplex information systemsChanges in managementRegulatory compliance difficultiesIncreasingly complex business models and processes

8

Categories of E-Business Risk

IT Infrastructure VulnerabilitiesFalsified IdentityCompromised PrivacyDestructive or Malicious Code

Human Factors

Systems Interdependencies

9

Infrastructure Vulnerabilities—weaknesses in the hardware, software and processes that allow day-to-day operations to be carried out

Denial-of-service attacksOther Service interruptions

PhysicalDesignOperationsEnvironmentalReconfiguration

Data TheftSniffingUnauthorized access to passwords

10

Controlling risks associated with Infrastructure Software-based security

FirewallsIntrusion detectionScanners or security probesSecurity suites

EncryptionPhysical ControlsPassword selection and change

11

Controlling risks associated with Infrastructure vulnerabilities

Disaster Recovery PlanFlying start

Shadow modeCold siteHot site

12

Falsified Identity-for an electronic transaction to take place, each party to the transaction needs to be confident that the claimed identity of the other party is authentic

Email spoofingIP spoofingCustomer impersonationFalse Web sitesEmail or web-visit hijacking

13

Controlling the risks associated with falsified identity

Digital Signatures and Certificates

Biometrics

14

Compromised Privacy—one of the biggest concerns of consumers who shop on the Internet is over privacy and security

Privacy policies

Cookies

15

Controlling the risks associated with compromised privacy

Cookie Screening

Effective privacy policies

16

Destructive Codes and Programs

VirusesMacroBootFileTrojan Horse

17

Controlling the risks associated with destructive codes and programs

18

Human Factors in E-Business

People-the weak link

Responsible personnel

Action plan for breach of security

19

System Interdependencies

20

Anticipating and Managing E-Business Risk

Emergent risks—threats that have yet to be identified

21

E-Commerce Security

Prentice-Hall

22

Learning Objectives

1. Document the rapid rise in computer and network security attacks.

2. Describe the common security practices of businesses of all sizes.

3. Understand the basic elements of EC security.

4. Explain the basic types of network security attacks.

23

Learning Objectives (cont.)

5. Describe common mistakes that organizations make in managing security.

6. Discuss some of the major technologies for securing EC communications.

7. Detail some of the major technologies for securing EC networks components.

24

Brute Force Credit Card Attack Story

• The Problem– Spitfire Novelties usually generates between 5

and 30 transactions per day– On September 12, 2002 in a “brute force” credit

card attack, Spitfire’s credit card transaction processor processed 140,000 fake credit card charges worth $5.07 each (62,000 were approved)

25

Brute Force Credit Card Attack (cont.)

– The total value of the approved charges was around $300,000

– Spitfire found out about the transactions only when they were called by one of the credit card owners who had been checking his statement online and had noticed the $5.07 charge

26


– Brute force credit card attacks require minimal skill

– Hackers run thousands of small charges through merchant accounts, picking numbers at random

– When the perpetrator finds a valid credit card number it can then be sold on the black market

– Some modern-day black markets are actually member-only Web sites like carderplanet.com, shadowcrew.com, and counterfeitlibrary.com

27


– Relies on a perpetrator’s ability to pose as a merchant requesting authorization for a credit card purchase requiring

• A merchant ID• A password• Both

28


– Online Data’s credit card processing services, all a perpetrator needed was a merchant’s password in order to request authorization

– Online Data is a reseller of VeriSign Inc. credit card gateway services

• VeriSign blamed Online Data for the incident• Online Data blamed Spitfire for not changing their

initial starter password

29

Brute Force Credit Card Attack Story (cont.)

• In April 2002 hackers got into the Authorize.Net card processing system (largest gateway payment system on the Internet)– Executed 13,000 credit card transactions, of

which 7,000 succeeded – Entry into the Authorize.Net system required only

a log-on name, not a password

30

Brute Force Solution

– Online Data should assign strong passwords at the start

– Customers should modify those passwords frequently

– Authorization services such as VeriSign and Authorize.Net should have built-in safeguards that recognize brute force attacks

31

Brute Force Credit Card Solution (cont.)

