Information Security

Information systems security, refers to the processes and methodologies involved with keeping information confidential, available, and assuring its integrity.

➢ Security:
1. a feeling secure; freedom from fear, doubt, etc. 2. protection; safeguard
3. something given as a pledge of repayment, etc. 4. [pl.] bonds, stocks, etc.
➢ Secure
1. [Firm] fastened, bound, adjusted
2. [Safe] guarded, unharmed, defended
3. [Self-confident] assured, stable, determined
➢ Information Systems Security: issues, theories, techniques, and tools that deals with the protection and safeguard of computer systems and information.
➢ Information systems security, refers to the processes and methodologies involved with keeping information confidential, available, and assuring its integrity.

cs691

chow

Threats to Information Security

➢A threat to an information resource is any danger to which a system may be exposed.
➢The exposure of an information resources is the harm, loss or damage that can result if a threat compromises that resource.
➢A system’s vulnerability is the possibility that the system will suffer harm by a threat.
➢Risk is the likelihood that a threat will occur.
➢Information system controls are the procedures, devices, or software aimed at preventing a compromise to the system.

Chapter 16

chow

cs691

Threats

➢Human errors can occur in the design of the hardware and/or information system.
Also can occur in programming, testing, data collection, data entry, authorization and procedures.
Contribute to more than 50% of control and security-related problems in organizations.

cs691

chow

Threats (Continued)

➢Environmental hazards include earthquakes, severe storms, floods, power failures or strong fluctuations, fires (most common hazard), explosions, ...etc.
➢Computer system failures can occur as the result of poor manufacturing or defective materials.

Chapter 16

chow

cs691

Threats(Continued)

➢Cybercrimes are fraudulent activities committed using computers and communications networks, particularly the Internet.

Chapter 16

chow

cs691

Threats (Continued)

➢Hacker. An outside person who has penetrated a computer system, usually with no criminal intent.
➢Cracker. A malicious hacker.
➢Social engineering. Computer criminals or corporate spies get around security systems by building an inappropriate trust relationship with insiders.

Chapter 16

chow

cs691

Threats (Continued)

• ➢  Snooping: unauthorized interception of information, listen to communications, browse files/system info
  
• ➢  Masquerading or spoofing: an impersonation of one entity by another.
  
• ➢  Viruses
  
• ➢  Worms
  
• ➢  Man-in-the middle attack.
  
• ➢  Keystroke logger.
  
• ➢  Denial of Service: a long term inhibition of service
  

cs691

chow

Four Basic Security Services
i. Confidentiality: the concealment of information or resources.
ii. Integrity: the trustworthiness of data and resources iii. Availability: the ability to use the information or
resources desired.
iv. Non-repudiation.

cs691

chow

i. Confidentiality
➢The prevention of unauthorized disclosure of information.
➢Confidentiality is keeping information secret or private.
➢Confidentiality might be important for military, business or personal reasons.

cs691

chow

Confidentiality
➢The need for keeping information secret arises from:

• ●  Enforcing the “need to know” principle in military and
  civilian government agencies.
  
• ●  Protecting proprietary designs from competitors
  
• ●  Protecting a company’s personnel records
  
• ●  Protecting personal financial/ID info against ID theft.
  ➢Apply to existence of data or traffic pattern
  ➢ Apply to resource hiding
  ● System configuration data
  ● Systems/Equipment/Service Provider used.
  

cs691

chow

Confidentiality
➢ Access control mechanisms support confidentiality. For example,
• Cryptography
• File access control

cs691

chow

ii Integrity
➢Preventing improper or unauthorized change i.e. Information should be accessible and useable upon appropriate demand by an authorised user
➢Two types of integrity:

• Data integrity (content of information)
  
• Origin integrity (source of the data, related to authentication) ! significant bearing on the credibility and trust of the people who creates the info.
  

cs691

chow

Integrity Mechanisms
➢Prevention mechanisms: They seek to maintain the integrity of the data by blocking
● any unauthorized attempts to change the data, or
● e.g., intrusion
● Protect with adequate authentication and access controls
● Any attempts to change the data in unauthorized ways. ● Protect with (independent) Auditing, persons with integrity
➢Detection mechanisms: report the data integrity is compromised, by analyzing system events or data itself.

cs691

chow

Integrity and Confidentiality
➢Confidentiality work finds whether data is compromised.
➢Integrity work includes checking the correctness and trustworthiness of the data.
● This includes the history of the data
●

cs691

chow

Integrity of the origin of data
● How it is arrived (transport channel integrity) ● How well it is protected after it arrived.

iii Availability

• ➢  Related to the reliability and system design
  
• ➢  Some may deliberately arrange to deny access to data or service
  by making it unavailable.
  
