Lecture 10: COMPUTER SECURITY, ETHICS AND MAINTENANCE

INTRODUCTION

Managing computer security is vital considering the amount of data stored. Preventing and detecting unauthorized use of your computer requires special skills. When your computer is connected to the Internet, the risk become high and security become the most important aspect that you need to consider. In this lecture, various aspects of computer and IT security will be discussed.

LECTURE OBJECTIVES

UTER AND IT SECURITY

Computer security is a way of protecting a computer device from harms caused by malicious programs (Trojan horses and viruses). It is a protection of computing systems and the data that they store or access. The IT security is overall protection of computers, networks and data from unauthorized access and harms caused by malicious programs.

The IT security is sometimes used interchangeably with the term Cybersecurity. Cybersecurity is the protection of internet-connected systems, including hardware, software and data, from cyberattacks. In a computing context, security comprises cybersecurity and physical security — both are used by enterprises to protect against unauthorized access to data centers and other computerized systems.

Information security, which is designed to maintain the confidentiality, integrity and availability (CIA) of data, is a subset of cybersecurity. The CIA make major three security requirements in any computer systems and applications.

Importance of Computer Security

Computer security allows users to carry out their activities safely without interruption, loss or damage. It supports critical business process and protects personal and sensitive organizational information. Everyone who uses a computer or mobile device needs to understand how to keep their computer, device and data secure, that is IT security is everyone’s responsibility.

Consequences for Security Violations

The consequences for security violations involve:

risk to security and integrity of personal or confidential information such as identity theft, data corruption or destruction, unavailability of critical information in an emergency, etc.

Loss of valuable business information.

Loss of public trust, embarrassment, bad publicity, media coverage, news reports.

 

Costly reporting requirements in the case of a compromise of certain types of personal, financial and health information.

Disciplinary action(s) as well as possible penalties, prosecution and the potential for sanctions / lawsuits.

Internet – Hazardous Place

The Internet is hazardous place due to number of computer attacks that are taking place daily. An unprotected computer can become infected or compromised within a few seconds after it is connected to the network and become threat to everyone. A hacked computer can be used to record keystrokes

and steal passwords, send spam and phishing emails, harvest and sell email addresses and passwords, access restricted or personal information, infect other systems, hide programs that launch attacks on other computers, illegally distribute software, distribute child pornography, generate large volumes of traffic and slowing down the entire system.

Protection Using ICT

Information security is defined as preservation of information confidentiality, integrity and availability. It involves set of rules of data protection on physical, technical and organizational level. It involves user authentication (user identification) where users gain access to a certain content (data) by login with username and password.

If the username and password is entered correctly, access to the system is granted. However, many cyber security threats are largely avoidable. Some key steps that everyone can take include: good, cryptic passwords that can’t be easily guessed and keep passwords secret.

ke sure your computer, devices and applications (apps) are current and up to date.

Make sure your computer is protected with up-to-date antivirus and anti-spyware software.

 

Don’t click on unknown or unsolicited links or attachments, and don’t download unknown files or programs onto your computer or other devices.

Remember that information and passwords sent via standard, unencrypted wireless are especially easy for hackers to intercept.

To help reduce the risk, look for “https” in the URL before you enter any sensitive information or a password. Note that the “s” stands for “secure”.

PASSWORD is a Password?

 password is a key that allows access. A computer password is a basic security mechanism that consists of a secret pass phrase created using alphanumeric and symbolic characters to restrict access to a system, application or service to only those users who are authorized to use it. A password may also be called an access code, PIN or secret code.

A password is one of the most used access control procedures applied in virtually all digital and computing appliances. Generally, a password is used in combination with a user name and in most cases an individual must provide both to gain access to a system, network or other password-protected area.

In most applications, passwords are created by the user themselves and are typically separate for each different system. The term password is also referred as passphrase for when the password uses more than one word, and passcode and passkey for when the password uses only numbers instead of a mix of characters, such as PIN number. Passwords are sometimes called “watchwords”.

