q. The inability to unilaterally deny having created a document or file or having agreed to perform a transaction. r. Software that limits what actions (read, copy, print, etc.) that users granted access to a file or document can perform. 9.2 Cost-effective controls to provide confidentiality require valuing the information that is to be protected. This involves classifying information into discrete categories. Propose a minimal classification scheme that could be used by any business, and provide examples of the type of information that would fall into each of those categories. There is no single correct solution for this problem. Student responses will vary depending on their experience with various businesses. One minimal classification scheme could be highly confidential or top-secret, confidential or internal only, and public. The following table lists some examples of items that could fall into each basic category. Highly Confidential (Top Secret) Confidential (Internal) Public Research Data Payroll Financial Statements Product Development Data Cost of Capital Security and Exchange Commission Filings Proprietary Manufacturing Processes Tax data Marketing Information Proprietary Business Processes Manufacturing Cost Data Product Specification Data Competitive Bidding Data Financial Projections Earnings Announcement Data 9.3 Download a hash calculator that can create hashes for both and text input. Use it to create SHA-256 (or any other hash algorithm your instructor assigns) hashes for the following: a. A document that contains this text: “Congratulations! You earned an A+” b. A document that contains this text: “Congratulations! You earned an A-” c. A document that contains this text: “Congratulations! You earned an a-” d. A document that contains this text: “Congratulations! You earned an A+” (this message contains two spaces between the exclamation point and the capital letter Y).
control objective DS5.11 addresses the use of encryption during the transmission of information. This should include procedures concerning: Procedures to ensure information is encrypted prior to transmission Specification of approved encryption algorithms Access controls over incoming encrypted information Secure storage of encryption keys SUGGESTED SOLUTIONS TO THE CASES Case 9-1 Protecting Privacy of Tax Returns The department of taxation in your state is developing a new computer system for processing individual and corporate income-tax returns. The new system features direct data input and inquiry capabilities. Identification of taxpayers is provided by using the Social Security number for individuals and federal tax identification number for corporations. The new system should be fully implemented in time for the next tax season. The new system will serve three primary purposes: 1 Data will either be automatically input directly into the system if the taxpayer files electronically or by a clerk at central headquarters scanning a paper return received in the mail. 2 The returns will be processed using the main computer facilities at central headquarters. Processing will include four steps: a. Verifying mathematical accuracy b. Auditing the reasonableness of deductions, tax due, and so on, through the use of edit routines, which also include a comparison of current and prior years’ data. c. Identifying returns that should be considered for audit by department revenue agents d. Issuing refund checks to taxpayers 3 Inquiry services. A taxpayer will be allowed to determine the status of his or her return or get information from the last three years’ returns by calling or visiting one of the department’s regional offices, or by accessing the department’s web site and entering their social security number. The state commissioner of taxation and the state attorney general are concerned about protecting the privacy of personal information submitted by taxpayers. They want to have potential problems identified before the system is fully developed and implemented so that
Attempts to screen individual returns on the basis of surname, sex, race, etc., rather than tax liability. Training about proper procedures Multi-factor authentication to limit access to system. Encrypt of tax return data stored in system c. Privacy problems could arise in the inquiry of data, and recommended corrective actions, are as follows: Problem Controls Unauthorized access to taxpayer information on web site Strong authentication of all people making inquiries via the web site something other than social security numbers – preferably multi-factor, not just passwords. Encryption of all tax return data while in storage Encryption of all traffic to/from the web site Unauthorized release of information in response to telephone inquiry Training on how to properly authenticate taxpayers who make telephone inquiries Strong authentication of taxpayers making telephone inquiries Disclosure of taxpayer information through improper disposal of old Training on how to paper documents prior to disposal Training on how to wipe or erase media that contained tax return information prior to disposal (CMA Examination, adapted) Case 9-2 Generally Accepted Privacy Principles Obtain the practitioner’s version of Generally Accepted Privacy Principles from the web site (). You will find it located under professional resources and then information technology. Use it to answer the following questions: