TOPIC 8: Security, Privacy, and Ethics

8.1  Computer Crime

Hackers usually describes a person who gain access to computer systems illegally. They are ‘clean’ white-collar crimes; no one gets physically hurt. The problems of computer crime have been aggravated in recent years by increased access to computers. Computer crime is serious business and deserves to be taken seriously by everyone.

•	Who Is The Computer Criminal?
	
	A computer criminal is apt to be:
•	someone occupying a position of trust in an organization.
•	has had no previous law-breaking experience
•	young
•	fascinated with the challenge of beating the system

	A few frequent motives that motivates the computer criminal are:
•	they are the disgruntled employee
•	someone suffering from personal or family problems
•	they are simply attracted to the challenge of the crime
•	the ease of the crime that tempts others 

•	Type and Methods of Computer Crime

	Computer crime falls into three basic categories:
•	Theft of computer time for development of software, either for personal use or with the intention of selling it
•	Theft, destruction, or manipulation of programs or data 
•	Alteration of data stored in a computer file

•	Discovery and prosecution

	Prosecuting the computer criminal is difficult because discovery is often difficult. Even if a computer crime is detected, a prosecution is by no means assured, because:
a) 	Some law enforcement agencies do not fully understand the complexities of computer related fraud.
b) 	Few attorneys are qualified to handle computer crime cases.
c) 	Judges and juries are not always educated about computers and may not understand the value of data to a company.

8.2  Security

	Security is a system of safeguards designed to protect a computer system and data from deliberate or accidental damage or access by unauthorized persons.

•	Identification and access
	Various means have been devised to give access to authorized people. These means fall into four broad categories:
•	What you have - to give you physical access to the computer room or a locked-up terminal. A card with a magnetized strip, for example, can give you access to your bank account via a remote cash machine.
•	What you know - a system password or an identification number for your bank cash machine.
•	What you do - for example your signature.
•	What you are - using biometrics, the science of measuring individual body characteristics. For example: voice recognition, fingerprinting, identification by the retina of the eye, etc.

	Some system use a combination of the preceding four categories.

•	When Disaster Strikes

•	Computer installations of any kind can be struck by natural or man-made disasters that can lead to security violations. 
•	Loss of hardware is not a major problem in itself. The true problem with hardware loss is the diminished processing ability that exists while managers find a substitute facility and return the installation to its former state.
•	The more important problem is the loss of data. The cost would be staggering.

•	Disaster Recovery Plan

	A disaster recovery plan is a method of restoring data processing operations if those operations are halted by major damage or destruction. It is by:
•	revert temporarily to manual services
•	buy time at service bureau
•	form a consortium, a joint venture to support a complete computer facility. Among these facilities are:
•	a hot site - is a fully equipped computer center, with hardware, environmental controls, security, and communications facility.
•	a cold site - is an environmentally suitable empty shell in which a company can install its own computer system.
•	The idea of disaster recovery plan is that everything except the hardware has been stored in a safe place somewhere else. 
•	Typically items stored at the backup site are program and data files, program listings, program and operating systems documentation, hardware inventory lists, output forms, and a copy of the disaster plan manual.

	These disaster recovery plan should include these items:

•	Priorities. A list of priorities identifies the programs that must be up and running first.
•	Personnel requirements. The plan should comprise procedures for notifying employees of changes in locations and procedures.
•	Equipment requirements. A list of needed equipment and where it can be obtained will speed recovery efforts.
•	Facilities. Most organizations cannot afford consortiums, so the recovery plan should include a list of alternative computing facilities.
•	Capture and distribution. This part of the plan outlines how input and output data will be handled in a different environment.

•	Software Security

	Software security has been an industry concern for years. It can be copyrighted. If a programmer is employed by an organization, any programs written for the organization belongs to the employer. If the programmer is a consultant, however, the contract must clearly  state whether it is the organization or the programmer that owns the software.

•	Data Security

	Data is one of an organization’s most important assets. Data security is usually done by security officers who are part of top management.
	There are five critical planning areas for data security:

•	Determination of appropriate policies and standards.
•	Development and implementation of security safeguards, such as passwords.
•	Inclusion of security precautions at the development stage of new automated systems, rather than after the systems are in use.
•	Review of state and federal laws related to security.
•	Maintenance of historical records associated with computer abuse.

	

Several data protection techniques are:

•	Secured waste. Waste of computer related materials can be source of information for unauthorized person. Shredders or locked trash barrels an prevent this.
•	Passwords. Good data protection systems change passwords often and also compartmentalize information by passwords, so that only authorized persons can have access to certain data.
•	Internal controls - controls that are planned as part of the computer system. 
•	Auditor Checks. Auditors who frequently review computer programs and data might also check to see who has accessed data during periods when that data is not usually used.
•	Cryptography. Data being sent over communications lines may be protected by scrambling the messages- that is, putting them in code that can be broken only by the person receiving the message. The process of scrambling messages is called encryption.
•	Applicant screening. The weakest link in any computer security system is the people in it. Employers should weed out dishonest applicants before they hired.
•	Separation of employee functions. By limiting employee duties so that doubling up on job functions is not permitted and, therefor, an access to company’s computer system can be restricted.
•	Built-in software protection. Software can be built into operating systems in ways that restrict access to the computer system.

•	Security Consideration for Personal Computers

	Personal computer security includes:
	
•	Locking hardware in place to protect them from being stolen.
•	Providing an appropriate physical environment - including appropriate temperatures.
•	Using surge protector - a device that prevents electrical problems from affecting data files.

•	Viruses and Vaccines

	A virus, as its name suggests, is contagious. It is a set of illicit instructions that infects other programs and may spread rapidly. Some type of viruses include: 
•	The Michelangelo, a destructive program that can cause losing all data on hard disk when switching on computer on March 6, every year.
•	The worm, a program that spreads by replicating itself. 
•	The Bomb, a program intended to sabotage a computer by triggering damage based on certain conditions. 
•	The Trojan Horse, a program that covertly places illegal, destructive instructions in the middle of an otherwise legitimate program.

	A virus can be dealt with by means of a vaccine, or antivirus, program- a computer program that stops the spread of and often eradicates the virus.

8.3	Privacy

8.4  A Matter of Ethics

	Everybody have a clear responsibility to their own organization and its customers to protect the security and privacy of their information. Any compromise of data, in particular, is considered a serious breach of ethics.

8.5  Copying Software

•	It is much more fuss over illegal software copying than over copying music or books. 
•	This is because the pirated software may be valued at hundreds of dollars due to a big investment in developing the software.
•	Some software is considered to be in the public domain because it is free to all. 
•	Software called shareware is also given away free even though it is copyrighted. 
•	Both public domain software and shareware may be copied often and given to other people. 
•	But the software that people use most often, such as Microsoft Word, is copyrighted software, software that costs money and must not be copied without permission from the manufacturer. 
•	Making illegal copies of copyrighted software is called software piracy.
•	Copy protection is a software or hardware roadblock to make it difficult or impossible to make pirated copies.

•	Site Licensing

	A site license permits a customer to make multiple copies of a given piece of software. Typically, a customer obtains the right to make an unlimited number of copies of a product, agrees to keep track of who uses it, and takes responsibility for copying and distributing manuals to its own personnel.

Good Luck!