Expertiza_Wiki - User contributions [en]

Category:Abuse

2008-08-12T15:20:55Z

Jmsevits:

[[Category:Ethics in Computing]]

Category:Ethics in Computing

2008-08-12T15:20:02Z

Jmsevits:

Test001

2008-08-12T15:17:32Z

Jmsevits:

[[Category:Ethics in Computing]]
[[Category:Abuse]]

== Study Guide ==

=== Definitions ===

* [http://www.cknow.com/ckinfo/servicedenial.htm DoS] - Denial of Service. Prevents or reduces an internet applications ability to be used by others.
* [http://www.irchelp.org/irchelp/nuke/#osattack Operating System attacks] - A DoS attack which targets bugs in specific operating systems and can be fixed with patches.
* [http://www.irchelp.org/irchelp/nuke/#netattack Networking attacks] - A DoS attack which exploit inherent limitations of networking and may require firewall protection.
* Nuke - also called "hacking" or "cyber-attacks", are just different names for DoS attacks.
* [http://www.pentics.net/denial-of-service/white-papers/smurf.cgi Smurf attacks] - named after its exploit program, is one of the most recent in the category of network-level attacks against hosts. A perpetrator sends a large amount of ICMP echo (ping) traffic at IP broadcast addresses, all of it having a spoofed source address of a victim.
* Fraggle attack - analogous to the smurf attack, except that UDP echo requests are used for the stimulus stream instead of ICMP echo requests. The third and fourth lines of the access list identify fraggle attacks. The appropriate response for the victims is the same, except that UDP echo is a less important service in most networks than is ICMP echo, and can therefore be disabled completely with fewer negative consequences.
* [http://www.networkmagazine.com/article/NMG20000512S0041 Distributed DoS attack] - utilizes a number of compromized systems to launch a large scale attack on one location. Since there may be hundreds or thousands of extra computers involved, the magnitude of the attack is greater than most other attacks listed.

=== Denial-of-service ===

[http://members.tripod.com/aprenacid/hackfaq/hackfaq-5.html Denial of service] is when someone decides to make your network or firewall useless and unavailable to others by disrupting it, crashing it, jamming it, or flooding it. The problem with denial of service on the Internet is that it is impossible to prevent. The reason has to do with the distributed nature of the network: every network node is connected via other networks which in turn connect to other networks, etc. A firewall administrator or ISP only has control of a few of the local elements within reach. Many [http://www.cnbc.com/commentary/commentary_full_story_stocks.asp?StoryID=13136 universities] have become the hosts for such attacks, because there are so many computers available for public use. An attacker can always disrupt a connection "upstream" from where the victim controls it. In other words, if someone wanted to take a network off the air, they could do it either by taking the network off the air, or by taking the networks it connects to off the air, ad infinitum.

There are many, many, ways someone can deny service, ranging from the complex to the brute-force. Presenting these attacks to the media can be good to inform others of the potential risks they face. It can also be a drawback, because people want to [http://www.abcnews.go.com/sections/tech/DailyNews/webattacks000218.html mimic] these actions. Denial of service attacks have been increasing in popularity because kids can simply download software that will do the attack work for them. All they need is an internet connection and a compiler, such as gcc that comes along with a free distribution of Linux. With these 'easy to use' programs, people think they should not be held [http://macobserver.com/columns/thebackpage/2000/20000211.shtml accountable] for their actions if they really didn't know what they were doing. There is a hefty [http://www.fbi.gov/pressrm/radio/archive/491text.htm penalty] for getting caught disrupting someone else's services by a DoS attack.Someone found guilty of engaging in a DoS attack will suffer a penalty of 6 months to 5 years in jail and up to a $250,000 fine.

Denial-of-service (DoS) attacks fall into four broad [http://www.cknow.com/ckinfo/servicedenial.htm categories: ]Tying up a server, Tying up CPU cycles or resources, Disabling web traffic (this can also happen accidentally), and Mail bombs.The intent of a[http://news.cnet.com/news/0-1007-200-1546362.html?tag=rltdnws DoS ]is to prevent other users from being able to access certain Internet process.

=== Distributed Denial-of-service (DDoS) ===

Distributed Denial of service [http://pmg.com/tip_archive/00_5_denial.htm attacks] work the same as other DoS attacks but instead of sending the congestion from one computer it is sent from manny. This is done because most servers have a pattern recognition system to prevent multiple request from the same source. Therefore, by distributing the calls the target server dosen't realize its under attack. In order for such an attack to work the attacker has to[http://www.cisco.com/warp/public/707/newsflash.html control ]several other machines.

A DDoS attack is one that comes from many "dummy" computers at the same time to flood the server. This is done either so that it is harder to trace or so that they can use more bandwidth. DDoS attacks are what have been used recently to take down large web servers such as Yahoo! and [http://washingtonpost.com/wp-dyn/articles/A47581-2001Jan25.html Microsoft].

==== Tracing attacks ====

Most hackers spoof their IP or bounce data off of another machine so that it is hard to track them. It is even harder to trace down the culprit of a DDoS attack because even if the user does connect directly it is one of many that are connecting so it is dificult to find the real culpret.

=== DoS Prevention ===

Some attacks can be prevented. Many exploit flaws in software that can be fixed easily. Some attacks cannot be prevented though. Brute force attacks for example are very hard to prevent. There are some firms that are working to prevent DDoS attacks but it is very difficult to do and there are currently no good solutions out on the market.

Security experts agree that [http://www.wired.com/news/technology/0,1282,34230,00.html attacks] that blocked access to Yahoo, eBay, and other popular Web sites are indefensible as they occur. Some DoS attacks can be prevented with a [http://howstuffworks.lycos.com/firewall.htm firewall ]but they have to be configured properly or they are a [http://www.acm.org/technews/articles/2000-2/0211f.html#item5 waste ].

=== How To Report a DoS Attack ===

There are several ways to Report a computer attack, depending on the type of [http://www.usdoj.gov/criminal/cybercrime/reporting.htm attack ]. If you follow [http://www.sans.org/newlook/publications/incident_handling.htm precautionary] procedure you will reduce your risk of an attack and reduce the down when one happens. By following these [http://www.indy.net/~sabronet/dos/what2do.html procedures] after a Dos attack you will also increase the chance of catching the attacker.

* Record the time of the attack.
* Record your own IP address at the time of attack.
* Record the attackers IP address if possible.
* Never fight back by attacking the attacker.
* If you are using a dialin, disconnect and reconnect to your ISP.
* Find out what domain the attacker's IP address is in.
* Contact your internet service provider for help and have them advise you of your rights in this matter.

