1 pertemuan 4 identifying and risks in e-business matakuliah: >/ > tahun: > versi: >
Post on 22-Dec-2015
215 Views
Preview:
TRANSCRIPT
1
Pertemuan 4Identifying and Risks in e-Business
Matakuliah : <<Kode>>/<<Nama mtkul>>
Tahun : <<Tahun Pembuatan>>
Versi : <<versi/revisi>>
2
Learning Outcomes
Pada akhir pertemuan, diharapkan mahasiswa
akan mampu :
• Menjelaskan apa yang dimaksud dengan Risks dalam suatu lingkungan e-Business (TIK-4)
• Menjelaskan area yang vulnerable dalam lingkungan e-Business (TIK-4)
• Menjelaskan jenis-jenis resiko (TIK-4)
3
Outline Materi
• Materi 1 Risks dalam suatu lingkungan e-Business
• Materi 2 Area yang vulnerable dalam lingkungan e-Business
• Materi 3 Jenis-jenis resiko
4
Chapter 4
Identifying and Managing the Risks of E-Business
5
Risk-risk is the likelihood that an unwanted or injurious event will occur.
From an investor’s standpoint, risk is usually associated with a reward, called a risk premium.As the risk of an investment increases, the the potential for favorable returns on the investment also increases.
E-Business may mitigate some risks, but it heightens other risks and even introduces new ones.
6
Risk in E-Business stems primarily from an organizations information systems and the way these systems interact with external parties.
“Internet Time” –the concept that business cycles and competitive threats are greatly accelerated has impacted risk for E-Business.
7
Deloitte and Touche’s common risk-increasing characteristics of firms engaged in E-Business
Rapid GrowthMergers and AcquisitionsFormations of new partnershipsIPOs (Initial public offerings)Upgrading/Installing new technologyTaking new products to marketComplex information systemsChanges in managementRegulatory compliance difficultiesIncreasingly complex business models and processes
8
Categories of E-Business Risk
IT Infrastructure VulnerabilitiesFalsified IdentityCompromised PrivacyDestructive or Malicious Code
Human Factors
Systems Interdependencies
9
Infrastructure Vulnerabilities—weaknesses in the hardware, software and processes that allow day-to-day operations to be carried out
Denial-of-service attacksOther Service interruptions
PhysicalDesignOperationsEnvironmentalReconfiguration
Data TheftSniffingUnauthorized access to passwords
10
Controlling risks associated with Infrastructure Software-based security
FirewallsIntrusion detectionScanners or security probesSecurity suites
EncryptionPhysical ControlsPassword selection and change
11
Controlling risks associated with Infrastructure vulnerabilities
Disaster Recovery PlanFlying start
Shadow modeCold siteHot site
12
Falsified Identity-for an electronic transaction to take place, each party to the transaction needs to be confident that the claimed identity of the other party is authentic
Email spoofingIP spoofingCustomer impersonationFalse Web sitesEmail or web-visit hijacking
13
Controlling the risks associated with falsified identity
Digital Signatures and Certificates
Biometrics
14
Compromised Privacy—one of the biggest concerns of consumers who shop on the Internet is over privacy and security
Privacy policies
Cookies
15
Controlling the risks associated with compromised privacy
Cookie Screening
Effective privacy policies
16
Destructive Codes and Programs
VirusesMacroBootFileTrojan Horse
17
Controlling the risks associated with destructive codes and programs
18
Human Factors in E-Business
People-the weak link
Responsible personnel
Action plan for breach of security
19
System Interdependencies
20
Anticipating and Managing E-Business Risk
Emergent risks—threats that have yet to be identified
21
E-Commerce Security
Prentice-Hall
22
Learning Objectives
1. Document the rapid rise in computer and network security attacks.
2. Describe the common security practices of businesses of all sizes.
3. Understand the basic elements of EC security.
4. Explain the basic types of network security attacks.
23
Learning Objectives (cont.)
