Managing Information Systems

Information Systems Security and Control

Part 2
Section 14.2

1
 Objectives
• Demonstrate that Information System
vulnerabilities can be controlled
• Demonstrate the ways in which Information
Systems can be controlled in an
organisation
• Demonstrate some of the technologies that
can be used to control Information Systems
vulnerabilities

2
Controlling Information Systems
• Recall there are numerous threats to
Information Systems
– Hardware failures
– Software failures
– Upgrade issues
– Disasters
– Malicious intent

3
Controlling Information Systems
• To minimise likelihood of threats, must
control the environment in which
Information Systems are developed and
deployed
• Controls put in place to:
– Manually control environment of Information
Systems
– Automatically add controls to Information
Systems
4
Controlling Information Systems
• Implemented through
– Policies
– Procedures
– Standards
• Control must be thought about through all
stages of Information Systems analysis,
construction, deployment operations and
maintenance

5
Controlling Information Systems
• What sort of controls can be put in place?

6
 Controls
• General controls
– Controls for design, security and use of
Information Systems throughout the
organisation
• Application controls
– Specific controls for each application
– User functionality specific

7
 General Controls
• Implementation controls
– Audit system development
– Ensure properly managed and controlled
– Ensure user involvement
– Ensure procedures and standards are in use
• Software controls
– Authorised access to systems

8
 General Controls
• Hardware controls
– Physically secure hardware
– Monitor for and fix malfunction
– Environmental systems and protection
– Backup of disk-based data

9
 General Controls
• Computer operations controls
– Day-to-day operations of Information Systems
– Procedures
– System set-up
– Job processing
– Backup and recovery procedures

10
 General Controls
• Data security controls
– Prevent unauthorised access, change or
destruction
– When data is in use or being stored
– Physical access to terminals
– Password protection
– Data level access controls

11
 General Controls
• Administrative controls
– Ensure organisational policies, procedures and
standards and enforced
– Segregation of functions to reduce errors and
fraud
– Supervision of personal to ensure policies and
procedures are being adhered to

12
 Application Controls
• Input controls
– Data is accurate and consistent on entry
– Direct keying of data, double entry or
automated input
– Data conversion, editing and error handling
– Field validation on entry
– Input authorisation and auditing
– Checks on totals to catch errors
13
 Application Controls
• Processing controls
– Data is accurate and complete on processing
– Checks on totals to catch errors
– Compare to master records to catch errors
– Field validation on update

14
 Application Controls
• Output controls
– Data is accurate, complete and properly
distributed on output
– Checks on totals to catch errors
– Review processing logs
– Track recipients of data

15
 Protecting Information Systems
• What sorts of technology can we use to
implement Information Systems controls?

16
 Protecting Information Systems
• Information Systems, especially TPS,
require high degrees of availability
• Technology is available to ensure systems
are available and contain accurate
information

17
 High Availability Computing
• Systems available for most of the time
(some downtime allowed)
– Recover quickly from crash / downtime
– Redundant servers and clustering
– Mirroring of data and networked storage
– Load balancing
– Scalable and robust infrastructure
– Disaster recovery planning

18
 Fault Tolerant Computing
• Systems available all the time (no downtime
allowed)
– Specialist hardware
• HP NonStop (Tandem), Stratos
– Detect and correct faults in hardware and
software to keep processing

19
 Network Security
• Permanent (open) network connectivity:
Internet, Extranet, wireless
– Firewall: proxy or stateful inspection
– Firewalls must be managed and part of security
policy
– Encryption: public key, SSL of S-HTTP
– Authentication and integrity
– Digital signatures and certificates
20
 Developing Control
• Lots of threats to Information Systems
• Lots of controls required
• Decision on which controls to use based
upon likelihood of threat and cost
• Risk assessment
– Likely frequency of threat
– Cost of damage
– Cost of implementation
21
HOMEWORK

22
HOMEWORK

23