=== Ethical implications ===

Denial of Service attacks can be considered an invasion of a persons/companys personal space. This invasion is mild in comparison to [http://www.acm.org/technews/articles/2000-2/0315w.html#item17 real-life] crimes. But, as more and more news storys come out about Internet crimes more and more criminals are turning an eye to their computer. [http://www.acm.org/technews/articles/2000-2/0412w.html#item13 Cyber protesters] are also finding the Internet. They can draw attention to a cause with out having to risk the pepper spray. The only [http://www.zdnet.com/zdnn/content/reut/0323/296845.html legitimate] reason for a DoS attack would be to increase security of your own network. This can be done by hiring someone to break into you system or to attack with a DoS. However, this brings up the question: How do you train a consultant to attack a system with out letting him attack a system?

== Bibliography ==

=== Denial of Service (DoS) ===

* [http://www.cert.org/research/JHThesis/Chapter11.html Denial of Service Incidents] ''CERT Coordination Center''
* [http://java.sun.com/sfaq/denialOfService.html Java Security - Denial of service] ''Sun Microsystems, Inc.''
* [http://www.usdoj.gov/criminal/cybercrime/dag0229.htm Internet Denial of Service Attacks and the Federal Response]Eric Holder, U.S. Department of Justice
* [http://www.usdoj.gov/criminal/cybercrime/vatis.htm Cybercrime] Michael A. Vatis, U.S. Department of Justice
* [http://www-cs.etsu.edu/gotterbarn/stdntppr/stats.htm Statics On Cyber-terrorism] Jimmy Sproles and Will Byars

=== The Law vs. DoS ===

* [http://cnn.com/2000/TECH/computing/02/16/hacking.investigation.01/index.html Clinton administration develops Internet security proposals as investigators pursue hackers]

''CNN''
* [http://abcnews.go.com/sections/tech/DailyNews/senatehearing_000216.html Feds Tackle Cybercrime] ''ABC News''
* [http://abcnews.go.com/sections/tech/DailyNews/netsummit_000215a.html Clinton Hosts Web Security Summit] ''ABC News''
* [http://www.mgrossmanlaw.com/articles/1999/cyberterrorism.htm Cyberterrorism] Mark Grossman
* [http://www.eff.org/pub/Legal/comp_security_legal.article An Introduction to Computer Security For Lawyers] Simson L. Garfinkel

=== Ethics and DoS ===

* [http://www-cs.etsu.edu/gotterbarn/stdntppr/cases.htm Examples of Cyber-terrorism] Jimmy Sproles and Will Byars

=== Preventing DoS Attacks ===

* [http://abcnews.go.com/sections/tech/DailyNews/fncl_hacker000215.html Advance Warning - Banks Knew of Impending Web Attacks Days Before] Ted Bridis, ''ABC News''<br />
* [http://www.l0pht.com/advisories/rdp.txt L0pht Security Advisory] ''L0pht''
* [http://www.wired.com/news/technology/0,1282,34230,00.html DoS: Defense Is the Best Offense] Chris Oakes, ''WIRED News''
* [http://www.wired.com/news/business/0,1367,34249,00.html Doing Away with DoS] Michelle Finney, ''WIRED News''
* [http://www.cert.org/incident_notes/IN-2000-01.html Windows Based DDOS Agents] ''CERT Coordination Center''
* [http://www.cert.org/incident_notes/IN-99-07.html Distributed Denial of Service Tools] ''CERT Coordination Center''

=== Recent Stories About DoS Attacks: ===

* [http://abcnews.go.com/sections/tech/DailyNews/webattack000308.html 'Coolio' Arrested - Alleged Web Site Vandal Charged] Jonathon Dube, ''ABC News''
* [http://abcnews.go.com/sections/tech/DailyNews/webattack000303.html 'Coolio' Admits to Hacking 3 Different Web Sites] Brian Ross and Jonathon Dube, ''ABC News''
* [http://www.abcnews.go.com/sections/tech/DailyNews/webattacks000225.html Two More Sites Attacked - Microsoft.com and National Discount Brokers Are Latest Victims]

Jonathon Dube, ''ABC News''
* [http://www.abcnews.go.com/sections/tech/DailyNews/webattacks000218.html Copycat Attacks? - Vandals Continue to Attack Smaller Web Sites; Investigation Goes Global, ]

Jonathon Dube and Erica D. Rowell, ''ABC News''
* [http://abcnews.go.com/sections/tech/DailyNews/yahoo000208.html Web Under Attack - Five Leading Web Sites Suffer Outages After Coordinated Attacks This Week] Jonathon

Dube, ''ABC News''
* [http://abcnews.go.com/sections/tech/dailynews/cyberchat0209.html A Tangled Web - A Chat with Former Hacker "Weld Pond"] ''ABC News''

=== How To Report a DoS Attack ===

* [http://www.usdoj.gov/criminal/cybercrime/reporting.htm How to Report Internet-Related Crime] ''U.S. Department of Justice''
* [http://www.sans.org/newlook/resources/policies/item7.pdf NAS Security Incident Handling Procedures] ''SANS Institute''

Test001

2008-08-12T15:05:46Z

Jmsevits:

== Study Guide ==

=== Definitions ===

* [http://www.cknow.com/ckinfo/servicedenial.htm DoS] - Denial of Service. Prevents or reduces an internet applications ability to be used by others.
* [http://www.irchelp.org/irchelp/nuke/#osattack Operating System attacks] - A DoS attack which targets bugs in specific operating systems and can be fixed with patches.
* [http://www.irchelp.org/irchelp/nuke/#netattack Networking attacks] - A DoS attack which exploit inherent limitations of networking and may require firewall protection.
* Nuke - also called "hacking" or "cyber-attacks", are just different names for DoS attacks.
* [http://www.pentics.net/denial-of-service/white-papers/smurf.cgi Smurf attacks] - named after its exploit program, is one of the most recent in the category of network-level attacks against hosts. A perpetrator sends a large amount of ICMP echo (ping) traffic at IP broadcast addresses, all of it having a spoofed source address of a victim.
* Fraggle attack - analogous to the smurf attack, except that UDP echo requests are used for the stimulus stream instead of ICMP echo requests. The third and fourth lines of the access list identify fraggle attacks. The appropriate response for the victims is the same, except that UDP echo is a less important service in most networks than is ICMP echo, and can therefore be disabled completely with fewer negative consequences.
* [http://www.networkmagazine.com/article/NMG20000512S0041 Distributed DoS attack] - utilizes a number of compromized systems to launch a large scale attack on one location. Since there may be hundreds or thousands of extra computers involved, the magnitude of the attack is greater than most other attacks listed.

