Computing Notes

COMP-160 Notes

January 24, 2012

Informed Consent

• This is the practice of having organization to let people know that they are getting personal information about them.
Problems:
• Not all countries or companies allow info to be acquired from the people/require informed consent (people acquire all consent)
• Not all organization strictly follows the guidelines
• Notall users of the internet are aware of the implications of giving out their personal info.
• Not all users read the fine print that goes along these consent notices.
• Not all users understand that info given out for one purpose may have secondary uses


Those organizations:

a. Inform users that their personal info has being collected even if it is only being used for the statedpurpose of that organization.

b. Request permission from users if that info is going to be used in any secondary application.



Opt in – will not do it unless you tell them to

Opt out – will do it unless you tell them to stop



Social Equity

• Issue that people know more about the internet and can find ways to protect themselves and use it to their advantage.

DigitalDivide – is a separation between those who are aware about modern technology and use it to their advantage and those who don’t.

Industry Self-regulation

1995 –TRUSTe



4 characteristics to earn TRUSTe approval:

a. Clearly explain in advance their general information collecting practices.

b. Indicate what personally identifiable data would be collected.

c. Reveal whatthe collected info would be used for.

d. Inform users about any third party organizations or individuals that may have access to this data.



Criticism of these characteristics: (weaknesses)

a. Not all users are going to know or care of the present of this TRUSTe seal.

b. The amount of info users are required to read may prove prohibited.

c. The protection offered bythis system may not go far enough.



1995 – EU Directive on Data Protection

• Protect data from being moved from one country to another



Security in Cyberspace

Questions to consider:

a. What is computer security? Defined by 3 characteristics: confidentiality (protection against unauthorized access of info from third parties), integrity (protection against either accidentalor malicious modification of data), and availability (the ability of authorized person to access data when they desire to do so).

b. How are violations of computer security similar to and different from computer crime? Almost every violation of computer security is a computer crime; however, not every computer crime is a violation of computer security.

c. What’s the difference betweenthe terms data security, system security and network security?

a. 1) Data Security is protection from unauthorized access to data which may be stored in or exchanged between computer systems. Data that needs to and must be protected are Proprietary data (legally owned and protected) and Sensitive Data (personal info that can be used to potentially harm someone).

b. 2) SystemSecurity is protection from attacks on system resources (hard drive, processor, operating system, applications). Generally being attacked by malware. Two types of malwares: Worms and Viruses. Virus needs a host program to spread, while worms do not need a host program but through networks.

c. 3) Network security is the protection from various kinds of attack on networks. Examples,slowing down/stopping transmissions, DOS – denial of service.

d. What is meant by hacking and a “hacker ethic?”

a. Hacker and Hacker Ethics

i. Hacker – unauthorized person gains access to a computer system. (people who create programs)

1. White Hats – hack system for pleasure

2. Black Hats – mess with the system by...