Test 4 1. Security is not simply a technology issue, it is a business issue. Discuss
Security's days as just a technical issue are done. It is becoming a central concern for leaders at the highest level of many organizations and governments, transcending national borders. Customers are demanding it as worries about privacy, the protection of personally identifiable information, and identity theft grow. Business partners, suppliers, and vendors are requiring it from one another, particularly when providing mutual network and information access. Networked efforts to steal competitive intelligence and engage in extortion are becoming more prevalent. Security breaches and data disclosure increasingly arise from criminal behavior motivated by financial gain.

2. Suppose your business had an e-commerce Web site where it sold goods and accepted credit card payments. Discuss the major security threats to this website and their potential impact. What can be done to minimize these threats?
E-commerce utilizes internal networks that interface with the World Wide Web. The nature of this kind of business, introduces internal and external risks to both the website and the business systems to which it is connected too. An E-commerce website can be faced some security threats that have to be addressed, to avoid any losses and intrusions. E-commerce websites are vulnerable to fraud from internal and external sources. Fraud incidents include credit card fraud, which exposes the website to threat from clients and any other external sources and internal fraud. Any fraudulent transactions being entered into the system from employees. Such transactions can also be introduced into the system by hackers or Trojan Horses, which resemble the real customers’ transactions. To prevent fraud, Fraud scoring must be used. It is a system of predictive fraud detection models or technologies that payment processors use to identify the highest-risk transactions in card-not-present environment that require additional verification. All card-not-present transactions must be authorized before they are processed. The authorization response will typically be approval or decline. You should develop a process for handling transactions after the authorization response has been received and apply it consistently. A website that has been invaded by viruses and malicious software, can come crushing which will make the website lose the entire information causing losses to the e-commerce business. This can cause the clients to lose trust in the business, and as a result they can close their accounts on the website. Loss of information on a website can be devastating for both the business owner and the client especially if the information was not backed up.
One of the greatest threats to an e-commerce is poor management. When the management is not committed to ensuring security and does not support budgets for purchase of anti-virus software licenses, that keep internal networks robust will cause pose a big security threat. The lack of proper anti-virus makes the e-commerce vulnerable to viral attacks. To minimize or reduce this threat, Management should commit to regular IT security audits of the e-commerce website to ensure that security is optimized and all potential problems are dealt with as soon as they occur.

3. Why are information systems vulnerable to destruction, error, and abuse?
Digital data are vulnerable to destruction, misuse, error, fraud and hardware or software failures. The Internet is designed to be an open system and makes internal corporate systems more vulnerable to actions from outsiders. Hackers can unleash denial-of-service (DoS) attacks or penetrate corporate networks, causing serious systems disruptions. Wi-Fi networks can easily be penetrated by intruders using sniffer programs to obtain an address to access the resources of the network. Computer viruses and worms can disable systems and Web sites. The dispersed nature of cloud computing makes it difficult to track unauthorized activity or to apply controls from afar. Software presents problems because software bugs may be impossible to eliminate and because software vulnerabilities can be exploited by hackers and malicious software. End users often introduce errors.

4. Define identity theft and phishing and explain why identity theft is such a big problem.
Identity theft is a crime in which an impostor obtains key pieces of personal information, such as social insurance number, driver's license number, or credit card numbers, to impersonate someone else. The information may be used to obtain credit, merchandise, or services in the name of the victim or to provide the thief with false credentials. It is a big problem today as the Internet has made it easy for identity thieves to both obtain and use stolen information because goods can be purchased online without any personal interaction. Credit card files are a major target of website hackers. Moreover, e-commerce sites are wonderful sources of personal information that criminals can use to establish a new identity and credit for their own purposes.
Phishing involves setting up fake websites or sending email messages that look like those of legitimate businesses that ask users for confidential personal data. The email instructs recipients to update or confirm records by providing social insurance numbers, bank and credit card information, and other confidential data either by responding to the email message or by entering the information at a bogus website.

5. List and describe the most common threats against contemporary information systems. * The multi-tier client/server computing environment: The vulnerabilities exist at each layer and in the communication between the layers. The user often unauthorized access and introduce errors. * The communications lines: The common threats are tapping, sniffing, message alteration, theft and fraud and radiation. * The Corporate Servers: The most common threats are hacking, viruses and worms, theft and fraud, vandalism and denial-of-service attacks. * The Corporate Systems: The most common threats are theft of data, copying data, alteration of data, hardware failure and software failure.