– Signals that something is amiss:• A merchant issues an extraordinary number

of requests • Repeated requests for small amounts

emanating from the same merchants

32


• The Results– VeriSign halted the transactions before

they were settled, saving Spitfire $316,000 in charges

– Authorize.Net merchants were charged $0.35 for each transaction

– The criminals acquired thousands of valid credit card numbers to sell on the black market

33


• What we can learn…– Any type of EC involves a number of

players who use a variety of network and application services that provide access to a variety of data sources

– A perpetrator needs only a single weakness in order to attack a system

34

Brute Force What We Can Learn

– Some attacks require sophisticated techniques and technologies

– Most attacks are not sophisticated; standard security risk management procedures can be used to minimize their probability and impact

35

Accelerating Need forE-Commerce Security

• Annual survey conducted by the Computer Security Institute and the FBI

1. Organizations continue to experience cyber attacks from inside and outside of the organization

36

Accelerating Need forE-Commerce Security (cont.)

2. The types of cyber attacks that organizations experience were varied

3. The financial losses from a cyber attack can be substantial

4. It takes more than one type of technology to defend against cyber attacks

37


• National Infrastructure Protection Center (NIPC): A joint partnership, under the auspices of the FBI, among governmental and private industry; designed to prevent and protect the nation’s infrastructure

38


• Computer Emergency Response Team (CERT): Group of three teams at Carnegie Mellon University that monitors incidence of cyber attacks, analyze vulnerabilities, and provide guidance on protecting against attacks

39


• According to the statistics reported to CERT/CC over the past year (CERT/CC 2002)– The number of cyber attacks skyrocketed

from approximately 22,000 in 2000 to over 82,000 in 2002

– First quarter of 2003 the number was already over 43,000

40

Security Is Everyone’s Business

• Security practices of organizations of various sizes– Small organizations (10 to 100 computers)

• The “haves” are centrally organized, devote a sizeable percentage of their IT budgets to security

• The “have-nots” are basically clueless when it comes to IT security

41

Security Is Everyone’s Business (cont.)

– Medium organizations (100 to 1,000 computers)

• Rarely rely on managerial policies in making security decisions, and they have little managerial support for their IT policies

• The staff they do have is poorly educated and poorly trained—overall exposure to cyber attacks and intrusion is substantially greater than in smaller organizations

42


– Large organizations (1,000 to 10,000 computers)

• Complex infrastructures and substantial exposure on the Internet

• While aggregate IT security expenditures are fairly large, their security expenditures per employee are low

43


– Larger organizations• IT security is part-time and undertrained—sizeable

percentage of the large organizations suffer loss or damage due to incidents

• Base their security decisions on organizational policies

44


– Very large organizations (more than 10,000 computers)

• extremely complex environments that are difficult to manage even with a larger staff

• rely on managerial policies in making IT security decisions

• only a small percentage have a well-coordinated incident response plan

45

Security Issues

• From the user’s perspective:– Is the Web server owned and operated by

a legitimate company?– Does the Web page and form contain some

malicious or dangerous code or content?– Will the Web server distribute

unauthorized information the user provides to some other party?

46

Security Issues (cont.)

• From the company’s perspective:– Will the user not attempt to break into the

Web server or alter the pages and content at the site?

– Will the user will try to disrupt the server so that it isn’t available to others?

47


• From both parties’ perspectives:– Is the network connection free from

eavesdropping by a third party “listening” on the line?

– Has the information sent back and forth between the server and the user’s browser been altered?

48

Security Requirements

• Authentication: The process by which one entity verifies that another entity is who they claim to be

• Authorization: The process that ensures that a person has the right to access certain resources

49

Security Requirements (cont.)