=== Denial-of-service ===

[http://members.tripod.com/aprenacid/hackfaq/hackfaq-5.html Denial of service] is when someone decides to make your network or firewall useless and unavailable to others by disrupting it, crashing it, jamming it, or flooding it. The problem with denial of service on the Internet is that it is impossible to prevent. The reason has to do with the distributed nature of the network: every network node is connected via other networks which in turn connect to other networks, etc. A firewall administrator or ISP only has control of a few of the local elements within reach. Many [http://www.cnbc.com/commentary/commentary_full_story_stocks.asp?StoryID=13136 universities] have become the hosts for such attacks, because there are so many computers available for public use. An attacker can always disrupt a connection "upstream" from where the victim controls it. In other words, if someone wanted to take a network off the air, they could do it either by taking the network off the air, or by taking the networks it connects to off the air, ad infinitum.

There are many, many, ways someone can deny service, ranging from the complex to the brute-force. Presenting these attacks to the media can be good to inform others of the potential risks they face. It can also be a drawback, because people want to [http://www.abcnews.go.com/sections/tech/DailyNews/webattacks000218.html mimic] these actions. Denial of service attacks have been increasing in popularity because kids can simply download software that will do the attack work for them. All they need is an internet connection and a compiler, such as gcc that comes along with a free distribution of Linux. With these 'easy to use' programs, people think they should not be held [http://macobserver.com/columns/thebackpage/2000/20000211.shtml accountable] for their actions if they really didn't know what they were doing. There is a hefty [http://www.fbi.gov/pressrm/radio/archive/491text.htm penalty] for getting caught disrupting someone else's services by a DoS attack.Someone found guilty of engaging in a DoS attack will suffer a penalty of 6 months to 5 years in jail and up to a $250,000 fine.

Denial-of-service (DoS) attacks fall into four broad [http://www.cknow.com/ckinfo/servicedenial.htm categories: ]Tying up a server, Tying up CPU cycles or resources, Disabling web traffic (this can also happen accidentally), and Mail bombs.The intent of a[http://news.cnet.com/news/0-1007-200-1546362.html?tag=rltdnws DoS ]is to prevent other users from being able to access certain Internet process.

=== Distributed Denial-of-service (DDoS) ===

Distributed Denial of service [http://pmg.com/tip_archive/00_5_denial.htm attacks] work the same as other DoS attacks but instead of sending the congestion from one computer it is sent from manny. This is done because most servers have a pattern recognition system to prevent multiple request from the same source. Therefore, by distributing the calls the target server dosen't realize its under attack. In order for such an attack to work the attacker has to[http://www.cisco.com/warp/public/707/newsflash.html control ]several other machines.

A DDoS attack is one that comes from many "dummy" computers at the same time to flood the server. This is done either so that it is harder to trace or so that they can use more bandwidth. DDoS attacks are what have been used recently to take down large web servers such as Yahoo! and [http://washingtonpost.com/wp-dyn/articles/A47581-2001Jan25.html Microsoft].

==== Tracing attacks ====

Most hackers spoof their IP or bounce data off of another machine so that it is hard to track them. It is even harder to trace down the culprit of a DDoS attack because even if the user does connect directly it is one of many that are connecting so it is dificult to find the real culpret.

=== DoS Prevention ===

Some attacks can be prevented. Many exploit flaws in software that can be fixed easily. Some attacks cannot be prevented though. Brute force attacks for example are very hard to prevent. There are some firms that are working to prevent DDoS attacks but it is very difficult to do and there are currently no good solutions out on the market.

Security experts agree that [http://www.wired.com/news/technology/0,1282,34230,00.html attacks] that blocked access to Yahoo, eBay, and other popular Web sites are indefensible as they occur. Some DoS attacks can be prevented with a [http://howstuffworks.lycos.com/firewall.htm firewall ]but they have to be configured properly or they are a [http://www.acm.org/technews/articles/2000-2/0211f.html#item5 waste ].

=== How To Report a DoS Attack ===

There are several ways to Report a computer attack, depending on the type of [http://www.usdoj.gov/criminal/cybercrime/reporting.htm attack ]. If you follow [http://www.sans.org/newlook/publications/incident_handling.htm precautionary] procedure you will reduce your risk of an attack and reduce the down when one happens. By following these [http://www.indy.net/~sabronet/dos/what2do.html procedures] after a Dos attack you will also increase the chance of catching the attacker.

* Record the time of the attack.
* Record your own IP address at the time of attack.
* Record the attackers IP address if possible.
* Never fight back by attacking the attacker.
* If you are using a dialin, disconnect and reconnect to your ISP.
* Find out what domain the attacker's IP address is in.
* Contact your internet service provider for help and have them advise you of your rights in this matter.

=== Ethical implications ===

Denial of Service attacks can be considered an invasion of a persons/companys personal space. This invasion is mild in comparison to [http://www.acm.org/technews/articles/2000-2/0315w.html#item17 real-life] crimes. But, as more and more news storys come out about Internet crimes more and more criminals are turning an eye to their computer. [http://www.acm.org/technews/articles/2000-2/0412w.html#item13 Cyber protesters] are also finding the Internet. They can draw attention to a cause with out having to risk the pepper spray. The only [http://www.zdnet.com/zdnn/content/reut/0323/296845.html legitimate] reason for a DoS attack would be to increase security of your own network. This can be done by hiring someone to break into you system or to attack with a DoS. However, this brings up the question: How do you train a consultant to attack a system with out letting him attack a system?

== Bibliography ==

=== Denial of Service (DoS) ===

* [http://www.cert.org/research/JHThesis/Chapter11.html Denial of Service Incidents] ''CERT Coordination Center''
* [http://java.sun.com/sfaq/denialOfService.html Java Security - Denial of service] ''Sun Microsystems, Inc.''
* [http://www.usdoj.gov/criminal/cybercrime/dag0229.htm Internet Denial of Service Attacks and the Federal Response]Eric Holder, U.S. Department of Justice
* [http://www.usdoj.gov/criminal/cybercrime/vatis.htm Cybercrime] Michael A. Vatis, U.S. Department of Justice
* [http://www-cs.etsu.edu/gotterbarn/stdntppr/stats.htm Statics On Cyber-terrorism] Jimmy Sproles and Will Byars

=== The Law vs. DoS ===

* [http://cnn.com/2000/TECH/computing/02/16/hacking.investigation.01/index.html Clinton administration develops Internet security proposals as investigators pursue hackers]

''CNN''
* [http://abcnews.go.com/sections/tech/DailyNews/senatehearing_000216.html Feds Tackle Cybercrime] ''ABC News''
* [http://abcnews.go.com/sections/tech/DailyNews/netsummit_000215a.html Clinton Hosts Web Security Summit] ''ABC News''
* [http://www.mgrossmanlaw.com/articles/1999/cyberterrorism.htm Cyberterrorism] Mark Grossman
* [http://www.eff.org/pub/Legal/comp_security_legal.article An Introduction to Computer Security For Lawyers] Simson L. Garfinkel

=== Ethics and DoS ===

* [http://www-cs.etsu.edu/gotterbarn/stdntppr/cases.htm Examples of Cyber-terrorism] Jimmy Sproles and Will Byars