Creating a Secure Password

To attain maximum security, a password should be strong and secured. Although passwords vary in length, but in good security practices, a password should be between eight and 24 characters long, and include at least one capital letter, one number and one special character. Some of the best practices for creating a secure password include: not use frequently used or common words as password as they are more easily guessed or cracked, i.e. phrases which are on a password blacklist like ‘123456’

Use a minimum length of eight characters,

Use combination of both uppercase and lowercase letters,

Include at least one number from 0 to 9,

Include at least one special character such as $, #, *, @, ?, /, etc.

Change password regularly i.e. put time limit for password usage.

Avoid reuse of password.

Use password that is hard to guess by others but easy to remember by yourself.

Password Management Good password management practices are required to be maintained so that a strong created password remains to be secured throughout its lifetime. Some of the good password management practices from user perspective include: not display the password on the display screen as it is being entered,

Avoid reusing single password for multiple systems,

Do not write down your passwords on paper,

Do not use common words for password such as “password”, or “123456”,

The password management practices from system perspective include:

Requiring passwords of adequate length,

Requiring users to re-enter their password after a period of inactivity. This is called a semi log-off policy.

Requiring periodic password changes,

Assigning randomly chosen passwords,

Requiring passwords of combination of alphanumeric, symbols with upper and lower cases.

Providinganalternativetokeyboardentry(e.g.,spokenpasswords, or biometric passwords).

Requiring more than one authentication system, such as two-factor authentication (something a user has and something the user knows).

Using encrypted tunnels or password-authenticated key agreement to prevent access to transmitted passwords via network attacks

Limiting the number of allowed failures within a given time to prevent repeated password guessing.

Introducing a delay between password submission attempts to slow down automated password guessing programs.

Some of the more stringent policy enforcement measures can pose a risk of alienating users, possibly decreasing security as a result.

OTHER AUTHENTICATION OPTIONS

There are many authentication options available today so that users do not have to rely on passwords that can be easily cracked or compromised. These options include the:

Two-factor authentication (2FA) which requires users to provide two authentication factors that include a combination of something the user knows like a password or PIN; something the user has like an ID card, security token or smartphone; or something the user is — biometrics.

Biometrics which is mainly used for identification and access control physiological characteristics such as such as fingerprints or retinal scans, and behavioral characteristics such as typing patterns and voice recognition.

Tokens which involve a physical hardware device like a smart card or key fob that a user carries to authorize access to a network.

One-time passwords (OTP) which is an automatically generated password that only authenticates a user for a single transaction or session. These passwords change for every use and are typically stored on security tokens.

Social logins when users can authenticate themselves on applications or websites by connecting to their social media account such as Facebook or Google instead of using a separate login for each and every site.

TYPES OF CYBERSECURITY THREATS

The process of keeping up with new technologies, security trends and threat intelligence is a challenging task. However, it is necessary in order to protect information and other assets from cyberthreats, which take many forms.

Malware is any file or program used to harm a computer user, such as worms, computer viruses, Trojan horses and spyware. A malware is malicious software which infiltrates an OS in a seamless manner, whether by human mistake or due to shortcomings of the OS and software support, with malicious intentions. Malicious software includes:

Virus which is a malicious program with the possibility of self-replication. In a computer it seeks other files, trying to infect them and the ultimate goal is to spread to other computers. Depending on what malicious code it contains, it may cause more or less damage to your computer.

Worm like virus, possess the ability of self-replication but cannot infect other programs. Their usual intent is to take control of your computer and allow remote control by opening, the so-called, “backdoor”.

Trojan horses can be presented in the form of games or files in e-mail attachments, with different purposes, such as to allow remote control to your computer, delete data, allow spreading of viruses, send spam from the infected computer, etc. Unlike viruses and worms, it does not replicate, and it needs to be executed, that is, it is not autonomous.

Spyware is a program that secretly collects data about computer users (passwords, credit card numbers, etc.), therefore it spies on users. The most common spyware infections usually occur while visiting suspicious sites with illegal or pornographic content.

Adware is a program that uses collected data about a user in order to display advertisements in a way regarded as intrusive. It usually manifests itself in the form of many pop-up windows that display ads.

