Exam 2 MIS
CHAPTER 5 DATABASE PROCESSING - - - - - -
Why Study Databases
You need to know if database technology can facilitate your project
How to construct data into useful info
How to change databases
What to know about Databases
A database is an organized collection of data, generally stored and accessed electronically.
DBMS: Database Management System (DBMS) is software that interacts with end-users, applications, and the database itself to capture and analyze data.
What is a Database
Self-describing collection of integrated records
A table or file is a collection of records or rows which are collections of fields or columns which is a collection of characters or bytes
Metadata - Data that describes data elements and their relationships
Primary key - a unique row in a table
Foreign keys - a column is a key but for a different table
Relational databases - carry data in tables and relate through foreign keys
What is a DBMS Forms, Queries, Reports, and Database Applications
Database management system - program used to create, process, and administer a database
Organize and keep track of things
Forms - view data, insert new, update date, and delete data
Reports - structured presentation using filtering, groupign and other operations
Queries - search based on the data provide by the user
Application Programms - provide security, data consistency, special-characrter processing,
Database application - a collection of forms queries and reports that is a intermediary between users and the database
Benefits of a Database management System
Ensures data integrity, security, and consistency
Reduces data redundancy
Improves data access, sharing, and integration
Increases efficiency in handling large amounts and multiple types of data
Allows categorization and structuring of available data
CHAPTER 8. PROCESSES, ORGANIZATIONS, AND INFORMATION SYSTEMS - - - - - -
Basic Types of Processes
Structured process and dynamic process
Structured - very structured and systematic always the same
Dynamic - unstructured and not the same every time
IS and Process Quality
Process efficiency -
Ratio of inputs and outputs
Process effectiveness -
How well a process achieves organizational strategy
How to improve
Change process structure
Reorganize the process or redesign
Ex: sale of product online
May increase effectiveness. If cost strategy, no special terms. Should eliminate the third activity. More effective
Change process resources
Change(add or subtract) allocation of humans and information systems resources
If the process takes too long, identify the source of delays and add more resources
Ex; self-checkout to congested, add more cashiers
Change both
The most common type.
Enterprise Systems and Departmental Silos
Information silos exist when data are isolated in separate information systems
Causes multiple problems
Data duplication
Data inconsistency
Data isolated
Disjointed processes
Lack of integrated enterprise information
Inefficiency: decisions made in isolation. Incomplete data to make a full correct decision
Increase cost for the organization
CRM, ERP, and EAI support of Enterprise Processes
Networking, data communication, and database technologies
Business process engineering
Companies realized the need for stronger, faster, more effective, linkages among value chains
Need role to design enterprise system
The process is slow and difficult as well as expensive
High-level skills and time
Enterprise application solutions
Inherent processes
Predesigned process for using the application
Industry best practices
Customer relationship management (CRM)
Enterprise Resource Planning (ERP)
Enterprise Application Integration (EAI)
Traditional approach - history
Transactional process systems (TPS)
A transaction that generated data
All separate
Needed to consider concurrency
Failure of any component at any time will cause an error
Functional Area information system (FAI)
Finally, Customer Relationship Management (CRM)
The suite of applications, database, and series of inherent processes
Manage all interactions with customers through four phases of the customer life cycle
marketing/attracting them, customer acquisition, relationship management, loss of customer,s and churning them back
Prospect orders and relationships increase value by selling more products. Overtime will lose custom, but can win back
CRM applications
Suite of apps
Every contract/transaction is recorded
Helps to increase value by trying to sell more product
Make the organization more customer-centric
Also offers to win back
Enterprise Resource Planning (ERP)
Suite of apps
The integration allows real-time updates
Designed to correct lack of communication among functioning areas
Integrate planning, management, and use of all organizational resource
Could be on premise or on software service
Enterprise Application Integration (EAI)
Useful when ERP is not suitable
Nonmanufacturing company or conversion of old system to ERP not justified
A suite of programs that integrate exiting systems - Middle ware
Connects systems “islands”
Enables communication and sharing data
Provides integrated information
Less expansive
Challenges of implementing and upgrading Enterprise Information Systems
Collabrative management
No single manager. Need to define conflict resolution. Comittees or steering groups
Requirement Gaps
Few ERP devolped from scratch. Liceased purchase products are not perfect fit
Identify gaps, then decide what to do with them
Transition problems
Change from isolated system to new enterprise system. Planning an training
Employee resistance
Change reuires effort and creates fear
Clear communication from top management, self efficacy threat to employees, and employees need to see benefits
New technology
Importance and value of new technology in strategy
Cloud and mobile technologies. Challenge and security
Inter-Enterprise IS and Enterprise Silos
information silos
Stand alone
Inter-enterprise information systems
Referred to as distributed systems
Allows users to receive and display data to multiple diverse devices
CHAPTER 12. INFORMATION SYSTEMS DEVELOPMENT - - - - - - - - -
What is Systems Development
Also called system analysis and design
Process create and maintain information systems
Requires all 5 components: hardware, software, data, procedure and people
More than programming, local expertise, or computer program development
Establish system goals, set up the project, and determine requirements
Not technical only. Requires business knowledge and management skills
Build computer network, write computer programs, create data models, design procedures, develop job descriptions, staffing and training
3 sources of software
Off the shelf
Off the shelf with adaptation
Custom made
Only off the shelf with adaptation and custom-made pertain to information systems. It involves procedures and people it needs to fit organizational goals
Key role in information systems development as business manager
Effective procedures exist
Trained personal
Users to take ownership of their systems
Systems Development difficulties and risks
Difficulties in requirements. Always changing
Scheduling and budgets involved
Change in requirements
Changing technology
Diseconomies of scale (marginal contribution per worker decreases with a larger number of workers)
Mongolian horde theory: “If a product software project falls behind you can just hire more people to pick up the work”
5 phases of the System Development Life Cycle
System Definition Phase
The first phase in SDLC, helps define goals, assess feasibility, form a team, and plan the project
Requirements Analysis Phase
Second phase, conduct user interviews, evaluate existing systems, identify new features, including security
Component Design
Third phase, developers determine hardware and software speciation, design the database, design procedures, and create a job description
System implementation
The fourth phase, build, test, and convert users to the new system
System Maintenance tasks
fifth phase, fix the system to what it was supposed to do in the first place and adapt the system to new requirements
Problems with Software Development Life Cycle (SDLC)
Variable Scope: Frequent changes in requirements can make it hard to predict the final scope of the project.
Uncertain Costs and Timeline: Iterative development means that the exact time and cost of completing the project can be difficult to estimate upfront.
CHAPTER 10. INFORMATION SYSTEMS SECURITY - - - - - - - - -
IS Security Background
Organizations collect large amounts of information, use multiple IS subject to threats
Threat: danger to which a system can be exposed
Exposure: harm, loss, or damage
Vulnerability: Possibility that threat will harm a resource
Multi-connected, interdependent networked business environment. Larger exposure
Smaller, faster, cheaper processing and storage devices. Easier to steal or lose data
Decreasing skills required to become a hacker. Scripts available, zero-day exploit lists ( no patch vulnerability)
International crime groups on the dark web, cybercrime. billion-dollar crime networks
Disregard of the manager of procedures, lack of support for security policies
Unintentional threats
Acts perfomred without malicis intent but still are a threat to information security
Programming apps contrary to specs, bypassing security mechanism, install unauthorized apps
Theft of confidential data, data entry errors, lack of training, easy-to-guess passwords
Accidental information leakage, failure of protection mechanism, virus or malware
Natural disasters, flooding, storms, fire
Careless of computer devices, open questionable emails, contract labor access
Deliberate threats
Espionage
Sabotage or vandalism
identity theft
Information Hijacking. Ransomware
cyberterrorism
Information Systems Security goal
Trade-off
Security and freedom. Force to use a stronger generated password instead of your own
Cost and risk. Security threat/loss scenario
Is the thread/loss scenario
Major elements of IS security
Threat person or organization trying to seek another company or person's information illegally
Vuneralabity - an opportunity for the threat to gain access
Safeguard - measure in place to stop people from gaining access
Target - asset desired by the threat
Computer Security Problem
Human error
Computer crime
Natural diasasters
Types of secutriy loss
Unathorized data disclosure
Pretexting - pretending to be someone else
Phishing - pretexting email
Spoofing - ip spoofing
Sniffing - searching unprotected networks
Hacking - breaking into computers, servers, and networks to steal data
Natural disasters
Incorrect data modification
Wrong design procedures
Increase customer discount or salary by mistake
Incorrect data on the company website
Faulty service
Incorrect data modification
Procedural modification
Programming errors
IT installation problems
Denial of Service (DoS)
Unintentional
Human error not following procedures to create a web server to shut down
Intentional
Malicious outside flood of web server service calls so normal requests cannot be processed
Loss of infrastructure
Accidents.