• ➢  The Attempts to block availability is called Denial of Service attacks.
  
• ➢  System designs usually assume a statistical model to analyze expected patterns of use.
  
• ➢  Those access patterns that follow the statistical model are allowed to use the services.
  
• ➢  Deliberate attempt can “train” the IDS to treat attacks as a typical events.
  

cs691

chow

iv Non-repudiation
➢Non-repudiation is the prevention of either the sender or the receiver denying a transmitted message.
➢ A system must be able to prove that certain messages were sent and received.
➢Non-repudiation is often implemented by using digital signatures.

cs691

chow

Access Controls:
➢The limitation and control of access through identification and authentication.
➢ A system needs to be able to indentify and authenticate users for access to data, applications and hardware.
➢In a large system there may be a complex structure determining which users and applications have access to which objects.

cs691

chow

Authentication:
•Proving that you are who you say you are, where you say you are, at the time you say it is.
•Authentication may be obtained by the provision of a password or a scan of your retina.
Authorization:
Is the function of specifying access rights to resources related to information and computer access control which is basically defined in the access policy.

cs691

chow

Policy and Mechanism:
➢Security policy is a statement of what is, and what is not, allowed.
➢Security mechanism is a method, tool, or procedure for enforcing a security policy.

cs691

chow

Goals of Security

• ➢  Given a security policy’s spec of “ secure” and “nonsecure” actions. The security mechanisms can
  
• ➢  Prevent the attack.
  ● ●
  
• ➢  Detect the attack.
  ● ● ●
  

Implement mechanisms that attacker can not alter. Password protection; ingress filtering

Determine if attack is underway, has occurred, and report it. Monitor the attack activity, nature, severity and results. Log/report high # of incorrect password.

➢ Recover from the attack.
1. Stop attack, Assess and repair damages. (backup and recovery,

cs691

chow

identification and fixing the vulnerabilities, retaliation)

2. Continue to function while being attacked (fault tolerant design) 

LECTURE TWO
RECORDING OF TRANSACTIONS

Introduction
 In previous lecture, you saw how various events had changed two items in the balance sheet.
 Events which result in such changes are known as „transactions‟.
 This means that if the proprietor asks the price of some goods, but does not buy them, then there is no transaction.
 If the proprietor later asks the price of some other goods, and then buys them, then there would be a transaction, and
two balance sheet items would then have to be altered.

Accounting Cycle
 Accounting cycle includes the following:
 Recording: In the first instance, all transactions should be recorded in the journal or subsidiary books as and when they take place.
 Classifying: All entries in the journal or subsidiary books are posted to the appropriate ledger accounts to find out at a glance the total effect of all such transactions in a particular account.
 Summarising: The last stage is to prepare the trial balance and final accounts with a view to ascertain the profit or loss made during a particular period and the financial position of the business on a particular date.

Journal
 When the business transactions take place, the first step is to record the same in the books of original entry or subsidiary books or books of prime or journal.
 Thus journal is a simple book of accounts in which all the business transactions are originally recorded in chronological order and from which they are posted to the ledger accounts at any convenient time.
 Journalising refers to the act of recording each transaction in the journal and the form in which it is recorded, is known as a journal entry.

Sub-division of Journal
 When innumerable number of transactions takes place, the journal, as the sole book of the original entry becomes inadequate. Thus, the number and the number and type of journals required are determined by the nature of operations and the volume of transactions in a particular business. There are many types of journals and the following are the important ones:

• –  Sales Day Book- to record all credit sales.
  
• –  Purchases Day Book- to record all credit purchases.
  
• –  Cash Book- to record all cash transactions of receipts as well as payments.
  
• –  Bills Receivable Book- to record the details of all the bills received.
  
• –  Sales Returns Day Book- to record the return of goods sold to customers on credit.
  