Hoax is a false message being spread by e-mail in order to deceive users. Their goal is to obtain data of, for instance, a bank account, or persuade users to pay some fees in order to win the lottery (which they never applied for), or pay costs of money transfers from an exotic prince to help him withdraw money from a country that is falling apart and, in return, will receive an impressive award, etc.

In order to clarify malicious programs, it is necessary to explain that malicious software is nothing more than a computer program. Like any other computer program, it must be Installed on your computer OS to act. Without making the distinction between malignant (evil) and benign (kind) programs, let us think of them as just a computer program.

Unlike legal and non-malicious programs, malicious programs are designed in a way that they do not have to be looked for, i.e. you do not need to search for them, you do not need to have any computer knowledge to install them, indeed, the less you know, the better it is for them. So, the more you know, the more likely it is you will be safe from an infection, with the use of professional protection programs against malicious programs. Finally, here is some advice on additional protection against malicious programs. As already stated, malicious programs are nothing more than computer programs, which mean they must be installed in order to act.

To install any program on a computer, a person/user must be logged into an account that has Administrator privileges. Only by means of a user account with administrator privileges, can a computer program be installed.

Therefore, if you are logged into an account with no administrator privileges, but limited privileges (that is, with no authority to install software), then malicious programs, like any other program, cannot be installed. From all this we can conclude:

For everyday computer use (especially for Internet browsing), do not use an account with administrator privileges but a limited account, which has no authority for software installation,

Use an Administrator account only when you need to administrate the system,

Use professional programs for protection against malicious programs,

Be sure to regularly update your program for protection,

Educate yourself, because nothing can protect you from reckless computer use.

Be careful about opening unsolicited received e-mails, because you have to notice if it is of suspicious character, make sure websites you visit are safe, because only you have control over it,

Also, check all external media with protection/security programs immediately after you connect them to a computer,

Do not use pirated software, it is considered a theft and they usually come with malware.

Ransomware

Ransomware is a type of malware that involves an attacker locking the victim’s computer system files typically through encryption and demanding a payment to decrypt and unlock them.

Social Engineering

Social engineering is an attack that relies on human interaction to trick users into breaking security procedures in order to gain sensitive information that is typically protected.

Phishing

Phishing is a form of fraud where fraudulent emails are sent that resemble emails from reputable sources, however, the intention of these emails is to steal sensitive data, such as credit card or login information.

CYBERCRIME

A Cybercrime, also called computer crime, is the use of a computer as an instrument to further illegal ends, such as committing fraud, trafficking in child pornography and intellectual property, stealing identities, or violating privacy. Cybercrime, especially through the Internet, has grown in importance as the computer has become central to commerce, entertainment, and government.

An important aspect of cybercrime is its nonlocal character that is actions can occur in jurisdictions separated by vast distances. This poses severe problems for law enforcement since previously local or even national crimes now require international cooperation. In Tanzania for instance, there is a national law called Tanzania

Cybercrime Act of 2015 that has expanded law enforcement’s power to monitor and

protect computer networks.

Cybercrime ranges across a spectrum of activities. They include identity theft and invasion of privacy, Internet fraud, ATM fraud, wire fraud, illegal file sharing and piracy, counterfeiting and forgery, child pornography, computer viruses, Denial of Service (DOS) attacks, spam, steganography, and e-mail hacking, and sabotage.

DATA SECURITY Any data can be lost; therefore, it is necessary to have it stored in several places to have the data copies. Putting extra data copies (replicating data in different places) is part of IT security and this is referred as data backup.

The term data backup signifies the process of making a copy of the original data (files, programs) so that they can be retrieved in the event of damage to the original data source or its loss. Electronic data can be stored on another server, magnetic tape, hard disk, DVD or CD, etc. Data backup can be done onsite or offsite and can be taken through manual or automated process.

Firewall

Firewall is a software (or network device) that is used to control authorized access and protect against unauthorized access to your computer.

Figuratively speaking, computers are connected via network port. In the computer world, the term port is used to describe the network of connections through which computers can connect to a computer network, or someone can connect to your computer from outside of your network.