5. Describe common mistakes that organizations make in managing security.
6. Discuss some of the major technologies for securing EC communications.
7. Detail some of the major technologies for securing EC networks components.
24
Brute Force Credit Card Attack Story
• The Problem– Spitfire Novelties usually generates between 5
and 30 transactions per day– On September 12, 2002 in a “brute force” credit
card attack, Spitfire’s credit card transaction processor processed 140,000 fake credit card charges worth $5.07 each (62,000 were approved)
25
Brute Force Credit Card Attack (cont.)
– The total value of the approved charges was around $300,000
– Spitfire found out about the transactions only when they were called by one of the credit card owners who had been checking his statement online and had noticed the $5.07 charge
26
Brute Force Credit Card Attack (cont.)
– Brute force credit card attacks require minimal skill
– Hackers run thousands of small charges through merchant accounts, picking numbers at random
– When the perpetrator finds a valid credit card number it can then be sold on the black market
– Some modern-day black markets are actually member-only Web sites like carderplanet.com, shadowcrew.com, and counterfeitlibrary.com
27
Brute Force Credit Card Attack (cont.)
– Relies on a perpetrator’s ability to pose as a merchant requesting authorization for a credit card purchase requiring
• A merchant ID• A password• Both
28
Brute Force Credit Card Attack (cont.)
– Online Data’s credit card processing services, all a perpetrator needed was a merchant’s password in order to request authorization
– Online Data is a reseller of VeriSign Inc. credit card gateway services
• VeriSign blamed Online Data for the incident• Online Data blamed Spitfire for not changing their
initial starter password
29
Brute Force Credit Card Attack Story (cont.)
• In April 2002 hackers got into the Authorize.Net card processing system (largest gateway payment system on the Internet)– Executed 13,000 credit card transactions, of
which 7,000 succeeded – Entry into the Authorize.Net system required only
a log-on name, not a password
30
Brute Force Solution
– Online Data should assign strong passwords at the start
– Customers should modify those passwords frequently
– Authorization services such as VeriSign and Authorize.Net should have built-in safeguards that recognize brute force attacks
31
Brute Force Credit Card Solution (cont.)
– Signals that something is amiss:• A merchant issues an extraordinary number
of requests • Repeated requests for small amounts
emanating from the same merchants
32
Brute Force Credit Card Attack (cont.)
• The Results– VeriSign halted the transactions before
they were settled, saving Spitfire $316,000 in charges
– Authorize.Net merchants were charged $0.35 for each transaction
– The criminals acquired thousands of valid credit card numbers to sell on the black market
33
Brute Force Credit Card Attack (cont.)
• What we can learn…– Any type of EC involves a number of
players who use a variety of network and application services that provide access to a variety of data sources
– A perpetrator needs only a single weakness in order to attack a system
34
Brute Force What We Can Learn
– Some attacks require sophisticated techniques and technologies
– Most attacks are not sophisticated; standard security risk management procedures can be used to minimize their probability and impact
35
Accelerating Need forE-Commerce Security
• Annual survey conducted by the Computer Security Institute and the FBI
1. Organizations continue to experience cyber attacks from inside and outside of the organization
36
Accelerating Need forE-Commerce Security (cont.)
2. The types of cyber attacks that organizations experience were varied
3. The financial losses from a cyber attack can be substantial
4. It takes more than one type of technology to defend against cyber attacks
37
Accelerating Need forE-Commerce Security (cont.)
• National Infrastructure Protection Center (NIPC): A joint partnership, under the auspices of the FBI, among governmental and private industry; designed to prevent and protect the nation’s infrastructure
38
Accelerating Need forE-Commerce Security (cont.)
• Computer Emergency Response Team (CERT): Group of three teams at Carnegie Mellon University that monitors incidence of cyber attacks, analyze vulnerabilities, and provide guidance on protecting against attacks
39
Accelerating Need forE-Commerce Security (cont.)
• According to the statistics reported to CERT/CC over the past year (CERT/CC 2002)– The number of cyber attacks skyrocketed
from approximately 22,000 in 2000 to over 82,000 in 2002
– First quarter of 2003 the number was already over 43,000
40
Security Is Everyone’s Business
• Security practices of organizations of various sizes– Small organizations (10 to 100 computers)
• The “haves” are centrally organized, devote a sizeable percentage of their IT budgets to security
• The “have-nots” are basically clueless when it comes to IT security
41
Security Is Everyone’s Business (cont.)
– Medium organizations (100 to 1,000 computers)
• Rarely rely on managerial policies in making security decisions, and they have little managerial support for their IT policies
• The staff they do have is poorly educated and poorly trained—overall exposure to cyber attacks and intrusion is substantially greater than in smaller organizations
42
Security Is Everyone’s Business (cont.)
– Large organizations (1,000 to 10,000 computers)
• Complex infrastructures and substantial exposure on the Internet
• While aggregate IT security expenditures are fairly large, their security expenditures per employee are low
43
Security Is Everyone’s Business (cont.)
– Larger organizations• IT security is part-time and undertrained—sizeable
percentage of the large organizations suffer loss or damage due to incidents
• Base their security decisions on organizational policies
44
Security Is Everyone’s Business (cont.)
– Very large organizations (more than 10,000 computers)
• extremely complex environments that are difficult to manage even with a larger staff
• rely on managerial policies in making IT security decisions
• only a small percentage have a well-coordinated incident response plan
45
Security Issues
• From the user’s perspective:– Is the Web server owned and operated by
a legitimate company?– Does the Web page and form contain some
malicious or dangerous code or content?– Will the Web server distribute
unauthorized information the user provides to some other party?
46
Security Issues (cont.)
• From the company’s perspective:– Will the user not attempt to break into the
Web server or alter the pages and content at the site?
– Will the user will try to disrupt the server so that it isn’t available to others?
47
Security Issues (cont.)
• From both parties’ perspectives:– Is the network connection free from
eavesdropping by a third party “listening” on the line?
– Has the information sent back and forth between the server and the user’s browser been altered?
48
Security Requirements
• Authentication: The process by which one entity verifies that another entity is who they claim to be
• Authorization: The process that ensures that a person has the right to access certain resources
49
Security Requirements (cont.)
• Auditing: The process of collecting information about attempts to access particular resources, use particular privileges, or perform other security actions
50
Security Requirements (cont.)
• Confidentiality: Keeping private or sensitive information from being disclosed to unauthorized individuals, entities, or processes
51
Security Requirements (cont.)
• Integrity: As applied to data, the ability to protect data from being altered or destroyed in an unauthorized or accidental manner
52
Security Issues (cont.)
• Nonrepudiation: The ability to limit parties from refuting that a legitimate transaction took place, usually by means of a signature
53
Types of Threats and Attacks
• Nontechnical attack: An attack that uses chicanery to trick people into revealing sensitive information or performing actions that compromise the security of a network
54
Types of Threats and Attacks (cont.)
55
Types of Threats and Attacks (cont.)
• Social engineering: A type of nontechnical attack that uses social pressures to trick computer users into compromising computer networks to which those individuals have access
56
Types of Threats and Attacks (cont.)
• Multiprong approach used to combat social engineering:
1. Education and training
2. Policies and procedures
3. Penetration testing
57
Types of Threats and Attacks (cont.)
• Technical attack: An attack perpetrated using software and systems knowledge or expertise
58
Types of Threats and Attacks (cont.)
• Common (security) vulnerabilities and exposures (CVEs): Publicly known computer security risks, which are collected, listed, and shared by a board of security-related organizations (cve.mitre.org)
59
Types of Threats and Attacks (cont.)
• Denial-of-service (DoS) attack: An attack on a Web site in which an attacker uses specialized software to send a flood of data packets to the target computer with the aim of overloading its resources
60
Types of Threats and Attacks (cont.)
• Distributed denial-of-service (DDoS) attack: A denial-of-service attack in which the attacker gains illegal administrative access to as many computers on the Internet as possible and uses these multiple computers to send a flood of data packets to the target computer
61
Types of Threats and Attacks (cont.)
62
Types of Threats and Attacks (cont.)
• Malware: A generic term for malicious software– The severity of the viruses increased
substantially, requiring much more time and money to recover
– 85% of survey respondents said that their organizations had been the victims of e-mail viruses in 2002
63
Types of Threats and Attacks (cont.)
– Malicious code takes a variety of forms—both pure and hybrid
• Virus: A piece of software code that inserts itself into a host, including the operating systems, to propagate; it requires that its host program be run to activate it
64
Types of Threats and Attacks (cont.)
– Worm: A software program that runs independently, consuming the resources of its host in order to maintain itself and is capable of propagating a complete working version of itself onto another machine
65
Types of Threats and Attacks (cont.)
– Macro virus or macro worm: A virus or worm that is executed when the application object that contains the macro is opened or a particular procedure is executed
66
Types of Threats and Attacks (cont.)
– Trojan horse: A program that appears to have a useful function but that contains a hidden function that presents a security risk
67
Managing EC Security
• Common mistakes in managing their security risks (McConnell 2002):– Undervalued information– Narrowly defined security boundaries– Reactive security management– Dated security management processes– Lack of communication about security
responsibilities
68
Managing EC Security (cont.)
• Security risk management: A systematic process for determining the likelihood of various security attacks and for identifying the actions needed to prevent or mitigate those attacks
69
Managing EC Security (cont.)
• Phases of security risk management– Assessment– Planning– Implementation– Monitoring
70
Managing EC Security (cont.)
• Phase 1: Assessment– Evaluate security risks by determining
assets, vulnerabilities of their system, and potential threats to these vulnerabilities
71
– Honeynet: A way to evaluate vulnerabilities of an organization by studying the types of attacks to which a site is subjected, using a network of systems called honeypots
– Honeypots: Production systems (e.g., firewalls, routers, Web servers, database servers) designed to do real work but to be watched and studied as network intrusions occur
72
Managing EC Security (cont.)
• Phase 2: Planning– Goal of this phase is to arrive at a set of
policies defining which threats are tolerable and which are not
– Policies also specify the general measures to be taken against those threats that are intolerable or high priority
73
Managing EC Security (cont.)
• Phase 3: Implementation– Particular technologies are chosen to
counter high-priority threats– First step is to select generic types of
technology for each of the high priority threats
74
Managing EC Security (cont.)
• Phase 4: Monitoring to determine– Which measures are successful– Which measures are unsuccessful and need
modification– Whether there are any new types of threats– Whether there have been advances or changes in
technology– Whether there are any new business assets that
need to be secured
75
Managing EC Security (cont.)
• Methods of securing EC– Authentication system– Access control mechanism– Passive tokens– Active tokens
76
Authentication
• Authentication system: System that identifies the legitimate parties to a transaction, determines the actions they are allowed to perform, and limits their actions to only those that are necessary to initiate and complete the transaction
77
Authentication (cont.)
• Access control mechanism: Mechanism that limits the actions that can be performed by an authenticated person or group
78
Authentication (cont.)
• Passive tokens: Storage devices (e.g., magnetic strips) used in a two-factor authentication system that contain a secret code
79
Authentication (cont.)
• Active tokens: Small, stand-alone electronic devices in a two factor authentication system that generate one-time passwords
80
Biometric Controls
• Biometric systems: Authentication systems that identify a person by measurement of a biological characteristic such as a fingerprint, iris (eye) pattern, facial features, or voice
81
Biometric Controls (cont.)
• Physiological biometrics: Measurements derived directly from different parts of the body (e.g., fingerprints, iris, hand, facial characteristics)
• Behavioral biometrics: Measurements derived from various actions and indirectly from various body parts (e.g., voice scans or keystroke monitoring)
82
Biometric Controls (cont.)
• Fingerprint scanning: Measurement of the discontinuities of a person’s fingerprint, converted to a set of numbers that are stored as a template and used to authenticate identity
• Iris scanning: Measurement of the unique spots in the iris (colored part of the eye), converted to a set of numbers that are stored as a template and used to authenticate identity
83
Biometric Controls (cont.)
