ICT cont

Page 1

Uses of communication technologies and standards

Relative advantages and disadvantages of networks

Advantages:

Ability to share files - no need to make copies of files as all files can be accessed by all the computers on the network if needed.

Ability to share hardware resources - no need to have a printer for each computer as it can be shared.

Lower software costs - cheaper to buy one network version with a licence for so many users compared to buying individual copies for each computer.

Improved security - easier for network managers to control access from computers to the internet.

Easier to implement acceptable use policies - centralising applications software simplifies the process of implementing software policies in an organisation.

Easier to back up files - performed by network manager rather than individual user. Backing up is therefore taken seriously.

Improved communication - networks have email facilities which will improve communication between workers.

Disadvantages:

Technical knowledge needed.

Lack of access when file server fails.

Cost - high cost of all network equipment and training needed.

TOPIC 5: SAFETY AND SECURITY OF DATA IN ICT SYSTEMS

The need to protect data in ICT systems: privacy and passwords

Personal information held on ICT systems:

- earnings

- vehicle details

- phone call details

- likes and dislikes

- credit history

- purchases made

- exams and qualifications

ICT systems that erode privacy:

- Surveillance cameras (number plate and face recognition systems, etc)

- Phishing (an illegal activity which tries to find out bank details)

- Spyware (used to snoop into your internet use)

- Cookies (record details of visits to websites, what pages you looked at, etc.)

- Marketing database (builds up a profile of your lifestyle)

- Mobile phone records (details of all your calls including your conversations)

- Internet service provider records

- Credit-checking agencies

The use of user-IDs/usernames

- It is unique to a particular user and will normally be an abbreviation for the persons full name

- Using a username, the computer can allow users to have their own personal settings and files

- When a username is entered, the computer will know who is using the computer.

The use of passwords

- First step in protecting an ICT system against illegal access.

- Only known by person who set it up and therefore is used to ensure only that person has access to iCT resources.

- Not displayed on the screen.

Choosing a password

The problem with passwords is:

- people choose simple words because they are easy to remember - makes it easy for hackers to crack

- or they choose pet names, names of football teams or even their own names - easily guessed by friends

- people often have to remember many passwords, so they write it down increasing security risk

- not changed regularly enough

Rules for passwords

- do not use a word that can be found in dictionary

- do not use your own name/surname

- always use maximum number of characters the system allows

- include numbers/letters

- include a mixture of uppercase and lowercase

- do not write password down

- do not tell anyone

- do not use your user-id as your password.

KEYWORDS:

* privacy - being able to choose to keep certain aspects of you life private.

The need to protect data in ICT systems: monitoring

Monitoring

Monitoring at work

- Many organisations monitor their employees use of the Internet.

- Using their user-id, a network manager can find out the amount of time spent on the internet, the websites visited and even look at emails sent.

- Network managers can also look at what programs and data are stored on a users hard drive. Can search for unauthorised software such as music files.

Internet service provider records:

- pages visited

- how long spent on each page

- downloads made.

Spyware

- Spyware is a software which collects information without their consent about the user of a computer connected to the Internet.

- Spyware records details such as:

keystrokes use

web browsing history

- Typical uses of spyware include:

to investigate your searching history on the internet, so you can be targeted for an advertising campaign

intercepting passwords and credit card details for theft/fraud.

- There are many different problems spyware causes such as:

identity theft/fraud - can search for passwords

computer crashes - software may have bugs which cause your computer to crash

poor performance - spyware runs in the background, so it slows down your computer

lots of pop-ups and banner advertisements - wastes time having to close them down

software problems - software can interfere with existing softwares

security software is disabled - spyware can disable firewall and anti-virus software.

- To remove spyware:

install anti-spyware software

install a security suite of software or anti-virus software

install software provided by your internet service provider

- Anti-spyware software will:

scan the memory for any spyware running

scan any new programs that have been downloaded

scan any programs that try to reinstall themselves

scan the entire hard drive periodically

Cookies

- used by websites to collect information about how you use the website.

- a cookie is a small text file downloaded to your computer. Can be used to find out whether the computer has visited site before. Can be used to investigate the pages on the site the user visited.

- To owner of website, cookies provide a way of investigating how users use their site.

- Main problem is that cookies erode our privacy by effectively following our paths through certain websites.

KEYWORDS:

* Cookie - a small text file downloaded to your computer, used by the websites to collect information about how you use the website.

* Internet service provider - the organisation that provides a connection service to the Internet.

* Spyware - software which collects information without their consent about the user of a computer connected to the internet.

The need to protect data in ICT systems: identity theft

Problems with online backing

- Most of the backing problems are caused by the following:

Phishing - fraudsters send random emails asking people who are using the online backing system to update their account details.

Trojans - lines of computer code that are stored in your PC without you knowing. Loaded onto computer when you look at a fake website, or email.

Keeping banking details private

Encryption

- Codes the data whilst it is being sent and only the true recipient is able to decode it.

- Should the data be intercepted by a hacker, then the data will be in code and totally meaningless.

- The process of coding data, sending it over the internet and then deciphering it when it reaches the true recipient, is called encryption.

- Encryption should be used for:

sending credit card details such as card numbers

online banking

sending payment details

confidential emails

- Problems with encryption:

security forces (police) do not like people using codes because they cannot crack themselves because they cannot read the emails

encryption can be used for secret conversations between criminals and terrorists.

Threats to ICT systems: what they are

Where do threats come from?

- viruses

- trojans

- worms

- spyware

- abuse by staff

- hacking

- fire

- theft

- natural disasters

- faulty hardware or software.

Threats from natural disasters

Earthquakes - loss of power, loss of communication lines, damage to ICT systems caused by building collapse.

Tidal waves - occur after earthquakes.

Volcanoes - fire and smoke damage, destruction of buildings

lightening stikes - causes momentary losses of power which can cause data loss. Lightening can also cause more serious damage with the complete loss of hardware, software and data.

floods - water damage to hardware, software and data, loss of power or communication lines.

Threats from fire

- Precautions need to take place to minimise the threat such as:

no smoking in all computer rooms

power sockets should not be overloaded

wiring should be checked regularly for safety

do not leave large quantities of paper lying around

fire alarms/smoke detectors in all rooms

install a sprinkler system

remove backup copies off-site

Computer or hardware theft

- Computer theft involves a thief stealing the computer or other hardware. If a computer is stolen then the hardware, software and data will be lost.

- Laptops are particularly vulnerable to theft because they are:

small, light and easily concealed

often used in public places

put into car boots

very desirable and easy to sell by thieves

Hacking

- The process of trying to break into a secure computer system.

- A hacker is a person who tries to or succeeds in breaking into a secure computer system.

- Once a hacker has gained access to an ICT system they may:

do nothing and be content that they have managed to gain access

gain access to sensitive/personal data

use personal data to commit blackmail

cause damage to data

deliberately alter data to commit fraud

Threats to ICT systems: internal or external, malpractice or crime

Internal and External

> Internal threat - a threat to an ICT system that comes from inside the organisation.

> External threat - a threat to an ICT system that comes from outside the organisation.

- Internal threats would include:

employees introducing viruses deliberately or accidentally.

staff stealing hardware/software/data.

staff accidentally damaging/losing data.

staff compromising the privacy of personal data by leaving computers logged on.

staff hacking into ICT systems that they are not allowed to access.

- Protecting against internal threats:

change passwords regularly.

attach computers to desks to prevent theft.

use passwords/access levels to prevent unauthorised copying of data.

install virus checking software

train staff to prevent accidental mistakes.

- External threats would include:

people from outside the organisation stealing hardware/software/data.

people from outside the organisation hacking into the ICT system to view or change information stored.

natural disasters

loss of telecommunications services

viruses introduced from file attachments

- Protecting against external threats:

install an uninterruptible power supply to prevent loss of power

encrypt data on laptops so if they are stolen the security of the data is not compromised

do not have ICT facilities in areas prone to flooding

use firewall to prevent hacking

use encryption when sending data to prevent misuse of data

Malpractice and crime

> Malpractice - improper or careless use or misconduct

> Crime - an illegal act

- Examples of malpractice:

accidentally deleting data

not backing up data

not scanning for viruses regularly

copying an old version of data over the latest version

allowing your password to be used by others

not logging off the network after use

Viewing inappropriate material

wasting time surfing the internet

- Examples of crime:

hacking

deliberately distributing viruses

illegally copying data or software

stealing hardware

fraud

Protecting ICT systems: methods

Hardware measures

- Include computer and other equipment that can be used to reduce the threats.