=== Preventing DoS Attacks ===

* [http://abcnews.go.com/sections/tech/DailyNews/fncl_hacker000215.html Advance Warning - Banks Knew of Impending Web Attacks Days Before] Ted Bridis, ''ABC News''<br />
* [http://www.l0pht.com/advisories/rdp.txt L0pht Security Advisory] ''L0pht''
* [http://www.wired.com/news/technology/0,1282,34230,00.html DoS: Defense Is the Best Offense] Chris Oakes, ''WIRED News''
* [http://www.wired.com/news/business/0,1367,34249,00.html Doing Away with DoS] Michelle Finney, ''WIRED News''
* [http://www.cert.org/incident_notes/IN-2000-01.html Windows Based DDOS Agents] ''CERT Coordination Center''
* [http://www.cert.org/incident_notes/IN-99-07.html Distributed Denial of Service Tools] ''CERT Coordination Center''

=== Recent Stories About DoS Attacks: ===

* [http://abcnews.go.com/sections/tech/DailyNews/webattack000308.html 'Coolio' Arrested - Alleged Web Site Vandal Charged] Jonathon Dube, ''ABC News''
* [http://abcnews.go.com/sections/tech/DailyNews/webattack000303.html 'Coolio' Admits to Hacking 3 Different Web Sites] Brian Ross and Jonathon Dube, ''ABC News''
* [http://www.abcnews.go.com/sections/tech/DailyNews/webattacks000225.html Two More Sites Attacked - Microsoft.com and National Discount Brokers Are Latest Victims]

Jonathon Dube, ''ABC News''
* [http://www.abcnews.go.com/sections/tech/DailyNews/webattacks000218.html Copycat Attacks? - Vandals Continue to Attack Smaller Web Sites; Investigation Goes Global, ]

Jonathon Dube and Erica D. Rowell, ''ABC News''
* [http://abcnews.go.com/sections/tech/DailyNews/yahoo000208.html Web Under Attack - Five Leading Web Sites Suffer Outages After Coordinated Attacks This Week] Jonathon

Dube, ''ABC News''
* [http://abcnews.go.com/sections/tech/dailynews/cyberchat0209.html A Tangled Web - A Chat with Former Hacker "Weld Pond"] ''ABC News''

=== How To Report a DoS Attack ===

* [http://www.usdoj.gov/criminal/cybercrime/reporting.htm How to Report Internet-Related Crime] ''U.S. Department of Justice''
* [http://www.sans.org/newlook/resources/policies/item7.pdf NAS Security Incident Handling Procedures] ''SANS Institute''

CSC 379 SUM2008:Week 5, Debate

2008-08-06T22:10:57Z

Jmsevits: /* Helpful Links */

== Direct-Recording Electronic Voting ==
'''''Should direct-recording electronic voting systems be banned?'''''

* If '''yes''', cite the errors and crises that have occurred with electronic voting, and establish that these problems are worse than with other technologies. Argue that no backup system, paper or otherwise, can be developed to make them as reliable as other voting systems. Also, say when the ban should go into effect, and suggest what kind of systems should replace them.
* If '''no''', argue that electronic systems, by themselves or with paper receipts or some other backup technology, can be as reliable as other types of voting systems. Or, argue that the ban would result in greater possibility of fraud, e.g., through lax ballot security. Or, argue that such decisions are best left to local election boards, which may face budgetary or training constraints.

== Helpful Links ==

* http://en.wikipedia.org/wiki/DRE_voting_machine
* http://www.acmqueue.org/modules.php?name=Content&pa=showpage&pid=219
* http://www.leagueissues.org/tutorial.html
* http://igs.berkeley.edu/library/htElectronicVoting2004-LWVUSreport.htm
* http://www.commoncause.org/site/pp.asp?c=dkLNK1MQIwG&b=3871677
* http://votingmachines.procon.org/viewresource.asp?resourceID=274

* http://www.verifiedvotingfoundation.org/article.php?id=6521

CSC 379 SUM2008:Week 5, Debate

2008-08-06T22:07:31Z

Jmsevits: add of initial content

CSC 379 SUM2008:Week 5, Group 4

2008-08-06T20:53:08Z

Jmsevits: /* Decision Support Systems */

== Decision Support Systems ==

As we become more willing to incorporate more complex software into our daily lives, we are able to solve problems with fewer people and less complex organizational structures. To allow one person to take the place of a decision group, decision-support systems have been developed. These systems distill expert knowledge and present it to the individual. Many decision-support systems are in use in medicine, to guide diagnoses, recommend treatments to practitioners, and assist with risk-assessment of procedures. Software also helps forestall medical emergencies through patient monitoring. In the military, decision support systems are everywhere, from the fast-paced environment of a fighter-jet cockpit to command-and-control centers. Other decision-support systems are used in business and government.

It is easy to see how decision-support systems could cause harm, as well as prevent it. Examine the ethical considerations raised in the design and use of decision-support systems (in general). What, if any ethical responsibilities apply to the software engineer in development of a decision-support system where errors in its design or use could result in serious harm? If a decision-support system is shown to reduce harm, improve quality of life, or otherwise provide a net-benefit to its users (fewer medical errors, battleground casualties, reduced costs of providing an essential public service, etc.), is it unethical to resist its adoption? Please explain your answers.

* http://en.wikipedia.org/wiki/Decision_support_system
* http://www.openclinical.org/clinical.html
* http://www.cioinsight.com/c/a/Past-Opinions/DecisionSupport-Systems-Lessons-from-the-Military/

CSC 379 SUM2008:Week 5, Group 4

2008-08-06T20:52:56Z

Jmsevits: add of initial content

== Decision Support Systems ==

As we become more willing to incorporate more complex software into our daily lives, we are able to solve problems with fewer people and less complex organizational structures. To allow one person to take the place of a decision group, decision-support systems have been developed. These systems distill expert knowledge and present it to the individual. Many decision-support systems are in use in medicine, to guide diagnoses, recommend treatments to practitioners, and assist with risk-assessment of procedures. Software also helps forestall medical emergencies through patient monitoring. In the military, decision support systems are everywhere, from the fast-paced environment of a fighter-jet cockpit to command-and-control centers. Other decision-support systems are used in business and government.

It is easy to see how decision-support systems could cause harm, as well as prevent it. Examine the ethical considerations raised in the design and use of decision-support systems (in general). What, if any ethical responsibilities apply to the software engineer in development of a decision-support system where errors in its design or use could result in serious harm? If a decision-support system is shown to reduce harm, improve quality of life, or otherwise provide a net-benefit to its users (fewer medical errors, battleground casualties, reduced costs of providing an essential public service, etc.), is it unethical to resist its adoption? Please explain your answers.