All data traffic between a computer and the rest of network is done through ports. Control port controls data flow from your computer to the network and vice versa. Control is done through a firewall; some ports are opened, some closed, and some allow temporary traffic.

User Authentication

To protect data from unauthorized access and theft, we use a username and password to confirm our identity and prevent unauthorized data access. Similarly, in case we need to briefly step away from a computer, it is necessary to lock it. Computers can be locked by opening the Start menu, clicking the arrow next to the Shut Down button and selecting the Lock command.

PART 2: COMPUTER AND IT ETHICS

INTRODUCTION

Ethics is an important aspect in IT industry. It satisfies basic human needs by encouraging being fair, honest and ethical. Computer user needs to operate in a fair and ethical, and to observe professional best practices. In this lecture, you are introduced to several ethics and professional code of conducts related to IT and computer use.

LECTURE OBJECTIVES

ODUCEthics are a set of moral principles that govern a persons’ or groups’ behavior. Ethics is an inquiry between right and wrong through a critical examination of the reasons underlying practices and beliefs. Someone is considered to be behaving ethically if they conform to generally accepted practices of the society or group making that consideration.

COMPUTER ETHICS

Due to wide usage and high acceptability of computer related technologies and ICT in general, the IT ethics must be well defined and observed by computer user, regardless of the professionalism, type of work, access privilege or geographical boundaries.

Computer ethics deals with the procedures, values and practices that govern the process of consuming computing technology and its related disciplines without damaging or violating the moral values and beliefs of any individual, organization or entity.

Computer ethics is a concept in ethics that addresses the ethical issues and constraints that arise from the use of computers, and how they can be mitigated or prevented. Computer ethics primarily enforces the ethical implementation and use of computing resources.

It includes methods and procedures to avoid infringing copyrights, trademarks and the unauthorized distribution of digital content. Computer ethics also entails the behavior and approach of a human operator, workplace ethics and compliance with the ethical standardsthat surround computer use.

The core issues surrounding computer ethics are based on the scenarios arising from the use of the Internet, such as Internet privacy, the publication of copyrighted content and user interaction with websites, software and related services.

Computer ethics can be considered the ethical considerations regarding the social impact of computer technology. Computer ethics take both the personal and the social impacts. Because of the ever-changing computing technologies, computer ethics cannot be a static set of rules.

It requires constant reflection about new policies and their implications and to be able to shift with our values. Computer ethics should encompass both conceptualizations that help people understand things, and also policies for using the computer technology ethically.

Computers and information systems are used everywhere in society. New technologies are invaluable tools, but they may have serious ethical consequences. The way an information technology tool affects sensitive issues has a direct impact on its effectiveness and usability.

It may be difficult for users and stakeholders to adopt a computer system if they feel that its use violates important values and interests. To take advantage of a computer tool may not be easy in situations dominated by ethical conflicts.

There is a great risk that expensive but necessary computer system are abandoned because of scandals and conflicts. There is also a risk that ethically controversial systems are used sub optimally, that persons may get hurt, and that organizations may be damaged if they hesitate to use.

Ethics in IT aims at the construction of tools that can be applied in systems development and use for the consideration of significant ethical aspects. The application of suitable ethical tools is a prerequisite to consider significant aspects in all phases of computer

systems development, implementation and use. Ethical tools are necessary not only to construct a system that avoids conflicts with significant moral principles but mainly to build a successful system that will play a significant role in satisfying the most important values of users and stakeholders.

UNETHICAL USE OF COMPUTERS

Unethical usage of computer technology means that using the computer technology to harm the other computers by taking undue advantage of internet. Examples of unethical uses of computers include invasion of media and software piracy, identity theft, ransomware attacks, financial theft, intellectual property theft, cyber bullying, spreading viruses, cyberterrorism, phishing, child predators, hacking.

Cyber bullying is the act of someone hurting and intimidating another person through threatening and violent on the internet especially over the most popular social networks such as Facebook, Twitter and Instagram. Software pirating is the software stealing by illegally downloading files without permission. Hacking is an unethical use of a computer. Hacking can quickly turn into identity theft and exploitation of a person.