Theft
Terminated employee revenge
Natural disaster
Information System security goal
Find appropriate trade-offs between risk and cost by
implementing safeguards
Protective actions
Use antivirus software
Delete browser cookies
Make appropriate trade-offs to protect yourself and your business
Security Threads. How to respond
IDS or Intrusion Detection System - a computer system that detects when another computer is attempting to scan or access a computer of network
Multiple passwords
Use trusted websites
Regularly update antivirus software
Remove high value assets from the computer
Protecting against Security Threats
Personal security safeguards
Take security seriously. Consider security for all business initiatives
Use multiple and strong passwords
Send no valuable data via email or Instant Message
Use HTTPS at trusted, reputable vendors
Remove High-value Assets from the computer
Clear browsing history, temporary files, and cookies. Settings or cleaning apps
Regularly update antivirus software
Demonstrate security concerns to your fellow workers
Follow organizational security directives and guidelines
Security policies
Company wie policies
Sensitive data to store and how to process it
What to share with other organizations
Technical Safeguards
Involve harware and software componest of information systems
examples : identification and authentication, encryption, firewalls, malware protection, design for secure applications
How SSL/TLS works with a website
A computer obtains a public key of wub site to whci it connect
The computer generates an encryption key
A computer using web sites public key and encrypts
Web site decodes symmetric key using its private key
Fire walls - multiple -
Perimeter firewall outside of organization. Filters everything that goes into company
Computer should not connect without a fire wall
Malware protections (viruses, spyware, adware)
Install antivirus and antimalware apps
Frequent scanning
Update definitions
Open emails only from known sources
Get updates and browse reputable domains
Type of malware and spyware symptoms
Malware
Virusus - slow symptom start up
Payload- sluggish systme performance
Trojan horses - many pop-ups ads
Worms - suspicious browser homepage changes
Spyware - suspicious changes to takes bar and other system interfaces
Keyloggers
Adware - unusual hard-disk activity
Ransomware
Payload- code that causes unwanted activity, such as deleting programs or data, or modifying data in undetected ways
Spyware - on computer without users knowledge
Key loggers- track every key you type
Adware - usually benign
SQL injection attacks
Users get SQL statements in form instead of name or other data
Intercept SQL parameters and modify queries response
Result: exposes unwanted data, damage date, possible data loss
Well designed applications make injections impossible
Data Safeguards
Protect Database and other organizational Data (spreadsheet, shared drives)
Data administration . develop data polices and enforce data standard
Database administration. Function of particular DB
Key Escrow. Sensitive data in encrypted form and how you will save encryption key
Define data polices
Data rights and resposibilities
Rights enforced by user accountant authenticate by passwrods
Legal standards specify safeguards organizatoins must follow regarding data collected and stored
Multinational organizations must understand every country in which they operate
Payment card industry data security standard
Gramm leach bliley act - health access protection
Sarbanes-oxley Act - securities act amendments
Human Safeguards
Security considerations for employees
Give the least privilege to complete the job, seerate duties
Employee screening
Dissemination and enforcement
Responsibility accountability and polices
Termination
Friendly - move them to differnt system and pause aocunts
Unfriendly
Turn off their account
Safe guards for non employee personal
Require apporipiate screening anf training
Give them the minimum privilege in your accounts
Public user considerations
Harden the system vulnerabilities
Protect users from interal company secirty problems
Account adminsitation
Account management
Standards for new users modify account permissions and double-check
Password management
Change password frequently
Help desk policies
Provide means of authenticating users
System security procedure s types
Normal operation
Back up
Recovery
These help reduce inside computer crime and malcious acitvity
Security monotoring
Last human safeguard
Activity logs
Server logs and firewall log
List all information in an out
DBMS - log all successful and unsuccessful logins
Webservers
Employ utilities to help access and fix vulnerabilities
Honey pots- for computer criminals to attack, false target, helps to investigate them
Constantly monitor
Security Incidents response
Have a plan in place
Have a way to centralize reporting
Specific response
Speed - longer incident goes on = higher cost for you
Preparation helps a lot
Dont make problems worse
Practice incidents
Create and use strong passwords
HO.RIGHTS AND RESPONSIBILITIES
Data User Rights and Responsibilities
User rights
Right to have the computing resources you need to perform work proficiently
Right to a reliable network
Right to secure computing network
Right to participate in requirements meetings for new applications that you will use and for major changes to applications that you currently use
Right to a reliable system, development, and maintenance
Right to receive prompt attention to your problems, concerns, and complaints about your information systems
Right to effective training
User Responsibilities
Responsibility to learn basic computer skills, techniques, and procedures for the applications you use
Responsibility for following security and backup procedures
Responsibility to use your computer resources in a manner that is consistent with your employer's policy
Responsibility to make no unauthorized hardware modifications to your computer and to install only authorized programs
Responsibility for installing computer updates and fixes when asked to do so
Responsibility to treat information systems professionals professionally
Cell phone policies