- http://en.wikipedia.org/wiki/Decision_support_system
- http://www.openclinical.org/clinical.html
- http://www.cioinsight.com/c/a/Past-Opinions/DecisionSupport-Systems-Lessons-from-the-Military/

CSC 379 SUM2008:Week 5, Group 3

2008-08-06T20:51:19Z

Jmsevits: add of initial content

== Cyberstalking ==

Provide a general overview of cyberstalking as it occurs today. Discuss recent instances and analyze the ethics. What ethical considerations are raised by tools that facilitate cyber-stalking? Should threats of violence through cyberstalking be considered the same as in-person threats or threats communicated through traditional means?

* http://en.wikipedia.org/wiki/Cyberstalking
* http://ethics.csc.ncsu.edu/privacy/cyberstalking/
* http://brief-treatment.oxfordjournals.org/cgi/content/abstract/5/3/279

CSC 379 SUM2008:Week 5, Group 2

2008-08-06T20:48:14Z

Jmsevits: add of initial content

== Open Non-Proprietary Technology vs. Closed Proprietary Technology ==

The issues surrounding electronic voting have highlighted the concerns of use of open non-proprietary technology vs. closed proprietary technology. On the one side, closed proprietary technology allegedly safeguards voting security by making it impossible for outsiders to discover vulnerabilities by analyzing the code. On the other side, open technology encourages more eyes to look over the code, and may find vulnerabilities in advance, in time to correct them. What bearing does this discussion have on other types of software systems? Should other systems with high social value also have open non-proprietary licenses to increase accountability, or do the risks of open licensing outweigh the benefits?

Examine how the experience with electronic voting applies to other critical software systems (e.g., software used for port security, handling medical records, or managing a payroll). What are the costs and benefits of open non-proprietary technology vs. closed proprietary technology for such applications? Are there applications where one or the other should clearly be used? Are there applications for which neither is appropriate? Please explain your answers.

* http://courses.ncsu.edu/csc379/lec/001/lectures/wk14/lecture.html

CSC 379 SUM2008:Week 5, Group 1

2008-08-06T20:46:50Z

Jmsevits:

== Avoiding the Need for Whistleblowing ==

Examine the ways an organization can help employees resolve concerns internally, and thereby avoid the need for external whistleblowing. How do these practices, such as anonymous reporting hotlines, apply to the work environment of a software engineer?

Due to ineffective or nonexistent feedback processes within an organization, many important concerns never reach anyone who is willing or able to take action. Employees may forgo making complaints due to processes that are hard to use, or because the company culture has no way to report anything, except to one’s immediate superior.

What can be done to reduce the need for external whistleblowing? Are there proven cultural fixes? Technological fixes? If someone has a less serious concern, which (s)he considers too insignificant to take the risk of external whistleblowing, how could this be actively addressed before problems arise? Is there an ethical obligation on the part of organizations to adopt practices that encourage effective internal whistleblowing? Please explain your answers.

* http://www3.interscience.wiley.com/journal/119949153/abstract
* http://www.springerlink.com/content/t61246w14l64k416/
* http://portal.acm.org/citation.cfm?doid=367211.367274
* http://courses.ncsu.edu/csc379/lec/001/lectures/wk15/lecture.html
* http://ethics.csc.ncsu.edu/basics/whistle/

CSC 379 SUM2008:Week 5, Group 1

2008-08-06T20:45:46Z

Jmsevits: add of initial content

Examine the ways an organization can help employees resolve concerns internally, and thereby avoid the need for external whistleblowing. How do these practices, such as anonymous reporting hotlines, apply to the work environment of a software engineer?

Due to ineffective or nonexistent feedback processes within an organization, many important concerns never reach anyone who is willing or able to take action. Employees may forgo making complaints due to processes that are hard to use, or because the company culture has no way to report anything, except to one’s immediate superior.

What can be done to reduce the need for external whistleblowing? Are there proven cultural fixes? Technological fixes? If someone has a less serious concern, which (s)he considers too insignificant to take the risk of external whistleblowing, how could this be actively addressed before problems arise? Is there an ethical obligation on the part of organizations to adopt practices that encourage effective internal whistleblowing? Please explain your answers.

* http://www3.interscience.wiley.com/journal/119949153/abstract
* http://www.springerlink.com/content/t61246w14l64k416/
* http://portal.acm.org/citation.cfm?doid=367211.367274
* http://courses.ncsu.edu/csc379/lec/001/lectures/wk15/lecture.html
* http://ethics.csc.ncsu.edu/basics/whistle/

CSC 379

2008-08-06T20:44:40Z

Jmsevits: /* Week 4 pages */

= Class Resources =
===Formatting Resources===
[http://meta.wikimedia.org/wiki/Help:Wikitext_examples Formatting Help Guide from MetaWiki]
===ACM Technews Search===
[http://www.google.com/search?hl=en&q=site%3Atechnews.acm.org Google Site Specific Search]
===IEEE Xplore===
[http://ieeexplore.ieee.org/search/advsearch.jsp http://ieeexplore.ieee.org/search/advsearch.jsp]
===Google Scholar===
[http://www.google.com/scholar http://www.google.com/scholar]
===Professional Codes of Ethics===
[http://www.onlineethics.org/CMS/profpractice/ethcodes/13411.aspx National Academy of Engineering]
===Debate Arguments Pyramid===
An outline of argument types.

[http://blog.createdebate.com/2008/04/07/writing-strong-arguments/ http://blog.createdebate.com/2008/04/07/writing-strong-arguments/]
===HTML to MediaWiki Converter===
You may find this tool helpful in converting the content on existing pages of the [http://ethics.csc.ncsu.edu ethics.csc.ncsu.edu website] to MediaWiki markup for your research assignment.

[http://labs.seapine.com/htmltowiki.cgi http://labs.seapine.com/htmltowiki.cgi]

===Work Examples===
Wiki Assignment: [http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379:Week_4%2C_Group_4] [http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379:Week_2%2C_Group_1]

Research Assignment: [[CSC 379:Research Assignment Sample]]

===Etc.===
[[temp001]]

= Research Assignment Topics =
[[CSC_379_SUM2008:Topics | '''Research Topics''']]

= Week 1 pages =
* [[CSC 379 SUM2008:Week 1, Debate | '''Week 1 Debate Topic''']]

* Netiquette Best Practices: Online Communities ([[CSC 379 SUM2008:Week 1, Group 1]])
* Political Uses of Spam for Special Interests and Influencing Elections ([[CSC 379 SUM2008:Week 1, Group 2]])
* Spam ([[CSC 379 SUM2008:Week 1, Group 3]])
* The Effects of Spam-Countermeasures ([[CSC 379 SUM2008:Week 1, Group 4]])

= Week 2 pages =
* [[CSC 379 SUM2008:Week 2, Debate | '''Week 2 Debate Topic''']]