Access restrictions

- To prevent theft and illegal access to ICT systems, access to computer rooms can be restricted by the use of keypads.

- Access to rooms and computers can also be restricted using hardware which involves biometric testing.

- Biometric testing involves face recognition, voice recognition, or fingerprint recognition. The advantage is that there are no passwords or combination codes to remember.

- Face recognition systems can restrict access to both rooms and computers. Can be used to monitor the time that the users are at their workstation.

Locking restrictions

- This system uses a card and a card reader to restrict access.

- When the card is removed, you cannot use the mouse, keyboard and see anything on the screen.

- When the card is inserted into the reader the system is restored.

Software measures

Uses of passwords/usernames

> Password - a series of characters chosen by the user that are used to check the identity of the user when they require access to an ICT system.

> User-ID - a name or number that is used to identify a certain user of the network or system. Once the network knows who is using the network, it can allocate resources such as storage area and access to certain files.

Access rights

- Restrict a user's access to only those files they need in order to perform their job.

- Their rights are allocated to them by the network manager and when they log on by giving their user-ID and password, these rights are allocated by the computer.

- A user can have a number of different levels of access to files including:

Read only - a user can only read the contents of the file. They cannot alter/delete the data.

Read/write - a user can read the data held in the file and can alter the data.

Append - they can add new records but they will be unable to alter/delete existing records.

No access - cannot open file so cannot do anything to it.

Firewalls

- Either a hardware/software that works in a network to prevent communication that is not allowed from one network to another.

- A firewall controls the data traffic between two networks and it looks at each packet of data to see if there is anything about the data that breaches the security policy.

- Used to prevent spread of viruses and also to prevent unauthorised access.

- Used to control what outside resources users have access to on the internet.

- Firewalls can be a hardware, software and a combination of both.

Protecting ICT systems: from staff

Procedures

Separation of duties

- Important procedure to protect against fraud.

- Ensures that two or more people should be involved in, for example, dealing with an order.

- One person would place the order but they would not be the same person who issued the payment for it.

- This would help company from paying for bogus orders because collusion between the staff would be needed to commit the fraud.

Non-disclosure

- Non-disclosure agreements are sometimes added to prevent employees passing on confidential information to others.

Careful selection of staff

- ICT staff are in a position of trust and can present a number of threats if they are not chosen carefully.

Retention of staff

- Hard to find suitably qualified and trained ICT staff and it is essential that good staff members are retained.

- Making their jobs interesting and letting them know they are valued as well as paying them well.

Audit trails

- Possible to track all details of a particular transaction.

- Audits are performed at regular intervals and they act as a deterrent, since staff realize that someone is checking things.

- Acceptable use policy

- Makes it clear to all employees/users what is acceptable use and what isn't.

Acceptable use policy

- Protects both the organisation and individuals by providing clear guidelines as to what constitutes use and abuse.

- There are six main areas on a typical IT acceptable use policy:

Introduction - gives general information about the organisation and also outlines the main reasons for having the IT use policy.

General computer use - health and safety information, advice about keeping workstations clean, eating and drinking near computer equipt etc.

Network and internet usage - information about network security - passwords/usernames, logging on/off. Warnings about doing non-work related tasks.

Email - ensuring that emails sent internally and externally are appropriate

Security - outline of the data protection act if personal data is being processed.

Training - must be offered so that all staff understand all aspects of the IT acceptable use policy. Also need training in all the legislation that applies to ICT use.

The problems and the need for legislation: personal data

The data protection act 1998

- covers the misuse of personal data, whether by the use of ICT systems or not.

- Gives right to the individual to find the information stored about them and to check whether it is correct. If information is wrong, they can have it altered and may be able to claim damages if they have suffered loss resulting from this wrong information.

What data is classed as personal data?

- Personal data is:

data about an identifiable person

who is alive

and is specific to that person.

- The data subject must be capable of being identified from the information.

- Data specific to a particular person would include:

medical history

credit history

qualifications

religious beliefs

criminal records.

The eight Data Protection Principles

Personal data shall be processed fairly and lawfully.

Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

Personal data shall be accurate and, where necessary, kept up to date.

Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose/purposes.

Personal data shall be processed in accordance with the rights of data subjects under this Act.

Appropriate technical and organisational measures shall be taken against unauthorized or unlawful processing of personal data and against accidental loss or destruction of, or damage, to personal data.

Personal data shall not be transferred to a country outside the EEA, unless that country ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

Processing personal data

- Processing can mean:

obtaining data

recording data

carrying out any operation or set of operations on data.

The problems and the need for legislation: Data Protection Act 1998

Notification

- Process of letting the Information Commissioners Office know that an organisation is storing and processing personal data.

- The person in organisation who is responsible for the processing of the data (the data controller) will inform the Information Commissioner of certain details such as:

company registration number

the name and address of the data controller

the classes of the data that is held

a general description of the reasons for storing the personal data

a description of the data subjects who the data are about

lists of other organisations to which the data is passed

information about whether the information is passed to other countries outside the EEA.

- Notification can be done:

by post using a special form

over the internet

by phone to the information commissioners office.

- Once the details have been supplied, they will be added to a register that will be made available to the public.

- This will allow the public to find out about organisations processing their personal data.

Exemptions from notification

- The implication of this is that the data subjects no longer have the right to see the data, have it changed or chain compensation.

- Data is exempt:

Where data is being held in connection with personal, family or household affairs or for recreational use.

Where data is used for preparing the text of documents.

Where the data is used for the calculation of wages and pensions.

Where the data is being held in the interests of national security.

Where data is being use for mailing lists, provided that only names and addresses are stored and the individuals must be asked if they object to personal data being held by the user.

Subject Access

- Purpose is so that the data subject can see the personal information to check that it is correct.

What happens if the personal data is wrong?

- Data subject have the right to compensation for financial loss or injury caused by the incorrect data.

- Have the right to the data being corrected or even deleted.

Exemptions from subject access

- Data where subject access could be refused includes:

data used for the prevention or detection of crime

data used for the apprehension or prosecution of offenders

data used for the assessment or collection of tax or duty

The information commissioner

- Duties includes:

responsibility for administering the two acts: Data protection act 1998 and the freedom of information act 2000

to promote good information handling

to investigate complaints

to provide guidelines

to bring legal proceedings, if necessary

The freedom of Information Act 2000

- Gives the right of access to information held by public authorities.

- Using this Act, an individual can access information such as emails, meeting minutes, research reports , etc, held by local authorities. Typically this information would be about:

how public authorities carry out their duties

how they make their decisions

how they spend public money.

- Public authorities include:

central government and government departments

local authorities

hospitals, doctors surgeries, dentists surgeries etc.

schools, colleges, universities

police and prison services.

- The act covers all types of information provided that the information is not covered by the following exemptions:

where the information could jeopardise the prevention or detection of a crime

where the release of the information would harm the public more than not releasing the information.

The problems and the need for legislation: Computer Misuse Act 1990

The computer misuse act 1990

- Passed to deal with a number of misuses as the use of computers became widespread.

- The act makes it an offence to:

deliberately plant or transfer viruses to a computer system to cause damage to programs and data

use an organisations computer to carry out unauthorised work

hack into someone else's computer system with a view to seeing the information or altering it

use computers to commit various frauds.

The problems and the need for legislation: Copyright, Designs and Patents Act 1988

Copyright and licensing

- There are the following problems with computer software:

very easy to copy

very easy to transfer files over the internet

people don't view copying software as like stealing goods from a supermarket.

- There are the following problems with copied software:

not entitled to technical support

do not qualify for upgrades

software may be incomplete

it may contain viruses.

- The process of illegally copying software is called software piracy.

The Copyright, Designs and Patents Act 1988

- This act makes it a criminal offence to copy or steal software.

- Under the act it is a criminal offence to:

copy/distribute software or manuals without the permission or licence from the copyright owner

run purchased software covered by copyright on two or more machines at the same time unless there is a software license which allows it

compel employees to make/distribute illegal software for use by the company.

Consequences of breaking the law

Unlimited fines and up to 10 years imprisonment

you could lose your reputation, promotion prospects and even your job

you could be sued for damage by the software owner.

TOPIC 4 CONT

TOPIC 5

TOPIC 5 CONT

New Page