• Auditing: The process of collecting information about attempts to access particular resources, use particular privileges, or perform other security actions

50


• Confidentiality: Keeping private or sensitive information from being disclosed to unauthorized individuals, entities, or processes

51


• Integrity: As applied to data, the ability to protect data from being altered or destroyed in an unauthorized or accidental manner

52


• Nonrepudiation: The ability to limit parties from refuting that a legitimate transaction took place, usually by means of a signature

53

Types of Threats and Attacks

• Nontechnical attack: An attack that uses chicanery to trick people into revealing sensitive information or performing actions that compromise the security of a network

54

Types of Threats and Attacks (cont.)

55


• Social engineering: A type of nontechnical attack that uses social pressures to trick computer users into compromising computer networks to which those individuals have access

56


• Multiprong approach used to combat social engineering:

1. Education and training

2. Policies and procedures

3. Penetration testing

57


• Technical attack: An attack perpetrated using software and systems knowledge or expertise

58


• Common (security) vulnerabilities and exposures (CVEs): Publicly known computer security risks, which are collected, listed, and shared by a board of security-related organizations (cve.mitre.org)

59


• Denial-of-service (DoS) attack: An attack on a Web site in which an attacker uses specialized software to send a flood of data packets to the target computer with the aim of overloading its resources

60


• Distributed denial-of-service (DDoS) attack: A denial-of-service attack in which the attacker gains illegal administrative access to as many computers on the Internet as possible and uses these multiple computers to send a flood of data packets to the target computer

61


62


• Malware: A generic term for malicious software– The severity of the viruses increased

substantially, requiring much more time and money to recover

– 85% of survey respondents said that their organizations had been the victims of e-mail viruses in 2002

63


– Malicious code takes a variety of forms—both pure and hybrid

• Virus: A piece of software code that inserts itself into a host, including the operating systems, to propagate; it requires that its host program be run to activate it

64


– Worm: A software program that runs independently, consuming the resources of its host in order to maintain itself and is capable of propagating a complete working version of itself onto another machine

65


– Macro virus or macro worm: A virus or worm that is executed when the application object that contains the macro is opened or a particular procedure is executed

66


– Trojan horse: A program that appears to have a useful function but that contains a hidden function that presents a security risk

67

Managing EC Security

• Common mistakes in managing their security risks (McConnell 2002):– Undervalued information– Narrowly defined security boundaries– Reactive security management– Dated security management processes– Lack of communication about security

responsibilities

68

Managing EC Security (cont.)

• Security risk management: A systematic process for determining the likelihood of various security attacks and for identifying the actions needed to prevent or mitigate those attacks

69


• Phases of security risk management– Assessment– Planning– Implementation– Monitoring

70


• Phase 1: Assessment– Evaluate security risks by determining

assets, vulnerabilities of their system, and potential threats to these vulnerabilities

71

– Honeynet: A way to evaluate vulnerabilities of an organization by studying the types of attacks to which a site is subjected, using a network of systems called honeypots

– Honeypots: Production systems (e.g., firewalls, routers, Web servers, database servers) designed to do real work but to be watched and studied as network intrusions occur

72


• Phase 2: Planning– Goal of this phase is to arrive at a set of

policies defining which threats are tolerable and which are not

– Policies also specify the general measures to be taken against those threats that are intolerable or high priority

73


• Phase 3: Implementation– Particular technologies are chosen to

counter high-priority threats– First step is to select generic types of

technology for each of the high priority threats

74


• Phase 4: Monitoring to determine– Which measures are successful– Which measures are unsuccessful and need

modification– Whether there are any new types of threats– Whether there have been advances or changes in

technology– Whether there are any new business assets that

need to be secured

75


• Methods of securing EC– Authentication system– Access control mechanism– Passive tokens– Active tokens

76

Authentication

• Authentication system: System that identifies the legitimate parties to a transaction, determines the actions they are allowed to perform, and limits their actions to only those that are necessary to initiate and complete the transaction

77

Authentication (cont.)

• Access control mechanism: Mechanism that limits the actions that can be performed by an authenticated person or group

78


• Passive tokens: Storage devices (e.g., magnetic strips) used in a two-factor authentication system that contain a secret code

79


• Active tokens: Small, stand-alone electronic devices in a two factor authentication system that generate one-time passwords

80

Biometric Controls

• Biometric systems: Authentication systems that identify a person by measurement of a biological characteristic such as a fingerprint, iris (eye) pattern, facial features, or voice

81

Biometric Controls (cont.)

• Physiological biometrics: Measurements derived directly from different parts of the body (e.g., fingerprints, iris, hand, facial characteristics)

• Behavioral biometrics: Measurements derived from various actions and indirectly from various body parts (e.g., voice scans or keystroke monitoring)

82


• Fingerprint scanning: Measurement of the discontinuities of a person’s fingerprint, converted to a set of numbers that are stored as a template and used to authenticate identity

• Iris scanning: Measurement of the unique spots in the iris (colored part of the eye), converted to a set of numbers that are stored as a template and used to authenticate identity

83


• Voice scanning: Measurement of the acoustical patterns in speech production, converted to a set of numbers that are stored as a template and used to authenticate identity

84


• Keystroke monitoring: Measurement of the pressure, speed, and rhythm with which a word is typed, converted to a set of numbers that are stored as a template and used to authenticate identity; this biometric is still under development

85

Encryption Methods

• Public key infrastructure (PKI): A scheme for securing e-payments using public key encryption and various technical components

86

Encryption Methods (cont.)

• Private and public key encryption– Encryption: The process of scrambling

(encrypting) a message in such a way that it is difficult, expensive, or time-consuming for an unauthorized person to unscramble (decrypt) it

87


– Plaintext: An unencrypted message in human-readable form

– Ciphertext: A plaintext message after it has been encrypted into a machine-readable form

– Encryption algorithm: The mathematical formula used to encrypt the plaintext into the ciphertext, and vice versa

88


• Symmetric (private) key system– Key: The secret code used to encrypt and

decrypt a message– Symmetric (private) key system: An

encryption system that uses the same key to encrypt and decrypt the message

89


– Data Encryption Standard (DES): The standard symmetric encryption algorithm supported the NIST and used by U.S. government agencies until October 2, 2000

– Rijndael: The new Advanced Encryption Standard used to secure U.S. government communications since October 2, 2000

90


91

Elements of PKI

• Digital signature: An identifying code that can be used to authenticate the identity of the sender of a document– Portable– Cannot be easily repudiated or imitated,

and can be time-stamped

92

Elements of PKI (cont.)

93


• Digital signatures include:– Hash: A mathematical computation that is applied

to a message, using a private key, to encrypt the message

– Message digest: A summary of a message, converted into a string of digits, after the hash has been applied

– Digital envelope: The combination of the encrypted original message and the digital signature, using the recipient’s public key

94


• Digital certificate: Verification that the holder of a public or private key is who they claim to be

• Certificate authorities (CAs): Third parties that issue digital certificates

95

Security Protocols

• Secure Socket Layer (SSL): Protocol that utilizes standard certificates for authentication and data encryption to ensure privacy or confidentiality

• Transport Layer Security (TLS): As of 1996, another name for the SSL protocol

96

Security Protocols (cont.)

• Secure Electronic Transaction (SET): A protocol designed to provide secure online credit card transactions for both consumers and merchants; developed jointly by Netscape, Visa, MasterCard, and others

97

Securing EC Networks

• Technologies for organizational networks– Firewall: A network node consisting of both

hardware and software that isolates a private network from a public network

– Packet-filtering routers: Firewalls that filter data and requests moving from the public Internet to a private network based on the network addresses of the computer sending or receiving the request

98

Securing EC Networks (cont.)

