Data Security 4/8/2017.

Presentasi berjudul: "Data Security 4/8/2017."— Transcript presentasi:

1 Data Security 4/8/2017

2 Computer Security Risks
What is a computer security risk? Event or action that causes loss of or damage to computer system

3 4/8/2017

4 Jenis Kerawanan Data (Types of Data Vulnerability)
Penyalinan data (data copying) Pengaksesan data terlarang (aunauthorized access) Penyalahan guna data (abuse) 4/8/2017

5 Serangan Keamanan Pasif
Snooping: berusaha mencuri informasi berharga dari suatu dokumen Eavesdropping: mendengarkan sebuah percakapan orang lain untuk mencuri informasi Eavesdropping Snooping 4/8/2017 5

6 Serangan Keamanan (lanjutan …)
Aktif Interception: menghentikan informasi dan mengambilnya untuk mendapatkan informasi berharga, selanjutnya diteruskan kembali (bisa jadi telah diubah) Denial of Service (DoS): melumpuhkan target (hang, crash) sehingga sistem tidak dapat memberikan layanan Repudiation: memberikan informasi palsu kepada target atau bertindak sebagai orang lain untuk mendapatkan informasi yang diinginkan pelaku. 4/8/2017

7 Praktek Pencurian PIN di Indonesia
Kasus Bank BCA Typosquatting  membuat domain “plesetan” Nama domain Asli: Beli kombinasi domain klikbca.com Harga Rp. nama domain .COM dsb Akibatnya: Pelaku mendapatkan: kode akses (pin), nomor rekening, Password dari puluhan bahkan ratusan nasabah 4/8/2017

8 Pencurian PIN via Kamera Mikro
Pencurian PIN dengan Kamera Wireless Sumber: [Budi Rahardjo, 2005] 4/8/2017 8

9 Legal for employers to use monitoring software programs
Information Privacy What is information privacy? Right of individuals and companies to deny or restrict collection and use of information about them Difficult to maintain today because data is stored online Employee monitoring is using computers to observe employee computer use Legal for employers to use monitoring software programs

10 Information Privacy What are spyware, adware, and spam?
Spyware is program placed on computer without user’s knowledge Adware is a program that displays online advertisements Spam is unsolicited message sent to many recipients

11 Information Privacy How can you control spam? E-mail filtering
Service that blocks messages from designated sources Collects spam in central location that you can view any time Anti-spam program Attempts to remove spam Sometimes removes valid messages

12 Information Privacy What is phishing?
Scam in which a perpetrator sends an official looking that attempts to obtain your personal and financial information

13 SCOPE OF SECURITY Electronically safe (computer and network systems)
Physically safe (rooms, channels, spaces, environment) Procedurally safe (policies, laws, merit systems ) 4/8/2017

14 Scope of Electronic Security
4/8/2017

15 Scope of Pysical Security
4/8/2017

16 Scope of Procedural Security
4/8/2017

17 Methods of Data Security
Access Right Assignment Authentication Virus prevention, detection & removal Network Protection & Security Data Encryption Periodical Data Backup Recovery System Monitoring System Establishment of SOP & Training nobody knows you’re dog 4/8/2017

18 Access Right Assignment
Domain User Domain Operasi Domain Obyek Siapa? Dapat melakukan apa? Terhadap obyek apa? 4/8/2017

19 Example of Access Right Assignment
4/8/2017

20 Methods of Data Security: Authentication
To ensure the identity, legality and authorithy of a user/ agroup of users to enter and utilize a system that store data. In general, authentication uses the combination of protected login ID and password The use of bio-password (biometrics) are highly recommended nowadays. 4/8/2017

21 Unauthorized Access and Use
How can you make your password more secure? Longer passwords provide greater security

22 Unauthorized Access and Use
What is a biometric device? Authenticates person’s identity using personal characteristic Fingerprint, hand geometry, voice, signature, and iris 22

23 4/8/2017 23

24 4/8/2017 24

25 Internet and Network Attacks
How can a virus spread through an message? Step 1. Unscrupulous programmers create a virus program that deletes all files. They hide the virus in a picture and attach the picture to an message. Step 2. They use the Internet to send the message to thousands of users around the world. Step 3b. Other users do not recognize the name of the sender of the message. These users do not open the message - instead they delete the message. These users’ computers are not infected with the virus. Step 3a. Some users open the attachment and their computers become infected with the virus.

26 Internet and Network Attacks
What is a firewall? Security system consisting of hardware and/or software that prevents unauthorized intrusion

27 Internet and Network Attacks
What is a personal firewall? Program that protects personal computer and its data from unauthorized intrusions Monitors transmissions to and from computer Informs you of attempted intrusion

28 4/8/2017 28

29 Solution for Systems Architecture: Internet Data Center
4/8/2017 29

30 a process which transforms a message to conceal its information
is non-encrypted (original) text is encrypted text 4/8/2017 30

31 Data Encryption 4/8/2017

32 Digital certificate is notice that guarantees Web site is legitimate
Information Theft How do Web browsers provide secure data transmission? Many Web browsers use encryption Secure site is Web site that uses encryption to secure data Digital certificate is notice that guarantees Web site is legitimate

33 Information Theft What is a certificate authority (CA)?
Authorized person or company that issues and verifies digital certificates Users apply for digital certificate from CA

34 Information Theft What is Secure Sockets Layer (SSL)?
Provides encryption of all data that passes between client and Internet server Web addresses beginning with “https” indicate secure connections

35 Periodical Data Backup
Bakcup data adalah proses penyalinan data ke media penyimpanan sekunder/tersier (seperti CD-ROM, External hardisk, tape, optical disk, drum disk) yang terpisah dari data master (asli)nya sehingga peluang terjadi kerusakan secara simultan dari seluruh data master dan backupnya semakin kecil 4/8/2017

36 Backup Procedures What are the five types of backups?

37 Backup Procedures What is a backup procedure?
Regular plan of copying and storing data and program files Can use combination of full backups and differential or incremental backups

38 Emergency plan steps to be taken immediately after disaster
Backup Procedures What is a disaster recovery plan? Written plan for restoring computer operations in event of disaster Emergency plan steps to be taken immediately after disaster Backup plan how backup files and equipment would be used to resume information processing Recovery plan actions to be taken to restore full information processing operations Test plan simulates various levels of disasters and records ability to recover

39 MONITORING SYSTEM 4/8/2017 39

40 Information Privacy What is computer forensics?
Also called digital forensics, network forensics, or cyberforensics Discovery, collection, and analysis of evidence found on computers and networks Computer forensic analysts must have knowledge of the law, technical experience, communication skills, and willingness to learn p. 587

41 Establishment of SOP & Training
S O P for Data Security 4/8/2017

42 Thank You 4/8/2017