• Voice scanning: Measurement of the acoustical patterns in speech production, converted to a set of numbers that are stored as a template and used to authenticate identity
84
Biometric Controls (cont.)
• Keystroke monitoring: Measurement of the pressure, speed, and rhythm with which a word is typed, converted to a set of numbers that are stored as a template and used to authenticate identity; this biometric is still under development
85
Encryption Methods
• Public key infrastructure (PKI): A scheme for securing e-payments using public key encryption and various technical components
86
Encryption Methods (cont.)
• Private and public key encryption– Encryption: The process of scrambling
(encrypting) a message in such a way that it is difficult, expensive, or time-consuming for an unauthorized person to unscramble (decrypt) it
87
Encryption Methods (cont.)
– Plaintext: An unencrypted message in human-readable form
– Ciphertext: A plaintext message after it has been encrypted into a machine-readable form
– Encryption algorithm: The mathematical formula used to encrypt the plaintext into the ciphertext, and vice versa
88
Encryption Methods (cont.)
• Symmetric (private) key system– Key: The secret code used to encrypt and
decrypt a message– Symmetric (private) key system: An
encryption system that uses the same key to encrypt and decrypt the message
89
Encryption Methods (cont.)
– Data Encryption Standard (DES): The standard symmetric encryption algorithm supported the NIST and used by U.S. government agencies until October 2, 2000
– Rijndael: The new Advanced Encryption Standard used to secure U.S. government communications since October 2, 2000
90
Encryption Methods (cont.)
91
Elements of PKI
• Digital signature: An identifying code that can be used to authenticate the identity of the sender of a document– Portable– Cannot be easily repudiated or imitated,
and can be time-stamped
92
Elements of PKI (cont.)
93
Elements of PKI (cont.)
• Digital signatures include:– Hash: A mathematical computation that is applied
to a message, using a private key, to encrypt the message
– Message digest: A summary of a message, converted into a string of digits, after the hash has been applied
– Digital envelope: The combination of the encrypted original message and the digital signature, using the recipient’s public key
94
Elements of PKI (cont.)
• Digital certificate: Verification that the holder of a public or private key is who they claim to be
• Certificate authorities (CAs): Third parties that issue digital certificates
95
Security Protocols
• Secure Socket Layer (SSL): Protocol that utilizes standard certificates for authentication and data encryption to ensure privacy or confidentiality
• Transport Layer Security (TLS): As of 1996, another name for the SSL protocol
96
Security Protocols (cont.)
• Secure Electronic Transaction (SET): A protocol designed to provide secure online credit card transactions for both consumers and merchants; developed jointly by Netscape, Visa, MasterCard, and others
97
Securing EC Networks
• Technologies for organizational networks– Firewall: A network node consisting of both
hardware and software that isolates a private network from a public network
– Packet-filtering routers: Firewalls that filter data and requests moving from the public Internet to a private network based on the network addresses of the computer sending or receiving the request
98
Securing EC Networks (cont.)
– Packet filters: Rules that can accept or reject incoming packets based on source and destination addresses and the other identifying information
– Application-level proxy: A firewall that permits requests for Web pages to move from the public Internet to the private network
99
Securing EC Networks (cont.)
– Bastion gateway: A special hardware server that utilizes application-level proxy software to limit the types of requests that can be passed to an organization’s internal networks from the public Internet
– Proxies: Special software programs that run on the gateway server and pass repackaged packets from one network to the other
100
Securing EC Networks (cont.)
101
Securing EC Networks (cont.)
• Personal firewalls:Personal firewall: A network node designed to protect an individual user’s desktop system from the public network by monitoring all the traffic that passes through the computer’s network interface card
102
Securing EC Networks (cont.)
• VPNsVirtual private network (VPN): A network that uses the public Internet to carry information but remains private by using encryption to scramble the communications, authentication to ensure that information has not been tampered with, and access control to verify the identity of anyone using the network
103
Securing EC Networks (cont.)