– Packet filters: Rules that can accept or reject incoming packets based on source and destination addresses and the other identifying information

– Application-level proxy: A firewall that permits requests for Web pages to move from the public Internet to the private network

99


– Bastion gateway: A special hardware server that utilizes application-level proxy software to limit the types of requests that can be passed to an organization’s internal networks from the public Internet

– Proxies: Special software programs that run on the gateway server and pass repackaged packets from one network to the other

100


101


• Personal firewalls:Personal firewall: A network node designed to protect an individual user’s desktop system from the public network by monitoring all the traffic that passes through the computer’s network interface card

102


• VPNsVirtual private network (VPN): A network that uses the public Internet to carry information but remains private by using encryption to scramble the communications, authentication to ensure that information has not been tampered with, and access control to verify the identity of anyone using the network

103


– Protocol tunneling: Method used to ensure confidentiality and integrity of data transmitted over the Internet, by encrypting data packets, sending them in packets across the Internet, and decrypting them at the destination address

104


• Intrusion detection systems (IDSs): A special category of software that can monitor activity across a network or on a host computer, watch for suspicious activity, and take automated action based on what it sees

105


• Network-based IDS uses rules to analyze suspicious activity at the perimeter of a network or at key locations in the network

• Consists of a monitor—a software package that scans the software agents that reside on various host computers and feed information back to the monitor

PHYSICAL SECURITYDOMAIN

Objectives

To address the threats, vulnerabilities, and countermeasures which can be utilized to physically protect an enterprise’s resources and sensitive information to include people, facilities, data, equipment, support systems, media, and supplies.

To discuss considerations for choosing a secure site, its design and configuration, and the methods for securing the facility against unauthorized access, theft of equipment and information, and the environmental and safety measures needed to protect people, the facility, and its resources.

Topics to Be Covered

• Physical Security Threats

• Site Design and Configuration

• Physical Security Requirements– For Centralized Computing Facilities– For Distributed Processing Facilities– For Extended Processing

References Used

• Handbook of Information Security Management 1999 - Krause & Tipton

• Computer Security Handbook, Third Edition - Hutt, Bosworth & Hoyt

• (ISC)2 CBK Review Materials• An Introduction to Computer Security: The

NIST Handbook

What Does Physical Security Include?

• Physical Access Controls– Guards– Fences– Barriers– Lighting– Keys and Locks– Badges– Escorts– Property Controls– Monitoring/Detection Systems

What Else Does Physical Security Cover?

• Environmental Protection– Power Protection– HVAC– Water Protection– Fire Detection– Fire Suppression– Evacuation– Environmental Monitoring/Detection

Physical Security Threats

• Threat Components– Agents

– Motives

– Results

• External Threats– Wind/Tornado

– Flooding

– Lightning

– Earthquake

– Cold and Ice

– Fire

– Chemical

Threat Identification (continued)

• Internal Physical Threats– Fire

– Environmental Failure

– Liquid Leakage

– Electrical Interruption

• Human Threats– Theft

– Vandalism

– Sabotage

– Espionage

– Errors

Site Design & Configuration Considerations

• Location and Access– Local Crime– Visibility– Emergency Access– Natural Hazards– Air and Surface Traffic– Joint Tenants– Stable Power Supply– Existing Boundary Protection

(Barriers/Fencing/Gates)

Boundary Protection

• Area Designation: Facilitates Enforcement• Vehicular Access• Personnel Access

– Occupants– Visitors (Escort & Logging)

• Fences– Deter Casual Trespassing– Compliments Other Access Controls– Aesthetics– Won’t Stop Determined Intruder

Boundry Protection (continued)

• Lighting– Entrances– Parking Areas– Critical Areas

• Perimeter Detection Systems– Does Not Prevent Penetration– Alerts Response Force– Requires Response– Nuisance Alarms– Costly

Boundry Protection (continued)

• CCTV– Efficiency– Requires Human Response– Limitations

• Staffing– Access Control Points– Patrols– Employees

Computing Facility Requirements (continued)

• Walls– True Floor to Ceiling– Fire Rating (at least 1 hour)– Penetrations– Adjacent Areas

• Doors– Interior/Exterior– Hinges– Fire Rating– Alarms– Monitoring


• Windows/Openings– Interior/Exterior– Fixed– Shatterproof

• Computer and Equipment Room Lay Out– Equipment Access– Storage– Occupied Areas– Water Sources– Cable Routing


