Six E-Policies Organizations Should Implement to Protect Themselve

Six e-policies organizations should implement to protect themselves. Organizations strive to build a corporate culture based on ethical principles that employees can understand and implement - Ethical computer use policy - Email privacy policy - Information privacy policy - Social media policy - Acceptable Use Policy - Workplace Monitoring Policy Ethical computer use policy – Contains general principles to guide computer user behavior The ethical computer user policy ensures all users are informed of the rules and, by agreeing to use the system on that basis, consent to abide by the rules The unethical use of information typically occurs “unintentionally” when it is used for new purposes Information privacy policy - Contains general principles regarding information privacy Acceptable use policy (AUP) – Requires a user to agree to follow it to be provided access to corporate email, information systems, and the Internet Nonrepudiation – A contractual stipulation to ensure that ebusiness participants do not deny their online actions Internet use policy – Contains general principles to guide the proper use of the Internet Organizations can mitigate the risks of email and instant messaging communication tools by implementing and adhering to an email privacy policy Email privacy policy – Details the extent to which email messages may be read by others Spam – Unsolicited email Anti-spam policy – Simply states that email users will not send unsolicited emails (or spam) Social media policy – Outlines the corporate guidelines or principles governing employee online communications Workplace Monitoring Policy Workplace monitoring is a concern for many employees Organizations can be held financially responsible for their employees’ actions The dilemma surrounding employee monitoring in the workplace is that an organization is placing itself at risk if it fails to monitor its employees, however, some people feel that monitoring employees is unethical Information technology monitoring – Tracks people’s activities by such measures as number of keystrokes, error rate, and number of transactions processed Employee monitoring policy – Explicitly state how, when, and where the company monitors its employees Common monitoring technologies include: ■ Key logger or key trapper software ■ Hardware key logger ■ Cookie ■ Adware ■ Spyware ■ Web log ■ Clickstream Protecting Intellectual Assets Organizational information is intellectual capital - it must be protected Information security – The protection of information from accidental or intentional misuse by persons inside or outside an organization Downtime – Refers to a period of time when a system is unavailable Hacker – Experts in technology who use their knowledge to break into computers and computer networks, either for profit or just motivated by the challenge ■ Black-hat hacker ■ Cracker ■ ■ ■ ■ Cyberterrorist Hactivist Script kiddies or script bunnies White-hat hacker Virus - Software written with malicious intent to cause annoyance or damage ■ Worm ■ Malware ■ Adware ■ Spyware ■ Ransomware ■ Scareware Virus - Software written with malicious intent to cause annoyance or damage continued ■ Backdoor program ■ Denial-of-service attack (DoS) ■ Distributed denial-of-service attack (DDoS) ■ Polymorphic virus ■ Trojan-horse virus Security threats to ebusiness include ■ Elevation of privilege ■ Hoaxes ■ Malicious code ■ Packet tampering ■ Sniffer ■ Spoofing ■ Splogs ■ Spyware Three Areas of Information Security - People ( Authentication and Authorization) - Data (Prevention and Resistance) - Attacks (Detection and Response) The First Line of Defense People Organizations must enable employees, customers, and partners to access information electronically The biggest issue surrounding information security is not a technical issue, but a people issue ■ ■ ■ ■ Insiders Social engineering Dumpster diving Pretexting The first line of defense an organization should follow to help combat insider issues is to develop information security policies and an information security plan ■ Information security policies ■ Information security plan Identity theft – The forging of someone’s identity for the purpose of fraud ■ Phishing ■ Pharming ■ Sock puppet marketing ■ Astroturfing Authentication – A method for confirming users’ identities Authorization – The process of giving someone permission to do or have something The most secure type of authentication involves 1. Something the user knows 2. Something the user has 3. Something that is part of the user Something the User Knows Such As a User ID and Password This is the most common way to identify individual users and typically contains a user ID and a password This is also the most ineffective form of authentication Over 50 percent of help-desk calls are password related Something the User Has, Such as a Smart Card or Token Smart cards and tokens are more effective than a user ID and a password ■ Tokens – Small electronic devices that change user passwords automatically ■ Smart card – A device that is around the same size as a credit card, containing embedded technologies that can store information and small amounts of software to perform some limited processing Something That is Part of the User Such as a Fingerprint or Voice This is by far the best and most effective way to manage authentication ■ Biometrics – The identification of a user based on a physical characteristic, such as a fingerprint, iris, face, voice, or handwriting Unfortunately, this method can be costly and intrusive The Second Line of Defense — Prevention and Resistance Prevention and resistance technologies stop intruders from accessing and reading data Privilege escalation - A network intrusion attack that takes advantage of programming errors or design flaws to grant the attacker elevated access to the network and its associated data and applications ■ Vertical privilege escalation ■ Horizontal privilege escalation Downtime can cost an organization anywhere from $100 to $1 million per hour Technologies available to help prevent and build resistance to attacks include 1. Content filtering 2. Encryption 3. Firewalls Spam – A form of unsolicited email Content filtering - Prevents emails containing sensitive information from transmitting and stops spam and viruses from spreading Personally identifiable information a specific individual ■ Sensitive PII ■ Nonsensitive PII If there is an information security breach and the information was encrypted, the person stealing the information would be unable to read it ■ Encryption ■ Public key encryption (PKE) ■ Certificate authority ■ Digital certificate One of the most common defenses for preventing a security breach is a firewall ■ Firewall – Hardware and/or software that guards a private network by analyzing the information leaving and entering the network The Third Line of Defense — Detection and Response If prevention and resistance strategies fail and there is a security breach, an organization can use detection and response technologies to mitigate the damage Intrusion detection software – Features full-time monitoring tools that search for patterns in network traffic to identify intruders The Cost of Downtime Financial performance ■ Revenue recognition ■ Cash flow ■ Payment guarantees ■ Credit rating ■ Stock price Revenue ■ Direct loss ■ Compensatory payments ■ Lost future revenue ■ Billing losses ■ Lost productivity Damaged reputation ■ Customers ■ Suppliers ■ Financial markets ■ Banks ■ Business partners Other expenses ■ Temporary employees ■ Equipment rentals ■ Overtime costs ■ Extra shipping charges ■ Travel expenses ■ Legal obligations How Computer Viruses Spread A hacker creates a virus and attaches it to a program, document, or website. Thinking the file is legitimate, the user downloads it, and the virus infects other files and programs on the computer. Quickly, the virus spreads in email attachments and shared files to co-workers and friends. Public Encryption (PKE) An originating business sends the same public key to three different customers. Each customer responds with encrypted information, which the business decrypts using a private key.