– Protocol tunneling: Method used to ensure confidentiality and integrity of data transmitted over the Internet, by encrypting data packets, sending them in packets across the Internet, and decrypting them at the destination address
104
Securing EC Networks (cont.)
• Intrusion detection systems (IDSs): A special category of software that can monitor activity across a network or on a host computer, watch for suspicious activity, and take automated action based on what it sees
105
Securing EC Networks (cont.)
• Network-based IDS uses rules to analyze suspicious activity at the perimeter of a network or at key locations in the network
• Consists of a monitor—a software package that scans the software agents that reside on various host computers and feed information back to the monitor
PHYSICAL SECURITYDOMAIN
Objectives
To address the threats, vulnerabilities, and countermeasures which can be utilized to physically protect an enterprise’s resources and sensitive information to include people, facilities, data, equipment, support systems, media, and supplies.
To discuss considerations for choosing a secure site, its design and configuration, and the methods for securing the facility against unauthorized access, theft of equipment and information, and the environmental and safety measures needed to protect people, the facility, and its resources.
Topics to Be Covered
• Physical Security Threats
• Site Design and Configuration
• Physical Security Requirements– For Centralized Computing Facilities– For Distributed Processing Facilities– For Extended Processing
References Used
• Handbook of Information Security Management 1999 - Krause & Tipton
• Computer Security Handbook, Third Edition - Hutt, Bosworth & Hoyt
• (ISC)2 CBK Review Materials• An Introduction to Computer Security: The
NIST Handbook
What Does Physical Security Include?
• Physical Access Controls– Guards– Fences– Barriers– Lighting– Keys and Locks– Badges– Escorts– Property Controls– Monitoring/Detection Systems
What Else Does Physical Security Cover?
• Environmental Protection– Power Protection– HVAC– Water Protection– Fire Detection– Fire Suppression– Evacuation– Environmental Monitoring/Detection
Physical Security Threats
• Threat Components– Agents
– Motives
– Results
• External Threats– Wind/Tornado
– Flooding
– Lightning
– Earthquake
– Cold and Ice
– Fire
– Chemical
Threat Identification (continued)
• Internal Physical Threats– Fire
– Environmental Failure
– Liquid Leakage
– Electrical Interruption
• Human Threats– Theft
– Vandalism
– Sabotage
– Espionage
– Errors
Site Design & Configuration Considerations
• Location and Access– Local Crime– Visibility– Emergency Access– Natural Hazards– Air and Surface Traffic– Joint Tenants– Stable Power Supply– Existing Boundary Protection
(Barriers/Fencing/Gates)
Boundary Protection
• Area Designation: Facilitates Enforcement• Vehicular Access• Personnel Access
– Occupants– Visitors (Escort & Logging)
• Fences– Deter Casual Trespassing– Compliments Other Access Controls– Aesthetics– Won’t Stop Determined Intruder
Boundry Protection (continued)
• Lighting– Entrances– Parking Areas– Critical Areas
• Perimeter Detection Systems– Does Not Prevent Penetration– Alerts Response Force– Requires Response– Nuisance Alarms– Costly
Boundry Protection (continued)
• CCTV– Efficiency– Requires Human Response– Limitations
• Staffing– Access Control Points– Patrols– Employees
Computing Facility Requirements (continued)
• Walls– True Floor to Ceiling– Fire Rating (at least 1 hour)– Penetrations– Adjacent Areas
• Doors– Interior/Exterior– Hinges– Fire Rating– Alarms– Monitoring
Computing Facility Requirements (continued)
• Windows/Openings– Interior/Exterior– Fixed– Shatterproof
• Computer and Equipment Room Lay Out– Equipment Access– Storage– Occupied Areas– Water Sources– Cable Routing
Computing Facility Requirements (continued)
• Electrical Power– Definitions:
• Blackout - Loss of Power• Brownout - Prolonged Period of Below Normal Voltage• Noise - Random Disturbance that Interferes with a
Device• Sag - Short Period of Low Voltage• Spike - Momentary High Voltage• Surge - Prolonged High Voltage• Transient - Line Noise/Disturbance at Normal Voltage
Computing Facility Requirements (continued)
– Dedicated Circuits– Controlled Access to:
• Power Distribution Panels• Master Circuit Breakers• Transformers• Feeder Cables
– Emergency Power Off Controls– Voltage Monitoring/Recording– Surge Protection
Computing Facility Requirements (continued)
– Backup Power• Alternate Feeders• Uninterruptible Power Supply
– Hydrogen Gas Hazard– Maintenance/Testing
• Emergency Power Generator– Fuel Consideration– Maintenance/Testing– Costs
Computing Facility Requirements (continued)
• Backup Power Requirements– Lighting– Physical Access Control Systems– Fire Protection Systems– Computing Equipment
• Mainframes
• Servers
• Workstations
– Communications Equipment– Telephone Systems– HVAC
Computing Facility Requirements (continued)
• Air Conditioning– Dedicated– Controllable– Independent Power– Emergency Shut Off Controls– Positive Pressure– Protected Air Intakes– Monitoring
Computing Facility Requirements (continued)
• Humidity Controls– Risk of Static Electricity– Risk to Electric Connections
• Air Quality (Dust)• Water Protection
– Falling Water– Rising Water– Drains– Protective Coverings– Moisture Detection Systems
Fire Prevention & Protection
• Fire Elements:– Fuel– Oxygen– Temperature
• Causes Of Computer Center Fires– #1: Electrical Distribution Systems– #2: Equipment
• Fire Classes– A: Common Compustibles (use Water/Soda Acid)– B: Liquid (CO2/Soda Acid/Halon)– C: Electrical (CO2/Halon)
Fire Prevention & Protection (continued)
• Temperatures When Damage Occurs– Paper Products: 350o
– Computer Equipment: 175o
– Disks: 150o
– Magnetic Media: 100o
• Fire Detection– Manual– Optical (Photoelectric-Smoke Blocking Light) – Temperature– Ionization (Reaction to Charged Particles in Smoke)
Fire Detection (continued)
– Detectors• On Ceilings• Above Suspended Ceilings• Beneath Raised Floors• Return Air Ducts• Cross-Zoning
– Alarms• Manual & Automated Activation• Visual & Audible Indication• Local & Remote Annunciation
Fire Suppression
• Portable Extinguishers– At Exits– Mark Locations and Type– Types A, B & C– Need to Inspect
• Water Sprinkler Systems– Works to Lower Temperature– Most Damaging to Equipment– Conventional Systems– “Dry Pipe” Systems: Less Risk of Leakage– Employ in Throughout Building and in all Spaces
Fire Suppression (continued)
• Carbon Dioxide (CO2)– Colorless/Odorless– Potentially Lethal– Removes Oxygen– Best for Unattended Facilities– Delayed-Activation in Manned Facilities
Fire Suppression (continued)
• Halon– Best Protection for Equipment
• Inside Equipment Cabinets/Vaults
• Special Areas
• Above Suspended Ceilings
• Under Raised Floors
– Concentrations <10% are Safe– Becomes Toxic at 900o
– Depletes Ozone (CFCs)– Montreal Protocol (1987)– Halon 1301: Requires Pressurization– Halon 1211: Self-Pressurization (Portable Extinguishers)
Fire Prevention & Protection (continued)
• Other Considerations– Training– Testing– National Fire Prevention Association (NFPA)
Standards– Local Fire Codes– Drainage
Securing Storage Areas
• Forms Storage Rooms– Increased Threat of Fire– Combustibles– Access Controls
• Media Storage Rooms– Media Sensitivity– Segregation– Access Controls– Environmental Controls
Media Protection
• Storage– Media Libraries/Special Rooms– Cabinets– Vaults
• Location– Operational– Off-Site
• Transportation
Protecting Wiring
• Optical Fiber
