9 Information Systems Controls for System Reliability— Part 2 Confidentiality and Privacy（课件）- 《会计信息系统英文版》同步教学（人民大学版）

Chapter 9 Information Systems Controls for System Reliability— Part 2: Confidentiality and Privacy 9-1 Learning Objectives Identify and explain controls designed to protect the confidentiality of sensitive corporate information. Identify and explain controls designed to protect the privacy of customers’ personal information. Explain how the two basic types of encryption systems work. 9-2 Trust Services Framework Security (Chapter 8) Access to the system and its data is controlled and restricted to legitimate users. Confidentiality (Chapter 8) Sensitive organizational information (e.g., marketing plans, trade secrets) is protected from unauthorized disclosure. Privacy Personal information about customers is collected, used, disclosed, and maintained only in compliance with internal policies and external regulatory requirements and is protected from unauthorized disclosure. Processing Integrity (Chapter 10) Data are processed accurately, completely, in a timely manner, and only with proper authorization. Availability (Chapter 10) System and its information are available to meet operational and contractual obligations. 9-3 Intellectual Property (IP) Strategic plans Trade secrets Cost information Legal documents Process improvements All need to be secured 9-4 Steps in Securing IP 9-5 Where is the information, who has access to it? Classify value of information The process of obscuring information to make it unreadable without special knowledge, key files, or passwords. Information rights management: control who can read, write, copy , delete, or download information. Most important! Employees need to know what can or can’t be read, written, copied, deleted, or downloaded Identification and Classification Encryption Controlling Access Trainingj Privacy Deals with protecting customer information vs. internal company information Same controls Identification and classification Encryption Access control Training 9-6 Privacy Concerns SPAM Unsolicited e-mail that contains ei