* Turn-it-in and MOSS ([[CSC 379 SUM2008:Week 2, Group 1]])
* Alternative Intellectual Property Models ([[CSC 379 SUM2008:Week 2, Group 2]])
* Search Engines ([[CSC 379 SUM2008:Week 2, Group 3]])
* File Sharing Countermeasures ([[CSC 379 SUM2008:Week 2, Group 4]])

= Week 3 pages =
* [[CSC 379 SUM2008:Week 3, Debate | '''Week 3 Debate Topic''']]

* Markets for Bug Reports ([[CSC 379 SUM2008:Week 3, Group 1]])
* Costs and Benefits of Malware Countermeasures ([[CSC 379 SUM2008:Week 3, Group 2]])
* Costs and Benefits Password Regulations ([[CSC 379 SUM2008:Week 3, Group 3]])
* Bundling Malware ([[CSC 379 SUM2008:Week 3, Group 4]])

= Week 4 pages =
* [[CSC 379 SUM2008:Week 4, Debate | '''Week 4 Debate Topic''']]

* Privacy Policies ([[CSC 379 SUM2008:Week 4, Group 1]])
* Open Government ([[CSC 379 SUM2008:Week 4, Group 2]])
* WAN Internet Filtering ([[CSC 379 SUM2008:Week 4, Group 3]])
* Hidden Tracking Codes ([[CSC 379 SUM2008:Week 4, Group 4]])

= Week 5 pages =
* [[CSC 379 SUM2008:Week 5, Debate | '''Week 5 Debate Topic''']]

* Avoiding the Need for Whistleblowing ([[CSC 379 SUM2008:Week 5, Group 1]])
* Open Non-Proprietary Technology vs. Closed Proprietary Technology ([[CSC 379 SUM2008:Week 5, Group 2]])
* Cyberstalking ([[CSC 379 SUM2008:Week 5, Group 3]])
* Decision Support Systems ([[CSC 379 SUM2008:Week 5, Group 4]])

CSC 379

2008-08-06T20:44:29Z

Jmsevits: /* Week 5 pages */ add of topic links

= Class Resources =
===Formatting Resources===
[http://meta.wikimedia.org/wiki/Help:Wikitext_examples Formatting Help Guide from MetaWiki]
===ACM Technews Search===
[http://www.google.com/search?hl=en&q=site%3Atechnews.acm.org Google Site Specific Search]
===IEEE Xplore===
[http://ieeexplore.ieee.org/search/advsearch.jsp http://ieeexplore.ieee.org/search/advsearch.jsp]
===Google Scholar===
[http://www.google.com/scholar http://www.google.com/scholar]
===Professional Codes of Ethics===
[http://www.onlineethics.org/CMS/profpractice/ethcodes/13411.aspx National Academy of Engineering]
===Debate Arguments Pyramid===
An outline of argument types.

[http://blog.createdebate.com/2008/04/07/writing-strong-arguments/ http://blog.createdebate.com/2008/04/07/writing-strong-arguments/]
===HTML to MediaWiki Converter===
You may find this tool helpful in converting the content on existing pages of the [http://ethics.csc.ncsu.edu ethics.csc.ncsu.edu website] to MediaWiki markup for your research assignment.

[http://labs.seapine.com/htmltowiki.cgi http://labs.seapine.com/htmltowiki.cgi]

===Work Examples===
Wiki Assignment: [http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379:Week_4%2C_Group_4] [http://pg-server.csc.ncsu.edu/mediawiki/index.php/CSC_379:Week_2%2C_Group_1]

Research Assignment: [[CSC 379:Research Assignment Sample]]

===Etc.===
[[temp001]]

= Research Assignment Topics =
[[CSC_379_SUM2008:Topics | '''Research Topics''']]

= Week 1 pages =
* [[CSC 379 SUM2008:Week 1, Debate | '''Week 1 Debate Topic''']]

* Netiquette Best Practices: Online Communities ([[CSC 379 SUM2008:Week 1, Group 1]])
* Political Uses of Spam for Special Interests and Influencing Elections ([[CSC 379 SUM2008:Week 1, Group 2]])
* Spam ([[CSC 379 SUM2008:Week 1, Group 3]])
* The Effects of Spam-Countermeasures ([[CSC 379 SUM2008:Week 1, Group 4]])

= Week 2 pages =
* [[CSC 379 SUM2008:Week 2, Debate | '''Week 2 Debate Topic''']]

* Turn-it-in and MOSS ([[CSC 379 SUM2008:Week 2, Group 1]])
* Alternative Intellectual Property Models ([[CSC 379 SUM2008:Week 2, Group 2]])
* Search Engines ([[CSC 379 SUM2008:Week 2, Group 3]])
* File Sharing Countermeasures ([[CSC 379 SUM2008:Week 2, Group 4]])

= Week 3 pages =
* [[CSC 379 SUM2008:Week 3, Debate | '''Week 3 Debate Topic''']]

* Markets for Bug Reports ([[CSC 379 SUM2008:Week 3, Group 1]])
* Costs and Benefits of Malware Countermeasures ([[CSC 379 SUM2008:Week 3, Group 2]])
* Costs and Benefits Password Regulations ([[CSC 379 SUM2008:Week 3, Group 3]])
* Bundling Malware ([[CSC 379 SUM2008:Week 3, Group 4]])

= Week 4 pages =
* [[CSC 379 SUM2008:Week 4, Debate | '''Week 4 Debate Topic''']]

* Privacy Policies ([[CSC 379 SUM2008:Week 4, Group 1]])
* Open Government ([[CSC 379 SUM2008:Week 4, Group 2]])
* WAN Internet Filtering ([[CSC 379 SUM2008:Week 4, Group 3]])
* Hidden Tracking Codes ([[CSC 379 SUM2008:Week 4, Group 4]])

= Week 4 pages =
* [[CSC 379 SUM2008:Week 5, Debate | '''Week 5 Debate Topic''']]

* Avoiding the Need for Whistleblowing ([[CSC 379 SUM2008:Week 5, Group 1]])
* Open Non-Proprietary Technology vs. Closed Proprietary Technology ([[CSC 379 SUM2008:Week 5, Group 2]])
* Cyberstalking ([[CSC 379 SUM2008:Week 5, Group 3]])
* Decision Support Systems ([[CSC 379 SUM2008:Week 5, Group 4]])

CSC 379 SUM2008:Week 4, Group 2

2008-07-30T21:54:16Z

Jmsevits:

Most bills are passed by legislatures without ever being read by most legislators. Letters, articles, reports, all often never escape the physical mediums (paper) of their existence. Although technology has developed to the point where all non-private information in the United States government can, in theory, be made openly available, the support structures and culture of information sharing has not caught up to make full use of them. Efforts are being made to use digitization and sharing technology; one of the most notable digitization efforts is THOMAS, a joint effort by the Library of Congress and the Government Printing Office (GPO).

