5.5: Summary

5.1. Information Systems Security

Authentication is the process of verifying whether someone (or something) is, in fact, who (or what) it is declared to be.

The four factors (classes) and some of the elements of each factor are:

• Knowledge
• Ownership or possession
• Inherence
• Location

Simple authentication requires only one such piece of evidence (factor), typically a password.

Multi-factor authentication is an electronic authentication method in which a computer user is granted access to a website or application only after successfully presenting two or more pieces of factors to an authentication mechanism.

Mutual authentication refers to two parties authenticating each other at the same time in an authentication protocol.

A password is a memorized secret, typically a string of characters, usually used to confirm a user's identity.

Leet is a method of typing words using alternate characters.

Identification is basically the process of someone claiming to be a specific person.

The Information Security Triad consists in:

• Confidentiality
• Integrity
• Availability

In order to ensure the CIA of information, organizations can choose from a variety of tools:

• Access Control
• Encryption
• Backups
• Firewalls
• Intrusion Detection Systems
• Physical Security
• Security Policies

BYOD allows the employees or members of an organization to bring their own device to work or school.

5.2. The Ethical and Legal Implications of Information Systems

The term ethics is defined as “a set of moral principles” or “the principles of conduct governing an individual or a group.”

The introduction of new technology can have a profound effect on human behavior. New technologies give us capabilities that we did not have before, which in turn create environments and situations that have not been specifically addressed in ethical terms.

A code of ethics is a document that outlines a set of acceptable behaviors for a professional or social group; generally, it is agreed to by all members of the group. It has advantages and drawbacks.

A hacker is a person who uses technical skill to gain unauthorized access to computer systems, or an expert programmer who deeply understands computer technology.

There are different types of hackers, as: white hat hackers, gray hat hackers, black hat hackers, hacktivists, script kiddies, among others.

Many organizations that provide technology services to a group of constituents or the public require agreement to an Acceptable Use Policy (AUP) before those services can be accessed.

Intellectual property is defined as “property (as an idea, invention, or process) that derives from the work of the mind or intellect.”

Public domain is the realm of creative works that are not protected by copyright and are free for anyone to use, reproduce, distribute, and create derivative works from, without permission or payment to a former copyright owner.

Copyright is the protection given to songs, computer programs, books, and other creative works.

Business method patent is a type of utility patent that protects a process such as one created in a software program.

Personally Identifiable Information (PII) is any information that can be used to identify an individual directly or indirectly, such as a name, email address, Social Security Number or IP address.

Sensitive Personally Identifiable Information (SPII) is any PII that if lost, stolen, or disclosed without authorization could result in significant harm to an individual.

5.3. Windows Security

Computer virus is a type of malicious code or program written to alter the way a computer operates and is designed to spread from one computer to another.

For a virus to infect your computer, you must run the infected program, which in turn causes the virus code to be executed.

Some signs of a computer virus:

• Frequent pop-up windows
• Changes to your homepage
• Mass emails being sent from your email account
• Unusually slow computer performance
• Unknown programs that startup when you turn on your computer
• Unusual activities like password changes
• Frequent crashes

Malware is an abbreviated form of “MALicious softWARE.”

There are various types of malware, including spyware, ransomware, viruses, worms, Trojan horses, adware, or any type of malicious code that infiltrates a computer.

A vulnerability is a system susceptibility or flaw.

Some of the most common computer vulnerabilities are:

The Internet of Things (IoT) is the network of physical objects such as devices, vehicles, and buildings that are embedded with electronics, software, sensors, and network connectivity that enables them to collect and exchange data – and concerns have been raised that this is being developed without appropriate consideration of the security challenges involved.

5.4. Common Cyberthreats

10 most common cyberthreats, for common people: