Chapter 4 - Risk and control of information systems Flashcards
Risks to information processing facilities may arise from?
- Dissatisfied employees might deliberately modify or destroy information in the system
- A hacker or industrial spy might break into the system
- Viruses or malicious software could be introduced
- Accidental mistakes could be made on input to the system
- Inadequate security of the hardware or data
- Faults in the hardware system
Advantages of Intranets and the Internet
- Employees have ready access to vast sources of external data that would not otherwise be available. Using external information can help to improve the quality of decision making
- Organisations can advertise their goods and services on a website and provide other information that helps to promote their image
- and etc
What types of controls are there for cost effectiveness and should reduce IS risk to an acceptable level?
- General Controls - ensure appropriate use of computer systems and security from loss of data
- Application Controls - designed for each individual application, detect and correct translation processing errors.
- Software Controls - ensure that the software used is authorised
- Network Controls - arisen in response to growth of distributed processing and e-commerce
What are an “alternative” to the classification of IS controls?
- Security controls - controls designed to ensure the prevention of unauthorised access, modification or destruction of stored data
- Integrity controls: controls to ensure that the data are accurate, consistent and free from accidental corruption
- Contingency controls - in the event that security or integrity controls fail there must be a back-up facility and a contingency plan to restore business operations as quickly as possible
List problems with password system
- Authorised users may divulge their password to a colleague
- Many passwords may have associations with the user so that a hacker can discover them by experimentation
- Passwords are often written down close to computer and so easily discovered
What needs to be done to protect password and user numbers against discovery?
- Change passwords regularly
- Should be memorable but not obviously related to a user’s private life
- be encouraged to never write down their passwords
- strict controls over passwords - they should never be lent or written down where they can be easily seen
- there should be automatic sentinel or watchdog programs to identify when password has been keyed incorrectly
List Physical Facility controls controlling access to sensitive areas
- security guards in buildings
- working areas to which access is through a locked door or a door with an ID card entry system or entry system requiring the user to enter a PIN number
- using safes and lockable filing cabinets
- CCTV used to monitor what is happening in a particular part of a building - this may be backed up by security video cameras
- doors automatically locked in the event of a security alarm
An oil company uses a mainframe computer for a major system and the management believe that it is essential that the continuity of processing must be assured at all times. Which of the following risk control measures is the most appropriate for ensuring that this happens?
A A secure password protection system
B A standby mainframe
C Surplus capacity in the memory of the operational mainframe
D Fire safety measures
B. Mainframe must be in another location and with continually backing up files
the Data Protection Act (DPA) was needed to protect individuals against the misuse of personal data. This was necessary due to:
- Easy interrogation of large files
- Speed of response (lees control)
- Interrogation from outside
- Entire files can be copied or transmitted in seconds
- Computer systems can be cross-linked to obtain personal profiles
- Individuals’ records can be selected easily through the search facilities
Key principles of DPA:
- Personal information shall be obtained and processed fairly and lawfully
- Personal data shall be held and used only for specified purposes
- Personal data shall be adequate, relevant and not excessive in relation to those specified purposes
- Personal data shall be accurate and kept up to date
- Personal data should not be kept for longer that is necessary
- A data subject is entitled to be informed and is:
- entitled to access
- entitled to have data corrected or erased - A data user is responsible for the security and protection of data held against unauthorised access, alteration, destruction, disclosure or accidental loss
Exemptions to the Act. Data subjects are not entitled to see their personal data if it is held for:
- Law enforcement purposes
- Revenue purposes
- Statistical and research purposes
- Regulating of financial service
- Legally privileged reasons
- Back-up security reasons
- Social work
- Medical purposes
The following are exempt from the provisions of the Act:
- Manual records
- Payroll, pension, test preparation, etc.
Which of the following are application controls? (Select all that apply)
A Pre-numbered forms B Validation checks C Buying software from reputable dealers D Renewing licences E Firewalls F Access logging
A and B. C and D are software controls, E is a network control and F is a more general control
The systems development life cycle (SDLC) is assumed knowledge at this level. However, there were six stages within the SDLC, with several activities involved. List those activities:
- Planning - project initiation document, project quality plan, work breakdown structure, budget
- Analysis - get to the root of the problem via user involvement in the form of interviews and questionnaires, complaints review;
- Design - prototyping
- Development - build the system which has been agreed on
- Implementation - staff training, file conversion, documentation, testing
- Review - post completion audit/review on quality, cost, timescale
The system development lifecycle has six stages. The correct order of four of the stages is:
A Analysis; development; design; review
B Analysis; design; development; review
C Planning; analysis; development; design
D Planning; design; analysis; review
B