As a computer user you are required to observe the following computer ethics while using computer:

Do not harm other people.

Do not interfere with other people’s computer work.

Do not snoop around in other people’s computer files,

Do not use a computer to steal,

Do not use a computer to bear false witness,

Do not copy or use proprietary software for which you have not paid without permission,

Do not use other people’s computer resources without authorization,

Consider and respect others.

PROFESSIONAL PRACTICES

Professionalism is the competence or skill expected of a professional. General attributes of professional practices include communication skills (verbal and written), honesty/integrity, teamwork skills, interpersonal skills, motivation/initiative, strong work ethic, analytical skills, flexibility/adaptability, computer

skills and self-confidence. Regardless of the field, as a professional you need to observe code of ethics and professional conduct which outline the ethical principles that govern decisions and behavior at a company or organization. They give general outlines of how employees should behave, as well as specific guidance for handling issues like harassment, safety, and conflicts of interest.

LEGAL REGULATIONS AND END USER LICENSE AGREEMENT

The need to observe existing regulations, rules and governing laws in ICT is crucial. Whether you are an IT specialist, computer professional, or just an end user, you need to understand the laws and behave ethically and professionally. Your extensive knowledge in the area of computing and IT field will be useless if you fail to observe and follow the rules and laws governing ICT usage.

One of the vital things to consider in IT industry is a copyright issue. Copyright is a right which is used to protect the author’s intellectual property. If you want to use a copyrighted work, software or any other IT product, you must first respect the conditions under which the owner has allowed the use of it.

The use of copyrighted software is defined by the license and the user is bound by EULA, a short of End User License Agreement. EULA is a software license agreement for end users. EULA is normally displayed during program installation and by pressing an “I agree” button you agree to terms of use and are legally bound to respect contract conditions. You need to be sure that the legal software is used. For example, after installation of the MS Windows operating system, it must be activated.

Activation verifies whether the serial number/identification number is valid, that is, whether the operating system is genuine.

Product identification number (PID) is a number that comes with legally purchased software and it certifies the origin of the program. Note that every software publisher has a specific method of verifying the legality of a piece of software you purchased. It mostly comes down to checking via the Internet, i.e., activation and/or registration, updates via the Internet. One of the advantages of legally purchased or acquired software is quality customer service that people with unlicensed software cannot have.

Proprietary software is software licensed under the exclusive legal right of the copyright holder. The licensee is given the right to use the software under certain conditions, but restricted from other uses, such as modification, further distribution etc. Shareware is a term that implies free software use (trials) for a specified time period, after which it is necessary to buy the product. Freeware is software free for personal use. Open Source is software whose code is available to users; it can be freely used, modified and distributed.

LAW ON PERSONAL DATA PROTECTI ON

Many directives have been published at local and international levels as references on the protection of personal data. For instance, Tanzania Cybercrime Act of 2015 for Tanzania and 95/46/EC for European countries. These laws set up a regulatory framework which seeks to strike a balance between a high level of protection for the privacy of individuals and the free movement of personal data.

The laws are mostly concerned on the data related to operations in public security, defense or State security. They also aim at protecting the rights and freedoms of persons with respect to the processing of personal data by laying down guidelines determining when this processing is lawful.

The guidelines relate to the quality of the data, legitimacy of data processing, special categories of processing, information to be given to the data subject, data subject’s right of access to data, exemptions and restrictions, right to object to the processing of data, confidentiality and security of processing, and notification of processing to a supervisory authority.

PART 3: COMPUTER MAINTENANCE AND TROUBLESHOOTING

Although some companies still believe in philosophy of “if it’s not broken, don’t fix it”, but due to increasing costs of systems downtime, the benefits of preventive maintenance should be emphasized.

This lecture introduces you on the preventive maintenance and computer troubleshooting processes. The best practices for hardware and software maintenance are presented.

LECTURE OBJECTIVES

PREVENTIVE MAINTENANCE

Preventive maintenance in IT field refers a regular and systematic inspection, cleaning, and replacement of worn (damaged) computer parts, materials, and systems. Preventive maintenance helps to prevent failure of parts, devices, and systems by ensuring that they are in good working order.

