1

Tonga Institute of Higher Education

IT 245

Management Information Systems

Lecture 11

Security, and Ethical Challenges of E-Business

2

Learning Objectives

• Identify several ethical issues in how the use of IT in E-Business affects employment, individuality, working conditions, privacy, crime, health, and solutions to societal problem

• Identify several types of security management strategies and defenses, and explain how they can be used to ensure the security of E-business applications.

• Propose several ways that business managers and professionals can help to lessen the harmful effects and increase the beneficial effects of the use of IT

3

Section 1- Security, Ethical, and Societal Challenges of E-Commerce

IT can support both beneficial or detrimental effects on society in each of the areas:

1. Computer Crime in E-Business: the unauthorized use, access, modification, and destruction of hardware, software, data, or network resources.

4

Computer Crime Activities

• Hacking

• Cyber Theft

• Unauthorized use at Work

• Software Piracy

• Piracy of Intellectual Property

• Computer viruses

5

Privacy Issues

• Privacy on the Internet

• Computer Matching

• Privacy Laws

• Computer Libel and Censorship– Spamming– Flaming

6

Health Issues

• Heavy use of computers is reportedly causing health problems like job stress, damaged arm, neck muscles, eye strain, radiation exposure etc.

• Solution to some of these health problems are based on the science of ERGONOMICS sometime called human factors engineering. Goal is to design healthy work environment that are safe, comfortable and pleasant for people to work in thus increasing morale and productivity

7

Ergonomics which means “fitting the task to the worker”

8

Other Challenges

• Employment Challenges– Substituting of human efforts

• Computer Monitoring– Computers to monitor productivity and

behaviors of employees

• Challenges in Working Conditions– Ongoing upgrading of working environment

• Challenges to individuality– Negative impact on individuals

9

You and Ethical Responsibility

• As a business end user,we have a responsibility to promote ethical uses of IT in the workplace.

• As a responsible IT user, it will be our responsibility to make decisions about business activities and the use of IT which may have an ethical dimension that must be considered.

10

Ethical Foundations

• Egoism – What is best for a given individual is right.• Natural Law – Humans should promote their own

health and life, pursue knowledge of the world and God,pursue close relationship with other people and submit to legitimate authority.

• Utilitarianism – Those actions are right that produce the greatest good for the greatest number of people.

• Respect for person – People should be treated as an end and not as a means to an end; and actions are right if everyone adopts the moral rule presupposed by the action.

11

Principles of Technology Ethics

• Proportionality – The good achieved by the technology must outweigh the harm or risk.

• Informed Consent – Those affected by the IT should understand and accept the risks.

• Justice – The benefits and burdens of the technology should be disturbed fairly.

• Minimized Risk – Even if judged acceptable by the other 3 guidelines, IT must be implemented so as to avoid all unnecessary risk.

12

Ethical Guidelines

• Business end users and IS professional would live up to their ethical responsibilities by:– Acting with integrity– Increasing your professional competence– Setting high standards of personal

performance– Accepting responsibility for your work– Advancing the health, privacy, and general

welfare of the public.

13

AITP Standards of Professional Conduct

In recognition of my obligation to my employer I shall:

• Avoid conflicts of interest and ensure that my employer is aware of any potential conflicts.

• Protect the privacy and confidentiality of all information entrusted to me.

• Not withhold and misrepresent information that is relevant or useful to the situation.

• Not attempt to use the resources of my employer for personal gain or for any purpose without proper approval.

• Not exploit the weaknesses of a computer system for personal gain or personal satisfaction.

14

AITP Stand. Of PC con’tIn recognition of my obligation to society I shall:• Use my skill and knowledge to inform the public in all

areas of my experience.• To the best of my ability, ensure that the products of

my work are used in a socially responsible way.• Support, respect, and abide by the appropriate local,

state, provincial and federal laws.• Never misrepresent or withhold information that is

germane to a problem or a situation of public concern, not will I allow any such known information to remain unchallenged.

• Not use knowledge of a confidential or personal nature in any unauthorized manner to achieve personal gain.

15

Section 2 – Security Management of E-commerce

The goal of SM is the accuracy, integrity, and safety of all E-Business processes and resources. Thus, effective SM can minimize errors, fraud, and losses in the internetworked computer-based systems that interconnect today’s e-business enterprise.

16

Security Tools and Defensive Measures.

• Encryption• Firewalls• Email Monitoring - Policy• Virus Defenses• Security Codes – multilevel password• Backup Files• Security Monitors• Biometric Security• Computer Failure Controls• Fault Tolerant Systems• Disaster Recovery Plan

17

Essential E-commerce Processes 4 of 5

• Event Notification: Multiple events take place in E-transactions. EC systems are event-driven. Event must be notified to different parties involved in the transactions

• Collaboration & Trading : Online/auction Sites for collective buying/selling requires collaboration between business partners. See the following diagram.

18

E-Business System Controls and Audits

IS Controls are designed to monitor and maintain the quality and security of the IPOS activities of an information system.

• Input Controls– Security codes– Encryption– Data Entry Screens– Error Signals– Control Totals

19

System Controls con’t

Processing Controls:• Software controls, Hardware controls, Firewalls,

Checkpoints

Output Controls• Security codes, Encryption, Control Totals,

Control Listings, and End User Feedback.

Storage Controls• Security codes, Encryption, Backup Files,

Library Procedures, Database Administrator

20

Auditing E-Business Systems

E-Business systems should be periodically examined or audited by a company’s internal auditing staff or external auditors from professional accounting firms. Such auditors review and evaluate whether proper and adequate security measures and management policies have been developed and implemented. This typically involves verifying the accuracy and integrity of the E-Business software used as well as the input of data and output produced with secured storage.

21

Auditing IS con’tAudit Trial can be defined as the presence of

documentation that allows a transaction to be traced through all stages of its information processing.

• Control Logs automatically record all computer network activity on a magnetic disk or devices.

22

Security Management for Internet Users

• Use antivirus software and update it often• Use a hard to guess password, mix of numbers

and letters and change frequently• Use different password for different applications• Use up to date web browser and email software• Install firewall software• Don’t open e-mail attachment unless you know

the source• Confirm the site you are doing business with.

23

SUMMARY• Section 1 – Security, Ethical, and Societal

Challenges of E-Business:– Computer crime in business– Privacy Issues– Other Challenges– Health Issues– Societal Solutions– You and Ethical Responsibility

• Section II - Security Management of E-Busines– Security Management– Internetworked E-Business Defenses– Other Security Measures– E-Business System Controls and Audit