• –  Purchases Returns Day Book- to record the return of goods purchased from suppliers on credit.
  
• –  Bills Payable Book- to record the details of all the bills accepted.
  
• –  Journal Proper-to record all residual transactions which do not find place in any of the aforementioned books of original entry.
  

Ledger

•   Ledger is a main book of account in which various accounts of personal, real and nominal nature, are opened and maintained.
  
•   In journal, as all the business transactions are recorded chronologically, it is very difficult to obtain all the transactions pertaining to one head of account together at one place.
  
•   But, the preparation of different ledger accounts helps to get a consolidated picture of the transactions pertaining to one ledger account at a time.
  
•   Thus, a ledger account may be defined as a summary statement of all the transactions relating to a person, asset, expense, or income or gain or loss which have taken place during a specified period and shows their net effect ultimately.
  

Sub-division of Ledger
 In a big business, the number of accounts is numerous and it is found necessary to maintain a separate ledger for customers, suppliers and for others. Usually, the following three types of ledgers are maintained in such big business concerns.

• –  Debtors’ Ledger: It contains accounts of all customers to whom goods have been sold on credit. From the Sales Day Book, Sales Returns Book and Cash Book, the entries are made in this ledger. This ledger is also known as sales ledger.
  
• –  Creditors’ Ledger: It contains accounts of all suppliers from whom goods have been bought on credit. From the Purchases Day Book, Purchases Returns Book and Cash Book, the entries are made in this ledger. This ledger is also known as Purchase Ledger.
  
• –  General Ledger: It contains all the residual accounts of real and nominal nature. It is also known as Nominal Ledger.
  

Subsidiary Books
 There are different types of subsidiary books which are commonly used in any big business concern. They are:

• –  Purchases Book: This book is used to record all credit purchases made by the business concern from its suppliers. This book is also known as „Purchases Books‟, „Purchases Journal‟ or „Invoice Book‟.
  
• –  Posting: The total of purchases book for a specified period is debited to the purchases account in the Ledger. The personal accounts are posted by crediting the individual accounts.
  

Subsidiary Books

• –  Sales books: This book is used to record all credit sales effected by the business to its customers. This book is also called as „Sales Book‟, „sales Journal‟ or „Sold Book‟.
  
• –  Posting: The total of the Sales Book for a specified period is credited to the Sales Account in the Ledger. The personal account is posted by debiting the individual accounts.
  

Subsidiary Books

• –  Purchases Returns Books: This book is used to record all transactions relating to the goods returned to suppliers. This book is also known as „Purchases Returns journal‟ or „Returns Outward Book‟, the specimen ruling of a Purchases Returns Book is given below:
  
• –  The columns in this book are similar to those of Purchases Book except the Debit Note Column in which the debit note number is recorded. A debit note represents a note sent to the supplier for the value of goods retuned by the business. While posting, all the personal accounts are debited in the Ledger and the total of Purchases Returns Book is credited to Purchases Returns Account.
  

Subsidiary Books

• –  Sales Returns Books: This book is used to record all transactions relating to goods returned by customers. This book is also known as „Sales Return Journal‟ or „Returns Inwards Book‟, the specimen ruling of sales returns book is given below:
  
• –  The columns in this book are similar to those of Sales Book except the Credit Note Column in which the credit note number is recorded. A credit note represents a note sent to the customer for the value of the goods returned by him. While posting, all the personal accounts are credited in the Ledger and the total of sales returns book is debited to Sales Returns Account
  

Subsidiary Books

• –  Bills Receivable Book: This book is used to record all the bills received by the business from its customers. It contains details regarding the name of the acceptor, date of the bill, place of payment, term of the bill, due date and the amount of the bill. The specimen ruing of a Bills Receivable Book is given below:
  
• –  While posting, the individual customers‟ accounts will be credited and the total of the Bills Receivable Book for a specified period will be debited to the Bills Receivable Account in the Ledger.
  

Subsidiary Books

• –  Bills Payable Book: This book is used to record all the bills accepted by the business drawn by its creditors. It contains details regarding the name of the drawer, payee and date of acceptance, due date, place of payment, term and amount of the bill. The specimen ruling of Bills payable Book is given below:
  
• –  While posting the individual drawer or payee account is debited and the Bills payable Account is credited with the total in the Bills Payable Book.
  

