Computer Crime Prevention
Computer crimes consist of illegal use of or the unauthorized entry into a computer system or computer data to tamper, interfere, damage, or manipulate the system or data. Computers can be the subject of the crime, the tool of the crime, or the object of the crime.
As the subject of a crime, someone would use your computer or another computer to willfully alter the data stored in the computer, adding fraudulent inaccurate data, altering data, or omitting input data. Some motives are revenge, protest, competitive advantage, and ransom. Most computer‑related crimes are committed by people who are well versed in computer technology. Most cases of theft by computer result from preparation of false input data. Have an outside consultant review your input controls and strengthen them if needed.
As the tool of a crime, someone would use your computer to gain access to or alter the data stored on another computer. Examples are telecommunications and computer manipulation crimes. Regarding the former, law enforcement agents working with telephone companies can identify phone hacking activity, including the location of the residence, and can provide search warrants and accompanying experts in the service of the warrant. Related crimes are computer hacking and unauthorized use of the telephone system. The latter includes embezzlement, crediting money to an account, continuing payroll checks after termination, removing the limit from a credit card account, fraud, and support of criminal enterprises, e.g., drug distribution.
As the object of a crime, computers and system components can be stolen, sabotaged, or destroyed. Software can be pirated. More importantly, trade secrets and sensitive business information stored in computers can be lost when computers stolen.
Your computers and computer information should be protected as any valuable business asset. Stay informed and use new computer security devices and information. The tips here will help prevent computer crimes.
Physical Protective Measures
Install surface locks, cable‑locking devices, and fiber-optic loops prevent equipment theft.
- Locate the computer room and data storage library away from outside windows and walls to prevent damage from external events.
- Install strong doors and locks to the computer room to prevent equipment theft and tampering.
- Reinforce interior walls to prevent break-ins. Extend interior walls to the true ceiling.
- Restrict access to computer facilities to authorized personnel. Require personnel to wear distinct, color-coded security badges in the computer center. Allow access through a single entrance. Other doors should be alarmed and used only as emergency exits.
Procedural and Operational Protective Measures
- Classify information into categories based on importance and confidentiality. Use labels such as “Confidential” and “Sensitive.” Identify software, programs, and data files that need special access controls.
- Install software access control mechanisms. Require a unique, verifiable form of identification, such as a user code, or secret password for each user. Install special access controls, such as a call‑back procedure, if you allow access through a dial‑telephone line connection.
- Encrypt confidential data stored in computers or transmitted over communication networks. Use National Institute of Standards and Technology (NIST) data encryption standards.
- Design audit trails into your computer applications. Log all access to computer resources with unique user identification. Separate the duties of systems programmers, application programmers, and computer programmers.
- Establish procedures for recovering your operating system if it is destroyed. Store all back‑up data offsite.
- Review automated audit information and control reports to determine if there have been repeated, unsuccessful attempts to log‑on both from within and outside your facility. Look for unauthorized changes to programs and data files periodically.
Personnel Policies
- Monitor activities of employees who handle sensitive or confidential data. Watch for employees who work abnormally long hours, or who refuse to take time off. Many computer crime schemes require regular, periodic manipulation to avoid detection. Be aware of employees who collect material not necessary to their jobs, such as programming manuals, printouts for data, programs and software manuals.
- Change security password codes to block further access by employees who leave or are fired. The latter become a high risk to your company for revenge or theft.
- Establish rules for computer use by employees, including removal of disks or printed output. All employees should sign and date a printed copy of these rules to indicate that he/she understands them.
Anti-Virus Protection
The following measures can help protect your computer from viruses:
- Don't bring disks in from outside sources.
- Scan demo disks from vendors, shareware, or freeware sources for viruses.
- Restrict use of electronic bulletin boards.
- Scan downloaded files for viruses. Avoid downloading executable files.
- Make regular back‑ups to aid in recovery.
|