Purpose of Preventive Maintenance

Preventive maintenance reduces the probability of hardware or software problems by systematically and periodically checking hardware and software to ensure proper operation.

Hardware Preventive Maintenance

Preventive maintenance in hardware involves checking the condition of cables, components, and peripherals. The components should be cleaned to reduce the likelihood of overheating. The equipments that show signs of damage or excessive wear need to be repaired or replaced. A hardware maintenance program should consider the following tasks:

Remove dust from fan intakes.

Remove dust from the power supply.

Remove dust from components inside the computer.

Clean the mouse and keyboard.

Check and secure loose cables.

Software Preventive Maintenance

Preventive maintenance in software involves verification if the installed software is current. Technicians need to follow the ICT policies of the organization when installing security updates, OS updates, and application program updates.

Many organizations do not allow updates until extensive testing has been completed. This testing is done to confirm that the update will not cause problems with the OS and applications. A software maintenance schedule that fits the needs of the computing equipment should consider the following tasks:

review security updates, review software updates, review driver updates, update virus definition files, scan for viruses and spyware, remove unwanted programs, scan hard drives for errors and defragment hard drives.

Benefits of Preventive Maintenance

One of the benefits of preventive maintenance is to be proactive in computer equipment maintenance and data protection. By performing regular maintenance routines, you can reduce potential hardware and software problems. Regular maintenance routines reduce computer downtime and repair costs. Preventive maintenance can also include upgrading certain hardware or software such as a hard drive that is making noise, upgrading memory that is insufficient, or installing software updates for security or reliability.

A preventive maintenance plan is developed based on the needs of the equipment. A computer exposed to a dusty environment, such as a construction site, needs more attention than equipment in an office environment. High-traffic networks might require additional scanning and removal of malicious software or unwanted files.

Document the routine maintenance tasks that must be performed on the computer equipment and the frequency of each task. This list of tasks can then be used to create a maintenance program. The following are the benefits of preventive maintenance: increases data protection, extends the life of the components, increases equipment stability, reduces repair costs and reduces the number of equipment failures.

TROUBLESHOOTING is Computer Troubleshooting?

Computer troubleshooting is a systematic approach to locating the cause of a fault in a computer system. A good preventive maintenance program helps minimizes failures. With fewer failures, there is less troubleshooting to do, thus saving an organization time and money.

Troubleshooting is a learned skill. Not all troubleshooting processes are the same, and technicians tend to refine their troubleshooting skills based on knowledge and personal experience. Use the guidelines in this lecture as a starting point to help develop your troubleshooting skills.

Although each situation is different, the process described in this lecture will help you to determine your course of action when you are trying to solve a technical problem for a customer.

Steps of the Troubleshooting Process

Troubleshooting requires an organized and logical approach to problems with computers and other components. A logical approach to troubleshooting allows you to eliminate variables in a systematic order. Asking the right questions, testing the right hardware, and examining the right data helps you understand the problem. This helps you form a proposed solution to try.

Troubleshooting is a skill that you will refine over time. Each time you solve another problem, you will increase your troubleshooting skills by gaining more experience. You will learn how and when to combine, as well as skip, steps to reach a solution quickly.

The following troubleshooting process is a guideline that you can modify to fit your needs: explain the purpose of data protection, identify the problem, establish a theory of probable causes, test the theory to determine an exact cause, establish a plan of action to resolve the problem and implement the solution, verify full system functionality, and if applicable, implement preventive measures, document findings, actions, and outcomes.

DATA PROTECTION

Before you begin troubleshooting problems, always follow the necessary precautions to protect data on a computer. Some repairs, such as replacing a hard drive or reinstalling an OS, might put the data on the computer at risk. Make sure that you do everything possible to prevent data loss while attempting repairs. This is accomplished by taking the data backup.

A data backup is a copy of the data on a computer hard drive that is saved to media such as a CD, DVD, or tape drive. In an organization, backups are routinely done based on the specified time duration. Verify the data backups on the following important aspects: date of the last backup, contents of the backup, data integrity of the backup, and the availability of all backup media for a data restore.