Subsidiary Books
– Journal Proper: This book is used to record all the residual transactions which cannot find place in any of the subsidiary books. While recording, the entries are made in the journal covering both the aspects of the transaction. The following are some of the examples of transactions which are entered in this book.
 Opening entries and closing entries.
 Adjusting entries
 Transfer entries from one account to another account.  Rectification entries.
 Bills of Exchange Entries
 Credit Purchase/sale of an asset other than goods.

Subsidiary Books
– Cash Book: Cash Book is a sub-division of Journal recording transactions pertaining to cash receipts and payments. Firstly, all cash transactions are recorded in the Cash Book wherefrom they are posted subsequently to the respective ledger accounts.

• –  The Cash Book is maintained in the form of a ledger with the required explanation called as narration and hence, it plays a dual role of a journal as well as ledger.
  
• –  All cash receipts are recorded on the debit side and all cash payments are recorded on the credit side. All cash transactions are recorded chronologically in the Cash Book.
  
• –  The Cash Book will always show a debit balance since payments cannot exceed the receipts at any time.
  

Petty Cash Book

•   The word „petty‟ has its origin from the French word „petit‟ which means small. The petty cash book is used to record items like carriage, cartage, entertainment expenses, office expenses, postage and telegrams, stationery, etc. The person who maintains this book is called the „petty cashier‟.
  
•   The petty cash book is used by many business concerns to save the much valuable time of the senior official, who usually writes up the main cash book, to prevent over burdening of the main cash book with so many petty items and to find out readily and easily information about the more important transactions.
  
•   The amount required to meet out various petty items is estimated and given to the petty cashier at the beginning of the stipulated period say a fortnight or a month.
  
•   When the petty cashier finds shortage of money, he has to submit the petty cash book, after making all the entries, to the chief cashier for necessary verifications.
  
•   The chief cashier in turn, verifies all the entries with supporting vouchers and disburses cash or issues cheque for the exact amount spent.
  

Analytical Petty Cash Book

•   In this cash book various items of petty cash payments are analysed and separate analytical columns are provided for recording each and every item.
  
•   The amount of cash received from the chief cashier for meeting out the petty expenses is recorded on the debit side and the actual cash payments towards various petty items are recorded on the credit side in the total as well as analytical columns.
  
•   The analytical column is provided for each usual head of expense like postage & telegrams, printing & stationery, carriage & cartage, traveling expenses, entertainment expenses, office expenses, sundry expenses, etc.
  
•   Subsequently, the totals of these analytical columns are posted to the respective ledger accounts which save labour used in posting each item of payment separately in the ledger.
  
•   Thebalancingofpettycashbookisdoneinthetotalpaymentscolumn.
  

Imprest System

•   In this system, the petty cashier is provided with a sum of cash which is termed as „float‟ after taking into consideration the possible kinds of expenses which would be incurred for a specific period, i.e., a week or a month.
  
•   The petty cashier, at the end of such period, submits the petty cash book, with all entries passed, to the chief cashier.
  
•   The chief cashier, in turn, will verify all the entries with the supporting vouchers and gives the actual amount spent on various petty items.
  
•   This would bring the petty cash balance to the original amount with which he has begun.
  
•   This system of maintaining the original amount of cash as such is known as „Imprest System of maintaining Petty Cash Book‟.
  

Discounts
 Trade discount: When a customer buys goods regularly or buys large quantity or buys for a large amount, the seller is usually inclined to allow a concession in price. He will calculate the total price according to the list of catalogue. But after the total is arrived at, he will make a deduction 5% or 10% depending upon his business policy. This deduction is known as Trade discount.
 Cash Discount: An amount which is allowed for the prompt settlement of debt arising out of a sale within a specified time and calculated on a percentage basis is known as cash discount, i.e., it is always associated with actual payment.

Relationship Between Journal And Ledger
 Both Journal and Ledger are the important books used under double entry system of book keeping.
 The following are the points of comparison between the two:

•   The transactions are recorded first in the journal and then they are posted to
  the ledger.
  
•   Thus journal is the book of first or original entry while the ledger is the book of second entry.
  
•   The journal is the book for chronological record while the ledger is the book for the analytical record.
  
•   Journal is more reliable as compared to the ledger since it is the book in which the entry is passed first.
  
•   The process of recording transaction is termed as “Journalising” while the process of recording transactions in the ledger is known as „Posting‟.
  

Balancing Ledger Accounts

•   Balancing of an account means the process of equalising the two sides of an account by putting the difference on the side where amount is short.
  
•   Where the debit side of an account exceeds the credit side then the difference is put on the credit side, and the account is said to have a debit balance.
  
•   This balance is brought down on the debit side while opening the account.
  
•   Similarly, where the credit side of an account exceeds the debit side, the difference is put on the debit side, and the account is said to have a credit balance.
  
•   This is also brought down on credit side while opening the account.
  

Single Entry and Incomplete Records

•   Whydoubleentryisnotused?
  
•   For every small shopkeeper, market stall, Internet cafe, or other small business to keep its books using a full double entry system would be ridiculous.
  
•   First of all, a large number of the owners of such firms would not know how to write up double entry records, even if they wanted to.
  
•   It is more likely that they would enter details of a transaction once only, using a single entry system.
  
•   Many of them would fail to record every transaction, resulting in incomplete records.
  
•   It is, perhaps, only fair to remember that accounting is supposed to be an aid to management accounting is not something to be done as an end in itself.
  

Single Entry and Incomplete Records

•   Therefore, many small firms, especially retail shops, can have all the information they want by merely keeping a cash book and having some form of record, not necessarily in double entry form, of their debtors and creditors.
  
•   However, despite many small businesses not having any need for accounting records, most do have to prepare financial statements or, at least, calculate their sales or profits once a year.
  
•   How can these be calculated if the bookkeeping records are inadequate or incomplete?
  

The Double Entry System

•   We have seen that every transaction affects two items. We need to show these effects when we first record each transaction.
  
•   That is, when we enter the data relating to the transaction in the accounting books we need to ensure that the items that were affected by the transaction, and only those items, are shown as having changed.
  
•   This is the bookkeeping stage of accounting and the process we use is called double entry.
  
•   You will often hear it referred to as double entry bookkeeping.
  
•   Either term is correct.
  

What is a Double Entry System?

•   Is a book keeping system by which each transaction is entered twice.
  
•   So it shows the double effect of transactions when doing transactions.
  
•   These transactions are entered in accounts or ledgers.
  
•   If we want to show the double effect of every transaction when we are doing our bookkeeping, we have to show the effect of each transaction on each of the two items it affects.
  
•   For each transaction this means that a bookkeeping entry will have to be made to show an increase or decrease of one item, and another entry to show the increase or decrease of the other item.
  

What is a Double Entry System?

•   From this description, you will probably see that the term „double entry bookkeeping‟ is a good one, as each entry is made twice (double entry).
  
•   Instead of constantly drawing up balance sheets after each transaction what we have instead is the „double entry‟ system.
  
•   The basis of this system is that the transactions which occur are entered in a set of accounts within the accounting books.
  
•   An account is a place where all the information referring to a particular asset or liability, or to capital, is recorded.
  
•   Thus, there will be an account where all the information concerning office equipment , buildings etc. will be entered.
  
•   This will be extended so that every asset, every liability and capital will each have its own account for transactions involving that item.
  

The Accounts for Double Entry
 Each account should be shown on a separate page in the accounting books. The double entry system divides each page into two halves. The left-hand side of each page is called the debit side, while the right-hand side is called the credit side. The title of each account is written across the top of the account at the centre. This is the layout of a page of an accounts book

The Accounts for Double Entry
 You describe the entries in the accounts by saying something like „debit account “D” with TZS B and credit account “C” with TZS B‟, inserting the names of the accounts and the actual amount in place of D, C, and B.
 So, for example, if you paid TZS 10,000,000 by cheque for a kettle, you could say „debit the kettle account with TZS 10,000,000 and credit the bank account with TZS 10,000,000‟.
 To actually make this entry, you enter TZS10,000,000 on the left-hand (i.e. debit) side of the kettle account and on the right-hand (i.e. credit) side of the bank account.

