OMIS 1050 WEEK 12

What are the ethical issue categories?

• privacy

• accuracy

• property

• accessibility

What is info privacy?

right to determine info time & extent gathering & communicating

What rules do court decisions follow about privacy?

• NOT absolute privacy right

• right to know: collective > individual

What are some privacy threats?

• data aggregator / digital dossier / profile

• e-surveillance

• info in database & e-bulletin board / newsgroup / social network

What is a data aggregator?

company collecting non/public data & producing digital dossier

What is a digital dossier?

e-description

What is profiling?

creating digital dossier

What are some e-surveillance examples?

• cam

• sensor

• geotag

• drone

• Google / Microsoft street view image

What are some concerns about info provided to record keepers?

• where’s the data?

• accurate data?

  • change inaccurate data?

  • time?

• when will data release?

• data use?

• who gets data?

  • security?

What are informed consent methods?

opt-…

• in

• out

What does P3P stand for?

Platform for Privacy Preferences

What is P3P?

protocol communicating privacy policy between site & visitor

What is PIPEDA?

Personal Information Protection & Electronic Documents Act

Why was PIPEDA developed?

Canada e-commerce strategy component

What is the most important factor for ensuring high customer trust?

personal info protection

What does PIPEDA specify?

fair info principles

What are the fair info principles?

• accountability

• purpose

• consent

• collection & use / disclosure / retention limit

• accuracy

• safeguard

• openness

• access

• compliance challenge

What are some info security threats?

• natural & manmade disaster

• employee

  • application & system programmer

  • operator

  • user

• hardware

  • terminal

  • PCS

  • database

• insider

• system software

What are the info system threat categories?

• unintentional act

• intentional act

• natural disaster

• tech failure

• management failure

What are some unintentional act threats?

• human error

• environment hazard

What are the human error risk areas?

• HR

• info system

What are some intentional act threats?

• software attack

• identity theft

• espionage / trespass

• info extortion

• sabotage / vandalism

• theft

What are the software attacks?

• virus

• worm

• trojan horse

• logic bomb

• DOS

• social engineering

• identity theft

What is a virus?

computer code segment

• attach to other program

What is a worm?

computer code segment

• spread by itself

What is a trojan horse?

software

• hide in other program & reveal behaviour when activate

What is a logic bomb?

computer code segment

• embed in existing program & activate destructive act at date / time

What does DOS stand for?

Denial Of Service

What is DOS?

performing attack preventing system from providing service to user

What is social engineering?

attack using social skills to trick employee to provide info

What is social engineering also called?

phishing

What are some social engineering examples?

• credit card number

• phony message & site

What is the fastest growing info crime?

identity theft

What do firms do to protect info?

• info security control

What is info security control?

• layer control

• business continuity plan

What are the control layers?

• environment

• general

• application

What is environment control?

• management attitude BY

  • action

  • policy

    • ethics

    • supervision quality

What is general control?

security system requiring user & password

• firewall

What is application control?

• individual area

  • input

  • process

  • output

What is application control’s purpose?

• accuracy

• completeness

• authorization

• audit trail

Where are general controls located?

• physical

• access

• communication

What are the access controls’ authentications?

something the user…

• is

• has

• does

• knows

What defines “something the user is?”

biometrics

What is biometrics?

examining innate physical characteristic

What defines “something the user has?”

• ID & smart card

• token

What defines “something the user does?”

• voice

• signature recognition

What defines “something the user knows?”

pass…

• word

• phrase

What are some communication controls?

• firewall

• antimalware

• white / black …list

• intrusion detection

• encryption

What is the cheapest control to execute but hardest to implement?

security policy

Why is shaping policy difficult?

• ensure no law conflict

  • if challenge, stand in court

• properly administer