1. Thou shalt not use a computer to harm other people.
2. Thou shalt not interfere with other people's computer work.
3. Thou shalt not snoop around in other people's files.
4. Thou shalt not use a computer to steal.
5. Thou shalt not use a computer to bear false witness.
6. Thou shalt not use or copy software for which you have not paid.
7. Thou shalt not use other people's computer resources without authorization.
8. Thou shalt not appropriate other people's intellectual output.
9. Thou shalt think about the social consequences of the program you write.
10. Thou shalt use a computer in ways that show consideration and respect.
Permission to duplicate or distribute this document is granted with the provision that the document remains intact or if used in sections, that the original document source be referenced. © Copyright 1998, Arlene Rinaldi + Florida Atlantic University
I
INTRODUCTION Computer Security, techniques developed to protect single computers and network-linked computer systems from accidental or intentional harm, including destruction of computer hardware and software, physical loss of data, deception of computer users and the deliberate invasion of databases by unauthorized individuals.Computers and the information they contain are considered confidential systems because their use is typically restricted to a limited number of users. Confidentiality and the possession of information can be violated by shoulder surfing, or observing another user's computer screen; tricking authorized users into revealing confidential information; wiretapping, or listening in on or recording electronic communications; and stealing computers or information.
A variety of simple techniques can prevent computer crime. For example, destroying printed information, protecting computer screens from observation, keeping printed information and computers in locked cabinets, and clearing desktops of sensitive documents prevent access to confidential information. But more sophisticated methods are also necessary to prevent computer crimes.
II
ENCRYPTION
One technique to
protect confidentiality is encryption. Information can be scrambled and
unscrambled using mathematical equations and a secret code called a key. Two
keys are usually employed, one to encode and the other to decode the
information. The key that encodes the data, called the private key, is possessed
by only the sender. The key that decodes the data, called the public key, may be
possessed by several receivers. The keys are modified periodically, further
hampering unauthorized access and making the encrypted information difficult to
decode or forge.
III
APPROVED USERS
Another technique
to prevent computer crime is to limit access of computer data files to approved
users. Access-control software verifies computer users and limits their
privileges to view and alter files. Records can be made of the files accessed,
thereby making users accountable for their actions. Military organizations give
access rights to classified, confidential, secret, or top secret information
according to the corresponding security clearance level of the user.
IV
PASSWORDS
Passwords are
confidential sequences of characters that give approved users access to
computers. To be effective, passwords must be difficult to guess. Effective
passwords contain a mixture of characters and symbols that are not real words.
To thwart imposters, computer systems usually limit the number of attempts to
enter a correct password.
Tokens are tamper-resistant plastic cards with microprocessor chips that contain a stored password that automatically and frequently changes. When a computer is accessed using a token, the computer reads the token's password, as well as another password entered by the user, and matches these two to an identical token password generated by the computer and the user's password, which is stored on a confidential list. In the future, passwords and tokens may be reinforced by biometrics, identification methods that use unique personal characteristics, such as fingerprints, retinal patterns, skin oils, deoxyribonucleic acid (DNA), voice variations, and keyboard-typing rhythms.
V
FIREWALLS
Computer networks,
multiple computers linked together, are particularly vulnerable to computer
crimes. Information on networks can be protected by a firewall, a computer
placed between the networked computers and the network. The firewall prevents
unauthorized users from gaining access to the computers on a network, and it
ensures that information received from an outside source does not contain
computer viruses, self-replicating computer programs that interfere with a
computer's functions.
VI SECURITY SERVERS Special computers called security servers provide secure connections between networked computers and outside systems, such as database-storage and printing facilities. These security computers use encryption in the handshaking process, the initiation of the electronic exchange, which prevents a connection between two computers unless the identity of each is confirmed to the other.
VII INTEGRITY AND AUTHENTICITY The integrity and authenticity of information are threatened by modifying, removing, or misrepresenting existing data. For example, omitting sections of a bad credit history so that only the good credit history remains violates the integrity of the document, and requesting a cash advance using a stolen credit card violates the authenticity of that transaction. The most serious threats to integrity and authenticity of information comes from those entrusted with access privileges who commit crimes, for example, secretly transferring money in financial networks, altering credit histories, sabotaging information, and committing payroll fraud. These crimes can be prevented by using such techniques as checksumming (mathematically comparing a file before and after it is accessed), authenticating the source of messages, and limiting the amount of money that can be transferred through a computer.
VIII AVAILABILITY The availability of information is affected if access to the information is prevented; if data are moved, misplaced, or damaged; or if information is converted to a less useful form. Computers and components such as floppy or hard disks are easy to damage. A computer's memory can be erased or the computer's hardware can be damaged by flooding, fire, or dust. To safeguard the availability of information, several backup copies of data should be made and stored in another location. Businesses that rely on computers need to institute disaster recovery plans that are periodically tested and upgraded.
Contributed By: