C HAPTER 9

Information Systems Controls for System Reliability Part 2: Confidentiality and Privacy

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

1 of 26

INTRODUCTION
Questions to be addressed in this chapter include:
What controls are used to protect the confidentiality of sensitive information? What controls are designed to protect privacy of customers personal information? Explain how the two basic types of encryption systems work.

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

2 of 26

CONFIDENTIALITY
SYSTEMS RELIABILITY PROCESSING INTEGRITY

CONFIDENTIALITY

According to the Trust Services framework, reliable systems satisfy five principles:
Security (discussed in Chapter 8) Confidentiality Privacy Processing integrity Availability
AVAILABILITY

SECURITY
2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart 3 of 26

PRIVACY

Confidentiality
Identification and Classification

Where is the information, who has access to it? Classify value of information

The process of obscuring information to make it unreadable without special knowledge, key files, or passwords.
Encryption

Controlling Access

Information rights management: control who can read, write, copy , delete, or download information.

Training

Most important! Employees need to know what can or cant be read, written, copied, deleted, or downloaded

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

4 of 26

Identification and Classification

Intellectual Property (IP)
Strategic plans Trade secrets Cost information Legal documents Process improvements All need to be secured

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

5 of 26

Encryption
Encryption alone is not sufficient to protect confidentiality. Given enough time, many encryption schemes can be broken. Access controls are also needed Strong authentication techniques are necessary.

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

6 of 26

Controlling Access
Information Rights Management (IRM) software
Can limit the actions (read, write, change, delete, copy, etc.) that authorized users can perform when accessing confidential information

Physical access controls System outputs

Magnetic and optical media

Data Loss Prevention (DLP) software Voice-over-the-Internet (VoIP) technology Virtualization and cloud computing

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

7 of 26

Training
Employee use of email and instant messaging (IM) probably represents two of the greatest threats to the confidentiality of sensitive information. Use of encryption software Leaving workstations unattended Code reports to reflect importance Clean desk policy

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

8 of 26

PRIVACY
SYSTEMS RELIABILITY PROCESSING INTEGRITY

In the Trust Services framework, the privacy principle is closely related to the confidentiality principle. Primary difference is that privacy focuses on protecting personal information about customers rather than organizational data.
9 of 26

CONFIDENTIALITY

SECURITY
2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

AVAILABILITY

PRIVACY

Privacy
Same controls as confidentiality
Identification and classification Encryption Access control Training

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

10 of 26

Privacy Concerns
SPAM
Unsolicited e-mail that contains either advertising or offensive content Controlling the Assault of Non-Solicited Pornography and Marketing Act. CAN-SPAM (2003)
Criminal and civil penalties for spamming

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

11 of 26

Privacy Concerns
Organizations must carefully follow the CAN-SPAM guidelines, which include:
The senders identity must be clearly displayed in the message header. The subject field in the header must clearly identify the message as an advertisement or solicitation. The body must provide recipients with a working link that can be used to opt out of future email. The body must include the senders valid postal address. Organizations should not: Send email to randomly generated addresses. Set up websites designed to harvest email addresses of potential customers.
2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart 12 of 26

Privacy Concerns
Identity Theft
The unauthorized use of someones personal information for the perpetrators benefit. Companies have access to and thus must control customers personal information.

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

13 of 26

Privacy Regulatory Acts

A number of regulations, including the Health Insurance Portability and Accountability Act (HIPAA), Health Information Technology for Economic and Clinical Health Act (HITECH), and the Financial Services Modernization Act (aka, Gramm-Leach-Billey Act) require organizations to protect the privacy of customer information.

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

14 of 26

ENCRYPTION
Encrypting sensitive stored data provides one last barrier that must be overcome by an intruder. Encryption plays an essential role in ensuring and verifying the validity of e-business transactions. Therefore, accountants, auditors, and systems professionals need to understand encryption.

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

15 of 26

Plaintext

This is a contract for . . .

Key

ENCRYPTION
Encryption is the process of transforming normal text, called plaintext, into unreadable gibberish, called ciphertext. Decryption reverses this process. To encrypt or decrypt, both a key and an algorithm are needed.

Encryption Algorithm
Key

Ciphertext

Xb&j &m 2 ep0%fg . . .

Decryption Algorithm

Plain- This is a contract text

for . . .
2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart 16 of 26

Encryption Strength
Key length
Number of bits (characters) used to convert text into blocks 256 is common

Algorithm
Manner in which key and text is combined to create scrambled text

Policies concerning encryption keys

Stored securely with strong access codes

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

17 of 26

ENCRYPTION
Types of Encryption Systems
There are two basic types of encryption systems
Symmetric encryption systems Asymmetric encryption systems

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

18 of 26

ENCRYPTION
Symmetric Encryption Systems
Use the same key to encrypt and decrypt. Symmetric encryption advantages: It is much faster than asymmetric encryption. Symmetric encryption disadvantages: Both parties need to know the secret key, so a method is needed to securely exchange the keys, and email is not an appropriate solution. A different key needs to be created for each party with whom the entity engages in encrypted transactions. Since both sides of a transaction are using the same key, there is no way to prove which of the two parties created a document.

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

19 of 26

ENCRYPTION
Asymmetric encryption systems
Use two keys:
The public key is publicly available. The private key is kept secret and known only to the owner of that pair of keys.

Either key can be used to encrypt. Whichever key is used to encrypt, the other key must be used to decrypt. The main drawback to asymmetric encryption is speed.
2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart 20 of 26

ENCRYPTION
Hybrid Solution
Use symmetric for encrypting information Use asymmetric for encrypting symmetric key for decryption

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

21 of 26

Hashing
Converts information into a hashed code of fixed length. The code can not be converted back to the text. If any change is made to the information the hash code will change, thus enabling verification of information.

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

22 of 26

Digital Signature
Hash of a document that is encrypted using document creators private key Provides proof:
That document has not been altered Of the creator of the document

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

23 of 26

Digital Certificate
Electronic document that contains an entitys public key Certifies the identity of the owner of that particular public key Issued by Certificate Authority Public Key Infrastructure (PKI)

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

24 of 26

Virtual Private Network (VPN)

The internet provides inexpensive transmission, but data is easily intercepted. Encryption solves the interception issue. If data is encrypted before sending it, a virtual private network (VPN) is created.
Provides the functionality of a privately owned network But uses the Internet

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

25 of 26

Virtual Private Network (VPN)

Private communication channels, often referred to as tunnels, which are accessible only to those parties possessing the appropriate encryption and decryption keys.

2012 Pearson Education, Inc. Accounting Information Systems, Romney/Steinbart

26 of 26