Professor Adams' Lecture Materials

Learning Objective 8B-03: Describe computer fraud and misuse of AIS and corresponding risk-mitigation techniques.

Understanding Computer Fraud and Its Implications

Computer fraud is defined as an intentional act involving deceit, concealment, or violation of trust to obtain assets, avoid payments, or gain a business advantage. The most sought-after digital assets for computer fraud include personal information (like Social Security and bank account numbers), proprietary company information, and trade secrets. Fraudsters may include both insiders, who have legitimate access to data, and external attackers.

The Fraud Triangle and Insider Threats

The fraud triangle identifies three conditions that increase the likelihood of fraud:

Incentive or Pressure: A need or desire that drives individuals to commit fraud.
Opportunity: An environment that lacks sufficient controls, allowing the fraud to be committed.
Rationalization: A personal justification by the perpetrator to make the fraud seem acceptable.

Insiders, often employees with legitimate access to systems, can be a significant source of fraud. Studies show that insider threats, stemming from abuse of authorized access, are frequently overlooked in security assessments.

Common Types of Computer Fraud Schemes

The following are frequent fraud schemes involving computer systems:

Data Theft and Manipulation: Fraudulent access to and alteration of computer-readable data, often for financial gain.
Software Manipulation: Unauthorized modification of software to produce altered financial reports or manipulate data.
Hardware Theft: Physical theft or unauthorized use of hardware for fraudulent purposes.

Computer Fraud Risk Assessment

A structured risk assessment approach helps identify potential fraud threats, possible perpetrators, and relevant controls. A typical risk assessment includes:

Identifying relevant fraud risk factors in IT environments.
Recognizing potential fraud schemes and evaluating their likelihood.
Mapping existing controls to these schemes and identifying any control gaps.
Testing the effectiveness of controls designed to prevent or detect fraud.
Assessing the potential impact of fraud on the organization.

Preventive and Detective Control Measures

To mitigate the risks of computer fraud, organizations employ several preventive and detective controls, including:

Segregation of Duties: Separating tasks among employees to reduce the chance of fraud.
Authorization Controls: Ensuring that access to sensitive data or systems is granted only to authorized individuals.
Continuous Monitoring: Implementing systems to track and log access, monitor transaction-level data, and detect unusual activity in real time.
Employee Training and Policies: Creating awareness through an Acceptable Use Policy (AUP) to outline expected conduct and deter potential fraud.

Role of External Standards and Regulations

The Computer Fraud and Abuse Act (CFAA) of 1986 is a key U.S. regulation that criminalizes unauthorized access to protected computers. Additionally, frameworks like the General Data Protection Regulation (GDPR) protect personal data by mandating companies to notify authorities and affected individuals in the event of a data breach.

Page updated

Google Sites

Report abuse