Examine the ethical implications of making policy with inadequate access to information, and the efforts being made to address those concerns. Is there a need for a change in existing support structures and culture of information sharing in government? Should support structures and culture change to encourage greater information sharing, if it required the government to slow down decision-making processes?

* http://thomas.loc.gov/home/abt_thom.html
* http://www.lessig.org/blog/
* http://www.archives.gov/nhprc/announcement/digitizing-faqs.html
* http://www.sunlightfoundation.com/

2008-07-26T13:02:52Z

Jmsevits:

'''''Note: Include the title and path of your page on the [http://ethics.csc.ncsu.edu ethics.csc.ncsu.edu website] at the bottom of your wiki page. Once your wiki page has gone through peer-review and posted to the website, your page's name will be that title. Ex: "Database Privacy" "privacy/database"'''''

= Study Guide =

The two main issues with database privacy are the actual security of the database itself and the legal and ethical implications of what can/should be stored on the databases in the first place. Also there should be a consideration of the intrinsic ethical duty placed on database security professionals to secure a database system.

=== How Database Information is Leaked ===

* SQL Injection - One of the best known database exploits around, SQL injection involves sending unexpected data to a webserver which interacts with a database. The data may be sent through a few methods, but is always specially formed, containing SQL statements which can compromise any unprotected data source. Data is generally passed through either the address or through form variables.
** Browser Method: When data is passed through the address to a page which interacts with a database, the data is passed in the form of variables appended to the end of the address. For example "www.cnn.com?id=1234" would pass 1234 as data to cnn.com If this data is directly used in a database command, one could alter 1234 in a specific way as to introduce a SQL command to be executed by the database. This ability could give the attacker a powerful tool to compromise data and accounts of an unprotected database. The users ability to change the address variables at will makes this an extremely easy database leak anyone can exploit
** Form Method: Forms take data on one page and pass that data directly to another page for processing, usually with a backend database involved. The ease of the user’s ability to modify address variables is prevented since the form data, if passed properly, is hidden from the user. Since the transfer is hidden, sites will believe they have satisfactorily sanitized user input by enforcing rules (digits only for certain fields, length limits) with client side JavaScript. This is supposed to prevent users from entering SQL statements disguised as bad input, but a savvy user could download the source of the file and modify the data subverting any JavaScript. Entering erroneous SQL statements such as '; drop table users --could compromise an entire database and its users.

* Preventing SQL Injection
** Syntax Checking: The trick of any SQL injection attack is the user’s ability to insert malicious statements into invalidated user input. To protect against this problem users must sanitize input collected from the user on the server side. The types of sanitation that must be performed is the removal of any semicolons or back tick marks since these are the stronghold of the syntax required for a proper SQL injection.
** While checking syntax is good, the best prevention of SQL injection is the use of something called a prepared statement. When using prepared statements, also known as stored procedures, every interaction with a database is prewritten allowing only enough rights as are required for any given command. Thus when an unexpected, powerful command is run there are not enough rights allocated for the malicious command under the ruse of a stored procedure to be properly executed even if it is properly inserted.

=== Database Security ===

When a carder by the handle "Maxus" broke into CD Universe's database records and gained access to over 250,000 credit card numbers from customers (link), the first thing everyone wanted to know was HOW. A single lapse in database security can doom an e-company to almost immediate failure and yet it seems we hear about events such as this happening all the time.

Database Security is integral in keeping our information private, regardless of who is maintaining the database itself. By far the most common break in security is the presence of plain-text log and/or data files on public web servers. The solution to this problem is relatively simple, either don't keep logs or use encryption. While encryption is beyond the scope of this topic, it can be used to effectively hinder the efforts of wouldbe cyber criminals. Another critical area that must be monitored are the administrators and users of the database. As in this case where a DEA Agent was found to have been selling information to various parties, all the encryption and frontend security means nothing if any user can have unchecked access to sensitive information. Keeping a checks and balances system on the users and administrators much the way a bank keeps tabs on its tellers is a necessary and effective means to keeping information safe and private.

=== Identity Privacy ===
The other and much more publicized area of database privacy is in the content that is availible for public use. This is divided up into two areas, data driven for marketing, and data driven for public records.

* '''Targeted Marketing''' - The first people to take unfair advantage of technology in business are arguably the marketing departments. Through the use of cookies, a company can find and archive to their databases loads of personal information about the visitors to their companies and or client's websites. This is where the waters get muddy, because often the users have no idea that their identities, habits and buying records are being recorded and stored. The real problems with this come when these companies, in an attempt to add extra sources of revenue, start to sell this information to other companies. This is what happened in the cases of Verisign (formerly Network Solutions) and even moreso with the DoubleClick corporation. The nail in the coffin that makes this entire practice so upsetting and angering to the average Joe, is the extreme difficulty in being "opted out" of inclusion into these databases. Also getting removed from any lists a user has been added to can be a wild goose chase of neverending unsubscribe emails.
* '''Identity Theft''' - Just by spending a few minutes and possibly a few dollars on sites like peoplefind one can get to nearly anyone in the US and abroad. The ease with which a malicious person can assume someone's identity both online and in real life can be startling. Most people don't even realize that their names, home telephone numbers and home addresses are already probably populated on several public records search databases across the web. Often times the reason it is so easy to find information is not the fault of the subject of the search. Companies often use very powerful information as the key to customer records, such as a person's social security number or the use of a drivers license number. All of this information once obtained can be used quickly and often unchecked to assume the identity of a person. A hacker by the name Kevin Mitnick has written several articles on the ease with which one can obtain all the details of a person's life from public online databases (one, two).

=== Ethical Implications of Database Privacy Compromise ===

* Who is to blame? Consider a situation where a database protected private data, but there was no attempt to ensure its security except the statement that no one is to misuse it. A person who compromises the database in a misuse fashion has committed an ethical infraction (we are ignoring his/her motives), but isn't the developer who required security but doesn't secure also culpable? What if the developer implemented security, but did it in such a poor fashion that no security was added; is he still culpable?
* Deontologists and Utilitarians would both agree that the developer is wrong for not completely securing a private database when the techniques used to compromise it are well-known. Utilitarians would argue that since databases must be secured to prevent someone from compromising it and thus committing an ethical wrong, developers have an ethical responsibility to ensure the security of systems they develop where security is a requirement.

