AIS Chapter 11

Chapter 11:
Computer
Crime, Fraud,
Ethics and
Privacy
Introduction
The connection between AISS and computer crime and fraud is
both straightforward and important. Managers, accountants, and investors
all use computerized information to control valuable resources, help sell
products, authenticate accounting transactions, and make investment
decisions.
2
Introduction
➢ Computer crime, fraud, and other irregularities that have occurred
in the past and that may also occur in the future.
➢ Not all computer-related offenses are illegal-some are just unethical.

Because of the importance of ethical behavior within the environment
of computerized AISs, we also discuss the topic of computers and
ethical behavior.
3
3 REPUTABLE ORGANIZATIONS
- conduct surveys that help us understand the breadth and depth of these
crimes:
1. The Computer Security Institute (CSI) - conducts an annual survey to
help determine the scope of computer crime in the United States. The
respondents to this survey are computer security practitioners in U.S.
corporations, government agencies, financial institutions, medical
institutions, and universities.
2. KPMG - a global network of professional firms providing audit, tax, and
advisory services, conducts surveys on fraud and business integrity. Survey
4participants are the business professionals who work for one of the top
2,000 companies listed in Dun and Bradstreet.
3. the Association of Certified Fraud Examiners (ACFE) - an

international professional organization committed to detecting, deterring,
and preventing fraud and white-collar crime-conducts a biannual survey
and publishes the results in its Report to the Nation on Occupational Fraud
and Abuse.
The participants in this survey are its members, each of whom provides
detailed information on one occupational fraud case he or she had
personally investigated within the past two years.
5
3. the Association of Certified Fraud Examiners (ACFE) - an

international professional organization committed to detecting, deterring,
and preventing fraud and white-collar crime-conducts a biannual survey
and publishes the results in its Report to the Nation on Occupational Fraud
and Abuse.
The participants in this survey are its members, each of whom provides
detailed information on one occupational fraud case he or she had
personally investigated within the past two years.
6
COMPUTER CRIME vs. COMPUTER ABUSE vs. FRAUD
1. Computer Crime - someone manipulates a computer or computer

data, by whatever method, to dishonestly obtain money, property, or
some other advantage-or cause significant loss.
2. Computer Abuse - means that someone, who does not have
permission, uses or accesses someone else's computer. So, a perpetrator
commits a computer crime when he or she gains an illegal financial
advantage or causes measurable loss to a person, company, or
organization.
3. Computer Abusers - are mischievous pests with such motives as a
challenge or revenge. There are hackers who exploit the vulnerabilities of
7an organization's computer systems just because they can.
The Importance of Computer Crime and Abuse to AISS
✓ AISS help control financial resources and thus are often the favored
targets of computer abusers and criminals.
✓ AISS are prized targets for disgruntled employees seeking to
compromise computer systems for revenge.
✓ Accountants are responsible for designing, selecting, or implementing
the control procedures that protect AISS.
✓ Both the government and the investing public rely on internal and
external auditors to vouch- safe the accuracy and completeness of the
financial statements of the corporations and government agencies they
audit.
8
✓ FBI is investigating approximately 800 separate incidents of economic

espionage, which is why this is such an important topic to accountants.
✓ Computer crime and abuse are also significant because of the large
proportion of firms that suffer million-dollar losses due to frauds,
computer viruses, unauthorized access, and denial-of-service attacks.
9
The 2008 ACFE Report to the Nation estimates that the annual total losses
from occupational fraud are almost $1 trillion (not all of which is computer
based). The 2008 annual survey of the Computer Security Institute
estimates that the average cost to target organizations from a computer-
abuse incident is about $500,000-an amount whose financial impact can
range from "substantial" to "catastrophic" to the victim firm.
10
THREE EXAMPLES OF COMPUTER CRIMES
1. Compromising Valuable Information

A major class of computer crime involves illegal access to, or misuse of,
the information stored in an AIS and is thus valuable-information computer
crime. In the TRW Credit Data case, the valuable information involved was
computerized credit data.
2. Wire Fraud and Computer Hacking
Voice over Internet Protocol (VoIP) is a technology that allows you to make
telephone calls using a broadband Internet connection instead of a
regular telephone line. This technology converts your voice signal into
digital signals that travel over the Internet and are then converted back to
audio signals at the receiver's end.
11
THREE EXAMPLES OF COMPUTER CRIMES
3. Denial of Service
▪ A number of computer viruses and computer worms have gained
media attention, but none have been as swift or as "deadly" as the
Slammer worm. In 2003, this computer worm nearly shut down the
Internet in less than 15 minutes. Internet service providers (ISPs) on the
east coast of the United States were the first to recognize the problem,
but the full impact of this computer worm quickly spread to other
countries.
▪ Denial-of-service (DOS) attacks take many forms, including (1)
computer viruses, (2) computer worms, or (3) distributed systems.
12
Denial-of-Service
▪ A computer virus is an attachment to other files or programs that

destroys computer files, disrupts operating system activities, or
damages program software.
▪ "viruses" continue to be the number one security problem for modern
organizations.
▪ Computer worms do not actually destroy data, but merely replicate
themselves repeatedly until the user runs out of internal memory or
disk space.
▪ With distributed denial-of-service attacks, a single virus or worm
program enlists the aid of innocent "zombie computers," which then
13 send e-mail messages to, or to request services from, the target
system.
Denial-of-Service
▪ Most computer viruses reside on secondary storage media, where they

hide until finding an opportunity to execute.
▪ Boot-sector viruses hide in the boot sectors of a disk, where the
operating system accesses them every time it accesses the disk itself.
▪ Trojan horse programs reside in the disk space occupied by
legitimate copies of computer programs, for example, spreadsheet
programs.
▪ Logic bomb programs are similar to Trojan horse programs, except
that they remain dormant until the computer system encounters a
specific condition, such as a particular day of the year or a particular
14 Social Security number in a file.
Denial-of-Service
▪ Trojan horse and logic bomb programs are termed "programs" rather
than "viruses" because they.
15
Denial-of-Service
For many microcomputer users, antivirus control procedures are often

better safeguards. These include:
(1) buying shrink-wrapped software from reputable sources,
(2) avoiding illegal software copying,
(3) not downloading suspicious Internet files,
(4) deleting e-mail messages from unknown sources before opening them,
and
(5) maintaining complete backup files in the event you must rebuild your
system from scratch.
16
PREVENTING COMPUTER CRIME AND FRAUD
What can organizations do to protect themselves against computer

abuse? Experts note that, for all their intricacy and mystique, we can
protect computer systems from crimes, abuses, and fraud just as well as
we can manual systems, and sometimes better. For example, computers
can be programmed to automatically search for anomalies and to print
exception conditions on control reports.
These computerized monitoring systems are often superior to manual

surveillance methods because they are automatic and can screen 100
percent, instead of merely a sample, of the target population data.
17
Enlist Top-Management Support

Most employees do not automatically follow organizational security
policies and procedures they are rarely rewarded for it, and such tasks
take time away from those activities for which they are rewarded.
This is why experts agree that computer security begins (or ends) with the
top management and security policies.
18
Without such policies, for example, organizations can only expect limited
employee:
(1) compliance with security procedures,
(2) sensitivity to potential problems,
(3) awareness of why computer abuse is important.
▪ Unfortunately, many top managers are not fully aware of the dangers
of computer crime, abuse, and fraud and therefore are not sufficiently
concerned about this type of offense.
▪ This is why security safeguards are effective only if top management
takes computer crime seriously and chooses to financially support and
19
enforce control procedures to stop, or at least minimize, computer
crimes.
Increase Employee Awareness and Education

Studies suggest that informal discussions, periodic departmental memos,
and formal guidelines are among the most popular educational tools for
informing employees about computer crime and abuse. Requiring new
hires to sign security statements indicating that they have received, read,
and understand policy statements can also help.
According to the 2008-2009 KPMG Integrity Survey, employees who work

in companies with comprehensive ethics and compliance programs
reported more favorable results across the board than those employees
who work in companies without such programs.
20
Increase Employee Awareness and Education
For example, employees who work in organizations with these programs
reported fewer instances of misconduct and higher levels of confidence in
management's integrity, believing that the CEO and other senior
executives set the right tone at the top.
The report's authors also believe that these programs eliminate a number
of conditions that might foster misconduct-for example,
(1) pressure to do whatever it takes to meet targets,
(2) the idea that policies and procedures are easy to bypass or override,
(3) the conviction that rewards are based on results, regardless of the
method used.
21
Ethical Issues and Professional Associations
Ethical concerns are often the issue in instances of computer abuse. In
cases involving hacking, for example, ignorance of proper conduct or
misguided playfulness may be the problem.
The accounting profession has a number of associations, such as Institute

of Internal Auditors (IIA), the Institute of Management Accountants
(IMA), the American Institute of Certified Public Accountants (AICPA),
and the Information Systems Audit and Control Association (ISACA)
that have had codes of ethics or codes of professional conduct in force for
a number of years.
22
These professional accounting association codes are self- imposed and
self-enforced rules of conduct.
One of the most important goals of a code of ethics or conduct is to aid

professionals in selecting among alternatives that are not clear- cut.
Included within professional association codes are rules pertaining to
independence, technical competence, and proper practices during audits
and consulting engagements involving information systems.
The certification programs of these associations increase awareness of the

codes of ethics and are essential in developing professionalism.
23
▪ Professional accounting associations at both the national and state
level have established ethics committees to assist practitioners in the
self-regulation process.
▪ These ethics committees provide their members with continuing
education courses, advice on ethical issues, investigations of possible
ethics violations, and instructional booklets covering a variety of ethics
case studies. Some of the ethics committees provide their members
with a hotline to advise them on the ethical and moral dilemmas
experienced in the workplace. These committees also encourage the
instruction of ethics in accounting curricula at colleges and universities.
24
QUIZ!
Let’s challenge our minds…
“
Your positive action combined with
positive thinking results in success
-Shiv Khera
26
27

AIS Chapter 11

Uploaded by

Copyright:

Available Formats

AIS Chapter 11

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

AIS Chapter 11

Uploaded by

Copyright:

Available Formats

Chapter 11:

➢ Not all computer-related offenses are illegal-some are just unethical.

3. the Association of Certified Fraud Examiners (ACFE) - an

3. the Association of Certified Fraud Examiners (ACFE) - an

1. Computer Crime - someone manipulates a computer or computer

✓ FBI is investigating approximately 800 separate incidents of economic

1. Compromising Valuable Information

▪ A computer virus is an attachment to other files or programs that

▪ Most computer viruses reside on secondary storage media, where they

For many microcomputer users, antivirus control procedures are often

What can organizations do to protect themselves against computer

These computerized monitoring systems are often superior to manual

Enlist Top-Management Support

Increase Employee Awareness and Education

According to the 2008-2009 KPMG Integrity Survey, employees who work

The accounting profession has a number of associations, such as Institute

One of the most important goals of a code of ethics or conduct is to aid

The certification programs of these associations increase awareness of the

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.