Chapter Four - Ethics and Information Security

1. Explain the ethical issues surrounding technology:

The ethical issues surrounding technology comprise of:

Intellectual property - This refers to an individual's rights which protects their efforts, skills and knowledge.

Fair use doctrine - These are situations where you use someones property but you don;t make profits.

Pirated software - This refers to software in which is copyright being used illegally e.g. running desktops that are unlicensed.

Counterfeit software - This is where a software has been duplicated and sold so it looks like the original software i.e. claiming it as your own software.



2. Describe the relationship between an 'email privacy policy; and an 'internet use policy':

An email privacy policy is a corporate email system in which it can be checked and determines how the email system in an organisation is going to be used e.g. not allowing employees to send spam emails to colleagues. An internet use policy is a guide on how to use the internet.

3. Summarise the five steps to creating an information security plan:

The picture below in which I created provides the five steps in creating an information security plan:




4. What do the terms; authentication and authorisation mean, how do they differ, provide some examples of each of them:

Authentication is ensuring an individuals identity by them claiming who they say they are i.e. something the user is e.g. biometrics, something the user has e.g. smart or token cards and something the user knows e.g password. It differs to authorisation as authorisation means that you are giving someone you consent to do something that is allowing the right people to access the right areas in the internet e.g. a member in an organisation being part of the marketing group which allows them to access marketing resources.

5. What are the five main types of security risks, suggest one method to prevent the severity of risk:

The following are the five types of security risks and the mechanisms that should be put in place:

Human error - Standards of training

Technological Failure - Robust systems, backups

Natural disaster - Disaster recovery; all organisations should have a disaster recovery plan and in it should be things like a communication plan, location of backup data, business continuity etc.

Deliberate acts - These could include hackers, disgruntled employees, viruses and spams

Management failures - This is where there is no back up in place and there is a lack of documentation and a suggested method would be to have some support training for managers in place.





References:

Baltzan, Phillips, Lynch, Blakey. Business Driven Information Systems. 1st Australian/New Zealand Edition. Mc Graw Hill. 2010.

kerls1982's Channel 2009, YouTube, viewed 4 April 2010, http://www.youtube.com/watch?v=emv88g0LVbw