Computer Crimes
Computer crimes consist of illegal use of or the unauthorized entry into a computer system or computer data to tamper, interfere, damage, or manipulate the system or data. Computers can be the subject of the crime, the tool of the crime, or the object of the crime. • Computers as the Subject of the Crime
• Computers as the Tool of the Crime
• Computers as the Object of the Crime
• Reducing Vulnerability
Computers as the Subject of the Crime
As the subject of a crime, someone would use your computer or another computer to willfully alter the data stored in the computer, adding fraudulent, inaccurate data, altering data, or omitting input data. Some motives are revenge, protest, competitive advantage, and ransom. Most computer related crimes are committed by people who are well-versed in computer technology. Most cases of theft by computer result from preparation of false input data. Have an outside consultant review your input controls and strengthen them if needed.
Computers as the Tool of the Crime
As the tool of a crime, someone would use your computer to gain access to or alter the data stored on another computer. Examples are telecommunications and computer manipulation crimes. Regarding the former, law enforcement agents working with telephone companies can identify phone hacking activity, including the location of the residence, and can provide search warrants and accompanying experts in the service of the warrant. Related crimes are computer hacking and unauthorized use of the telephone system. The latter includes embezzlement, crediting money to an account, continuing payroll checks after termination, removing the limit from a credit card account, fraud, and support of criminal enterprises, (e.g. drug distribution).
Computers as the Object of the Crime
As the object of a crime, computers and system components can be stolen, sabotaged, or destroyed. Software can be pirated. More importantly, trade secrets and sensitive business information stored in computers can be lost when computers are stolen.
Reducing Vulnerability
Your computers and computer information should be protected just as you would any valuable business asset. Stay informed and use new computer security devices and information. The following tips deal with physical, procedural, and operational protective measures, personnel policies, and anti-virus protection.Physical Protective Measures
• Install surface locks, cable locking devices, and fiber-optic loops to prevent equipment theft.
• Locate the computer room and data storage library away from outside windows and walls to prevent
damage from external events.
• Install strong doors and locks to the computer room to prevent equipment theft and tampering.
• Reinforce interior walls to prevent break-ins. Extend interior walls to the true ceiling.
• Restrict access to computer facilities to authorized personnel. Require personnel to wear distinct,
color-coded security badges in the computer center. Allow access through a single entrance. Other
doors should be alarmed and used only as emergency exits.
• Classify information into categories based on importance and confidentiality. Use labels such as
“Confidential” and “Sensitive.”
• Identify software, programs, and data files that need special access controls.
• Install software access control mechanisms. Require a unique, verifiable form of identification, such as a
user code, or secret password for each user. Install special access controls, such as a call back
procedure, if you allow access through a dial telephone line connection.
• Encrypt confidential data stored in computers or transmitted over communication networks. Use National
Institute of Standards and Technology (NIST) data encryption standards.
• Design audit trails into your computer applications. Log all access to computer resources with unique
user identification.
• Separate the duties of systems programmers, application programmers, and computer programmers.
• Establish procedures for recovering your operating system if it is destroyed. Store all back up data offsite.
• Review automated audit information and control reports to determine if there have been repeated,
unsuccessful attempts to log on both from within and outside your facility. Look for unauthorized changes
to programs and data files periodically.
Personnel Policies
• Monitor activities of employees who handle sensitive or confidential data. Watch for employees who work
abnormally long hours, or who refuse to take time off. Many computer crime schemes require regular,
periodic manipulation to avoid detection. Be aware of employees who collect material not necessary to
their jobs, such as programming manuals, printouts for data, programs and software manuals.
• Change security password codes to block further access by employees who leave or are fired. The latter
become a high risk to your company for revenge or theft.
• Establish rules for computer use by employees, including removal of disks or printed output. All
employees should sign and date a printed copy of these rules to indicate that he/she understands them.
• Don't bring disks in from outside sources
• Scan demo disks from vendors, shareware, or freeware sources for viruses.
• Restrict use of electronic bulletin boards.
• Scan downloaded files for viruses. Avoid downloading executable files.
• Make regular back ups to aid in recovery.