• Copper Wire
• Certifying the Wiring and Cabling
• Controlling Access to Closets and Riser Rooms
Other Considerations
• Dealing with Existing Facilities– Planning– Upgrade/Renovation– Incremental New Construction
• Protecting the Protection– Implement Physical and Environmental
Controls for Security Systems– Protect against both Intentional and
Inadvertent Threats
Personnel Access Controls
• Position Sensitivity Designation
• Management Review of Access Lists
• Background Screening/Re-Screening
• Termination/Transfer Controls
• Disgruntled Employees
Access Controls – Locks
• Preset Locks and Keys• Programmable Locks
– Mechanical (Cipher Locks)– Electronic (Keypad Systems): Digital Keyboard
• Number of Combinations
• Number of Digits in Code
• Frequency of Code Change
• Error Lock-Out
• Error Alarms
Access Controls - Tokens
• Security Card Systems– Dumb Cards
• Photo Identification Badges• Manual Visual Verification• Can be Combined with Smart Technology
– Digital Coded (Smart) Cards• Often Require Use of PIN Number with Card• Readers: Card Insertion, Card Swipe &
Proximity
Types of Access Cards
• Photo ID Cards• Optical Coded Cards (Magnetic Dot)• Electric Circuit Cards (Embedded Wire)• Magnetic Cards (Magnetic Particles)• Metallic Stripe Card (Copper Strips)
Access Controls - Biometrics
• Fingerprint/Thumbprint Scan• Blood Vein Pattern Scan
– Retina– Wrist– Hand
• Hand Geometry• Facial Recognition• Voice Verification• Keystroke Recorders• Problems
– Cost– Speed– Accuracy
Physical Security in Distributed Processing
• Threats– To Confidentiality
• Sharing Computers
• Sharing Diskettes
– To Availability• User Errors
– To Data Integrity• Malicious Code
• Version Control
Distributed Processing Physical Security Controls (continued)
• Office Area Controls– Entry Controls– Office Lay-Out– Personnel Controls– Hard-Copy Document Controls– Electronic Media Controls– Clean-Desk Policy
Office Area Physical Security Controls (continued)
– Printer/Output Controls– Property Controls– Space Protection Devices– Equipment Lock-Down
Distributed Processing Physical Security Controls (continued)
• Cable Locks
• Disk Locks
• Port Controls
• Power Switch Locks
• Keyboard Locks
• Cover Locks
Distributed Processing Physical Security Controls (continued)
• Isolated Power Source– Noise– Voltage Fluctuations– Power Outages
• Heat/Humidity Considerations• Fire/Water• Magnetic Media Controls
Extended Processing Physical Security Controls
• User Responsibilities Paramount– Protection against Disclosure
• Shoulder Surfing• Access to Sensitive Media and Written Material
– Integrity Protection– Protection against Loss or Theft
• Locks• Practices
• Management Responsibilities– Approval– Monitoring
Other Terms & Abbreviations
• Tailgate
• Piggy-Back
• Stay Behind
• Degauss
• Remanence
• Mantrap
• Pass-Back
• Dumpster Diving
• False Positive/Negative
• Montreal Protocol
• Duress Alarm
• Tamper Alarm
• Passive Ultrasonic
• Fail Safe/Fail Soft
• EPO
• IDS
• Shoulder Surfing
• Electronic Emanation
• Tsunami
• RFI
• Defense in Depth
• EMI
• Top Guard
QUESTIONS?
150
Managerial Issues
1. Have we budgeted enough for security?2. What are the business consequences of
poor security?3. Which e-commerce sites are vulnerable
to attack?
151
Managerial Issues (cont.)
4. What is the key to establishing strong e-commerce security?
5. What steps should businesses follow inestablishing a security plan?
6. Should organizations be concerned with internal security threats?
152
Summary
1. Increase in computer attacks.2. Security is everyone’s business.3. Basic security issues.4. Basic types of network security
attacks.5. Managing EC security.6. Securing EC communications.7. Technologies for securing networks
153
Summary
• Mahasiswa diwajibkan membuat summary
top related