• Electrical Power– Definitions:

• Blackout - Loss of Power• Brownout - Prolonged Period of Below Normal Voltage• Noise - Random Disturbance that Interferes with a

Device• Sag - Short Period of Low Voltage• Spike - Momentary High Voltage• Surge - Prolonged High Voltage• Transient - Line Noise/Disturbance at Normal Voltage


– Dedicated Circuits– Controlled Access to:

• Power Distribution Panels• Master Circuit Breakers• Transformers• Feeder Cables

– Emergency Power Off Controls– Voltage Monitoring/Recording– Surge Protection


– Backup Power• Alternate Feeders• Uninterruptible Power Supply

– Hydrogen Gas Hazard– Maintenance/Testing

• Emergency Power Generator– Fuel Consideration– Maintenance/Testing– Costs


• Backup Power Requirements– Lighting– Physical Access Control Systems– Fire Protection Systems– Computing Equipment

• Mainframes

• Servers

• Workstations

– Communications Equipment– Telephone Systems– HVAC


• Air Conditioning– Dedicated– Controllable– Independent Power– Emergency Shut Off Controls– Positive Pressure– Protected Air Intakes– Monitoring


• Humidity Controls– Risk of Static Electricity– Risk to Electric Connections

• Air Quality (Dust)• Water Protection

– Falling Water– Rising Water– Drains– Protective Coverings– Moisture Detection Systems

Fire Prevention & Protection

• Fire Elements:– Fuel– Oxygen– Temperature

• Causes Of Computer Center Fires– #1: Electrical Distribution Systems– #2: Equipment

• Fire Classes– A: Common Compustibles (use Water/Soda Acid)– B: Liquid (CO2/Soda Acid/Halon)– C: Electrical (CO2/Halon)

Fire Prevention & Protection (continued)

• Temperatures When Damage Occurs– Paper Products: 350o

– Computer Equipment: 175o

– Disks: 150o

– Magnetic Media: 100o

• Fire Detection– Manual– Optical (Photoelectric-Smoke Blocking Light) – Temperature– Ionization (Reaction to Charged Particles in Smoke)

Fire Detection (continued)

– Detectors• On Ceilings• Above Suspended Ceilings• Beneath Raised Floors• Return Air Ducts• Cross-Zoning

– Alarms• Manual & Automated Activation• Visual & Audible Indication• Local & Remote Annunciation

Fire Suppression

• Portable Extinguishers– At Exits– Mark Locations and Type– Types A, B & C– Need to Inspect

• Water Sprinkler Systems– Works to Lower Temperature– Most Damaging to Equipment– Conventional Systems– “Dry Pipe” Systems: Less Risk of Leakage– Employ in Throughout Building and in all Spaces

Fire Suppression (continued)

• Carbon Dioxide (CO2)– Colorless/Odorless– Potentially Lethal– Removes Oxygen– Best for Unattended Facilities– Delayed-Activation in Manned Facilities

Fire Suppression (continued)

• Halon– Best Protection for Equipment

• Inside Equipment Cabinets/Vaults

• Special Areas

• Above Suspended Ceilings

• Under Raised Floors

– Concentrations <10% are Safe– Becomes Toxic at 900o

– Depletes Ozone (CFCs)– Montreal Protocol (1987)– Halon 1301: Requires Pressurization– Halon 1211: Self-Pressurization (Portable Extinguishers)

Fire Prevention & Protection (continued)

• Other Considerations– Training– Testing– National Fire Prevention Association (NFPA)

Standards– Local Fire Codes– Drainage

Securing Storage Areas

• Forms Storage Rooms– Increased Threat of Fire– Combustibles– Access Controls

• Media Storage Rooms– Media Sensitivity– Segregation– Access Controls– Environmental Controls

Media Protection

• Storage– Media Libraries/Special Rooms– Cabinets– Vaults

• Location– Operational– Off-Site

• Transportation

Protecting Wiring

• Optical Fiber

• Copper Wire

• Certifying the Wiring and Cabling

• Controlling Access to Closets and Riser Rooms

Other Considerations

• Dealing with Existing Facilities– Planning– Upgrade/Renovation– Incremental New Construction