The Accounts for Double Entry
 You learnt in lecture one that transactions increase or decrease assets, liabilities or capital. In terms of the assets, liabilities, and capital:

•   to increase an asset we make a DEBIT entry
  
•   to decrease an asset we make a CREDIT entry
  
•   to increase a liability/capital account we make a CREDIT entry
  
•   to decrease a liability/capital account we make a DEBIT entry.
   Placing these in a table organised by type of item, the double entry rules for bookkeeping are:
  

The Accounts for Double Entry
 Let‟s look once again at the accounting equation:
 The double entry rules for liabilities and capital are the same, but they are the opposite of those for assets.
 Looking at the accounts the rules will appear as:

The Accounts for Double Entry

•   For example;
  
•   The proprietor Mr. Kent started business with TZS 20 million in
  cash on 31 June, 2016.
  
•   Mr. Kent bought a motor vehicle costing TZS 9 Million by cash on 25 July, 2016.
  
•   Mr. Kent bought fixtures costing TZS 2.5 Million on 2 August, 2016 on credit from Victoria Ltd.
  
•   Mr. Kent paid the amount owing to Victoria Ltd on 2 September, 2016 by cash.
  

Double Entry for Stock
 Stock is an important asset to the business and it has a tendency of fluctuating often.
 The movement in stock can be seen in these ways;
 Stock increases; the causes for this may be due to;
 The purchases of additional goods from suppliers
 Return inwards e.g. wrong types of goods were dispatched to the customers, goods were damaged in transit, goods are of poor quality
 Stock decreases; this may be caused by the following factors;  Sale of goods
 Returns outwards e.g. supplier sent wrong type of goods to the business.

Double Entry for Stock
 For example;

•   On 2 June, 2017, Mr. Rambo bought goods on credit costing TZS
  600,000 from Kotti.
  
•   On 5 June, 2017 he bought goods from Kuku Ltd for cash TZS 520,000
  
•   On 10th June, 2017 he sold goods on credit for TZS 950,000 to Mr Juan.
  
•   On 25th June, 2017 he sold goods to Mr. Ndunya for cash receiving TZS 220,000.
  
•   Mr. Juan returned some of the goods sold to him costing TZS 98,000 on 4th July, 2017.
  
•   On 8 July, 2017 the owner Mr. Rambo returned goods costing TZS 292,000 to Kotti (the supplier).
  

Control Accounts

•   Variousaccountbalanceshaveadditionsandsubtractionsduring the accounting year.
  
•   So it is important to open control accounts so as to determine the ending balances of these accounts after considering all deductions and additions.
  
•   Types of control accounts:
   Sales ledger control account
  

 This is used to find the ending balance of the account receivable by considering additions and deductions from the account
 Effect of transactions to the sales ledger control account
 The opening balance of the account receivable is DEBIT
 Creditsales:theseareDEBITEDintheaccountsreceivablesoastoincreasedebtors
 Returnsinwards:theseareCREDITEDintheaccountsreceivabletodecreasethefigurefordebtors  Chequesfromdebtors:theseareCREDITEDintheaccountsreceivablesoastodecreasedebtors.

Control Accounts

•   Cash received from debtors: this is DEBITED in the accounts receivable so as to decrease debtors.
  
•   Discounts allowed: these are CREDITED in the accounts receivable so as to decrease debtors.
  
•   Bad debts: these are CREDITED in the accounts receivable so as to decrease debtors.
   Purchases ledger control account
   This is used to find the ending balance of the accounts payable after
  considering additions and deductions to the account.
   Effect of transactions to the purchases ledger control account
  

•   Opening balance of this account is CREDIT since it is the accounts payable.
  
•   Credit purchases: these are CREDITED in this account so as to increase the accounts payable.
  
•   Returns outwards: these are DEBITED in this account to decrease accounts payable.
  
•   Payment to suppliers by cheque: this is DEBITED in the accounts payable
  
•   Cash payment to suppliers: this is DEBITED in the accounts payable.
  
•   Discounts received: this is DEBITED in the accounts payable.
  

Control Accounts
 NB: sometimes the control accounts can have both credit and debit balances.
 For instance normally the sales ledger control account has a debit balance.
 However it can have also a credit balance, this occurs when a debtor pays up the whole the amount owing to him, but later on returned goods to the business causing a credit balance. 

This post was written by: Author Name

Your description comes here!

Get Free Email Updates to your Inbox!

• Rss
• Twitter
• FaceBook
• Google +

Filed Under: event on Wednesday, February 7, 2018