Ethics in Information

Technology, Fourth Edition

Chapter 3
Computer and Internet Crime
 Objective
s
• As you read this chapter, consider the following
questions:
- What key tradeoffs and ethical issues are
associated with the safeguarding of data and
information systems?
- Why has there been a dramatic increase in the
number of computer-related security incidents
in recent years?
- What are the most common types of computer
security attacks?

Ethics in Information Technology, Fourth Edition

 Objectives (cont'd.)
- Who are the primary culprits of computer crime, and
what are their objectives?
- What are the key elements of a multilayer process
for managing security vulnerabilities based on
the concept of reasonable assurance?
- What actions must be taken in response to a security
incident?
- What is computer forensics, and what role does it
play in responding to a computer incident?

Ethics in Information Technology, Fourth Edition

Implementing CIA at the End-
User Level
 Educating Employees,
Contractors, and Part-Time
• Educate Workers
and motivate users to understand and
follow policy
• Discuss recent security incidents
• Help protect information systems by:
- Guarding passwords
- Not allowing sharing of passwords
- Applying strict access controls to protect data
- Reporting all unusual activity
- Protecting portable computing and data storage
devices

Ethics in Information Technology, Fourth Edition

For example, users must help protect an organization’s
information systems and data by doing the following:

• Guarding their passwords to protect against unauthorized

access to their accounts
• Prohibiting others from using their passwords
• Applying strict access controls (file and directory
permissions) to protect data from disclosure or
destruction
• Reporting all unusual activity to the organization’s IT
security group
• Taking care to ensure that portable computing and data
storage devices are protected
Included in the Assignment No 1: Do this exercise for your own devices and
write “not applicable” on those questions which are related to the
organization.
 RESPONSE TO CYBERATTACK
• Response plan
- Develop well in advance of any incident
- Approved by:
• Legal department
• Senior management
• A well-developed response plan helps keep an
incident under technical and emotional control.
• Primary goals
- Regain control and limit damage
- Not to monitor or catch an intruder

Ethics in Information Technology, Fourth Edition

 Response (cont'd.)

• Incident notification defines:

- Who to notify
- Who not to notify
• Security experts recommend against releasing
specific information about a security compromise in
public forums
• Document all details of a security incident
- All system events
- Specific actions taken
- All external conversations

Ethics in Information Technology, Fourth Edition

 Response (cont'd.)

• Act quickly to contain an attack

• Eradication effort
- Collect and log all possible criminal evidence
- Verify necessary backups are current and complete
- Create new backups
• Follow-up
- Determine how security was compromised
• Prevent it from happening again

Ethics in Information Technology, Fourth Edition

The key elements of a formal incident report
should include the following
• IP address and name of host computer(s) involved
• The date and time when the incident was discovered
• How the incident was discovered
• The method used to gain access to the host computer
• A detailed discussion of vulnerabilities that were exploited
• A determination of whether or not the host was compromised as
a result of the attack
• The nature of the data stored on the computer (customer,
employee, financial, etc.)
• A determination of whether the accessed data are considered
personal, private, or confidential
• The number of hours the system was down
• The overall impact on the business
• An estimate of total financial damage from the incident
• A detailed chronology of all events associated with the incident
 Response (cont'd.)

• Review
- Determine exactly what happened
- Evaluate how the organization responded
• Legal practice
- Hold organizations accountable for their own IT
security weaknesses

Ethics in Information Technology, Fourth Edition

Using an MSSP
(Managed security service providers)
(MSSPs) are IT service providers that specialize in offering
some kind of cybersecurity monitoring or management to
organizations. These services can include virus and spam
blocking, intrusion detection, firewalls and virtual private
network (VPN) management.
Assignment
• What are the pros and cons of outsourcing the security
services of an organization?
• Search 3 Pakistan based “Managed security service
providers” and discuss the services they offer. Also,
solve the problem discuss below.
• Your team has been assigned responsibility to
identify an appropriate MSSP provider for a small,
rural hospital. What criteria will you use to select
an appropriate provider? Do research online to
identify three MSSP providers. Use the criteria you
established to rate each of the three, and choose
the one that would be best for the hospital.

• Submission on and before 14 September 2021 on

LMS.
 Computer Forensics
• Combines elements of law and computer science
to identify, collect, examine, and preserve data and
preserve its integrity so it is admissible as
evidence
• Computer forensics investigation requires
extensive training and certification and knowledge
of laws that apply to gathering of criminal evidence

Ethics in Information Technology, Fourth Edition

Numerous certifications relate to computer forensics,
including

• CCE (Certified Computer Examiner),

• CISSP (Certified Information Systems Security
Professional),
• CSFA (Cyber Security Forensic Analyst), and
• GCFA (Global Information Assurance Certification
Certified Forensics Analyst).
Checklist continued…
 Summary

• Ethical decisions in determining which information

systems and data most need protection
• Most common computer exploits
- Viruses
- Worms
- Trojan horses
- Distributed denial-of-service attacks
- Rootkits
- Spam
- Phishing, spear-fishing, smishing, vishing

Ethics in Information Technology, Fourth Edition

 Summary (cont'd.)
• Perpetrators include:
- Hackers
- Crackers
- Malicious insider
- Industrial spies
- Cybercriminals
- Hacktivist
- Cyberterrorists

Ethics in Information Technology, Fourth Edition

 Summary (cont'd.)

• Must implement multilayer process for managing

security vulnerabilities, including:
- Assessment of threats
- Identifying actions to address vulnerabilities
- User education
• IT must lead the effort to implement:
- Security policies and procedures
- Hardware and software to prevent security
breaches
• Computer forensics is key to fighting computer
crime in a court of law
Ethics in Information Technology, Fourth Edition