• Protecting the Protection– Implement Physical and Environmental

Controls for Security Systems– Protect against both Intentional and

Inadvertent Threats

Personnel Access Controls

• Position Sensitivity Designation

• Management Review of Access Lists

• Background Screening/Re-Screening

• Termination/Transfer Controls

• Disgruntled Employees

Access Controls – Locks

• Preset Locks and Keys• Programmable Locks

– Mechanical (Cipher Locks)– Electronic (Keypad Systems): Digital Keyboard

• Number of Combinations

• Number of Digits in Code

• Frequency of Code Change

• Error Lock-Out

• Error Alarms

Access Controls - Tokens

• Security Card Systems– Dumb Cards

• Photo Identification Badges• Manual Visual Verification• Can be Combined with Smart Technology

– Digital Coded (Smart) Cards• Often Require Use of PIN Number with Card• Readers: Card Insertion, Card Swipe &

Proximity

Types of Access Cards

• Photo ID Cards• Optical Coded Cards (Magnetic Dot)• Electric Circuit Cards (Embedded Wire)• Magnetic Cards (Magnetic Particles)• Metallic Stripe Card (Copper Strips)

Access Controls - Biometrics

• Fingerprint/Thumbprint Scan• Blood Vein Pattern Scan

– Retina– Wrist– Hand

• Hand Geometry• Facial Recognition• Voice Verification• Keystroke Recorders• Problems

– Cost– Speed– Accuracy

Physical Security in Distributed Processing

• Threats– To Confidentiality

• Sharing Computers

• Sharing Diskettes

– To Availability• User Errors

– To Data Integrity• Malicious Code

• Version Control

Distributed Processing Physical Security Controls (continued)

• Office Area Controls– Entry Controls– Office Lay-Out– Personnel Controls– Hard-Copy Document Controls– Electronic Media Controls– Clean-Desk Policy

Office Area Physical Security Controls (continued)

– Printer/Output Controls– Property Controls– Space Protection Devices– Equipment Lock-Down


• Cable Locks

• Disk Locks

• Port Controls

• Power Switch Locks

• Keyboard Locks

• Cover Locks


• Isolated Power Source– Noise– Voltage Fluctuations– Power Outages

• Heat/Humidity Considerations• Fire/Water• Magnetic Media Controls

Extended Processing Physical Security Controls

• User Responsibilities Paramount– Protection against Disclosure

• Shoulder Surfing• Access to Sensitive Media and Written Material

– Integrity Protection– Protection against Loss or Theft

• Locks• Practices

• Management Responsibilities– Approval– Monitoring

Other Terms & Abbreviations

• Tailgate

• Piggy-Back

• Stay Behind

• Degauss

• Remanence

• Mantrap

• Pass-Back

• Dumpster Diving

• False Positive/Negative

• Montreal Protocol

• Duress Alarm

• Tamper Alarm

• Passive Ultrasonic

• Fail Safe/Fail Soft

• EPO

• IDS

• Shoulder Surfing

• Electronic Emanation

• Tsunami

• RFI

• Defense in Depth

• EMI

• Top Guard

QUESTIONS?

150

Managerial Issues

1. Have we budgeted enough for security?2. What are the business consequences of

poor security?3. Which e-commerce sites are vulnerable

to attack?

151

Managerial Issues (cont.)

4. What is the key to establishing strong e-commerce security?

5. What steps should businesses follow inestablishing a security plan?

6. Should organizations be concerned with internal security threats?

152

Summary

1. Increase in computer attacks.2. Security is everyone’s business.3. Basic security issues.4. Basic types of network security

attacks.5. Managing EC security.6. Securing EC communications.7. Technologies for securing networks

153

Summary

• Mahasiswa diwajibkan membuat summary

1 pertemuan 4 identifying and risks in e-business matakuliah: >/ > tahun: > versi: >

Documents