Network and Telecommunication
Network Component
Risk
Security and Internal Control
Legacy computer systems
Connected computers
Mainframe computers kept in a secure computer room
Easy to protect
form networks
risks increase exponentially as with multiple access points
Network
two or more linked computers and computing equipment
Telecommunication
transfer of text, audio, video, image or other data formats
Local area network(LAN)
A group of connected computers within a short distance of one another
Wide area network(WAN)
connects computers some geographic distance away from one another
Intranet
internal network
Extranet
External networks that connect
Internet - International network of public and private computers
Virtual private network
uses the public Internet as its network system to privately conect
Target for intruders
Threats to network security
social enginering
physical infrastructure threats
programmed threats
denial of service attacks(DOS)
form of manipulation and trickery
Relies on human behaviors
points of vulnerability
Natural element
Natural disaster
power surge
Human attack
Viruses, worms, Trojan horses
Malicious program codes developed by hackers
DOS attack occurs when a system is tied up in such a way that it is unable to perform its functions
Software Vulnerability
Programmed threats and DOS are enabled by "holes”
Weak spots in application and operating system software
Security tools are available for preventing or detecting threats to
networked systems
Network manager - responsible for day-to-day operation of the network
Network security administration- a separate function, create network security plan, develop and communicate security policy for network resources.
Authentication
What they have- exhangeable
What they know- Combinable
Who they are - biometrics of biology characteristics such as fingerprint
Encryption
Scrambling or coding data so that anyone who views it will not be able to make sense of it without a decoder and decryption key
Firewall
Combine software and hardware to control access to an network components
Intrusion Detection Systems
May be included in a firewall package or a stand-alone system
Penetration Testing
Ethical hacking - IT audiors to test their ability to break in an information system - remote and internal access