= Bibliography =

=== Database Privacy Issues ===
* [http://www.stack.nl/~galactus/remailers/ Anonymity and privacy on the Internet] ''Arnoud "Galactus" Engelfriet''
* [http://www.inetcon.com/priv.html Ethical implications of email privacy] ''Victoria A. White''
* [http://www.hackcanada.com/canadian/freedom/canadna.html Canada's DNA Database: Privacy's last stronghold destroyed] ''HackCanada.com''

=== Database Security ===
* [http://en.wikipedia.org/wiki/SQL What is SQL?] ''wikipedia.org''
* [http://www.baycongroup.com/sql_command_reference.htm SQL Commands] ''baycongroup.com''
* [http://www.securiteam.com/securityreviews/5DP0N1P76E.html SQL Injection Walkthrough] ''SecuriTeam.com''
* [http://www.unixwiz.net/techtips/sql-injection.html SQL Injection by Example] ''Steve Friedl, Unixwiz.net''
* [http://www.owasp.org/software/labs/phpfilters.html PHP Input Sanitation Filters] ''owasp.org''

=== Securing a Databases Privacy ===
* [http://www.4guysfromrolla.com/webtech/061902-1.shtml Protecting Yourself From SQL Injection] ''Ross Overstreet''
* [http://www.windowsitpro.com/Article/ArticleID/42216/42216.html?Ad=1 Protecting Against SQL Injection] ''Umachandar Jayachandran''
* [http://java.sun.com/docs/books/tutorial/jdbc/basics/prepared.html Using Prepared Statements in Java] ''java.sun.com''

=== Commerce and Private Information ===
* ''Marketing vs Privacy''
** [http://www.bgassociates.com/essay2.htm Database Privacy] ''Brent Green & Associates, Inc.''
** [http://www.cio.com/archive/cio_021596_qa.html Privacy versus profit] ''Carol Hildebrand, cio.com''
** [http://www.tbtf.com/resource/priv-marketing.html Privacy marketing] ''Nick Szabo, Tasty Bits from the Technology Front''
* [http://www.privacytimes.com/NewWebstories/carder_priv_1_27.htm Specialists: 'Carders' Target Credit Numbers] ''PrivacyTimes.com''
* ''Lotus Marketplace''
** [http://www.cpsr.org/dox/conferences/cfp91/culnan.html The Lessons of the Lotus Marketplace] ''Mary J. Culnan''
* ''P-TRAK''
** [http://www.news.com/News/Item/0,4,1527,00.html Research service raises privacy fears] ''Rose Aguilar, news.com''
** [http://www.news.com/News/Item/0,4,1539,00.html Service pulls Social Security numbers] ''Rose Aguilar, news.com''

=== The Government and Privacy ===
* The [http://www.ssa.gov Social Security Administration] Web-site controversy
** [http://www.news.com/News/Item/0,4,9555,00.html Social Security site closed] ''Janet Kornblum, news.com''''''
** [http://www.cnn.com/TECH/computing/9903/29/secssn.idg/ SEC database exposes Social Security numbers] ''CNN.com''
* [http://www.eff.org/pub/Privacy/cfp2_convention.summary Computers, Freedom and Privacy - 2: A Report] ''Steve Cisler''
* [http://www.securityfocus.com/news/142 DEA agent charged with selling data] Kevin Poulsen, ''Security Focus''

=== Identity Theft ===
* [http://www.cs.rutgers.edu/~watrous/people-hunting.html People hunting (on and off the Web)] Donald Watrous, Rutgers University
* [http://www.cnn.com/TECH/computing/9910/11/id.theft.idg/ Fighting the Plague of Identity Theft] ''CNN''
* [http://www.theregister.co.uk/content/6/17358.html Stomp the identity thieves] Kevin Mitnick, ''TheRegister.co.uk''

== Source Files ==
'''Title: Database Privacy'''

privacy/database

* [http://ethics.csc.ncsu.edu/privacy/database/study.php '''Original Study Guide''']
* [http://ethics.csc.ncsu.edu/privacy/database/ '''Original Bibliography''']

CSC 379:Research Assignment Sample

2008-07-26T12:52:02Z

Jmsevits: /* Bibliography */

= Study Guide =

The two main issues with database privacy are the actual security of the database itself and the legal and ethical implications of what can/should be stored on the databases in the first place. Also there should be a consideration of the intrinsic ethical duty placed on database security professionals to secure a database system.

=== How Database Information is Leaked ===

* SQL Injection - One of the best known database exploits around, SQL injection involves sending unexpected data to a webserver which interacts with a database. The data may be sent through a few methods, but is always specially formed, containing SQL statements which can compromise any unprotected data source. Data is generally passed through either the address or through form variables.
** Browser Method: When data is passed through the address to a page which interacts with a database, the data is passed in the form of variables appended to the end of the address. For example "www.cnn.com?id=1234" would pass 1234 as data to cnn.com If this data is directly used in a database command, one could alter 1234 in a specific way as to introduce a SQL command to be executed by the database. This ability could give the attacker a powerful tool to compromise data and accounts of an unprotected database. The users ability to change the address variables at will makes this an extremely easy database leak anyone can exploit
** Form Method: Forms take data on one page and pass that data directly to another page for processing, usually with a backend database involved. The ease of the user’s ability to modify address variables is prevented since the form data, if passed properly, is hidden from the user. Since the transfer is hidden, sites will believe they have satisfactorily sanitized user input by enforcing rules (digits only for certain fields, length limits) with client side JavaScript. This is supposed to prevent users from entering SQL statements disguised as bad input, but a savvy user could download the source of the file and modify the data subverting any JavaScript. Entering erroneous SQL statements such as '; drop table users --could compromise an entire database and its users.

* Preventing SQL Injection
** Syntax Checking: The trick of any SQL injection attack is the user’s ability to insert malicious statements into invalidated user input. To protect against this problem users must sanitize input collected from the user on the server side. The types of sanitation that must be performed is the removal of any semicolons or back tick marks since these are the stronghold of the syntax required for a proper SQL injection.
** While checking syntax is good, the best prevention of SQL injection is the use of something called a prepared statement. When using prepared statements, also known as stored procedures, every interaction with a database is prewritten allowing only enough rights as are required for any given command. Thus when an unexpected, powerful command is run there are not enough rights allocated for the malicious command under the ruse of a stored procedure to be properly executed even if it is properly inserted.

=== Database Security ===

When a carder by the handle "Maxus" broke into CD Universe's database records and gained access to over 250,000 credit card numbers from customers (link), the first thing everyone wanted to know was HOW. A single lapse in database security can doom an e-company to almost immediate failure and yet it seems we hear about events such as this happening all the time.

Database Security is integral in keeping our information private, regardless of who is maintaining the database itself. By far the most common break in security is the presence of plain-text log and/or data files on public web servers. The solution to this problem is relatively simple, either don't keep logs or use encryption. While encryption is beyond the scope of this topic, it can be used to effectively hinder the efforts of wouldbe cyber criminals. Another critical area that must be monitored are the administrators and users of the database. As in this case where a DEA Agent was found to have been selling information to various parties, all the encryption and frontend security means nothing if any user can have unchecked access to sensitive information. Keeping a checks and balances system on the users and administrators much the way a bank keeps tabs on its tellers is a necessary and effective means to keeping information safe and private.

=== Identity Privacy ===
The other and much more publicized area of database privacy is in the content that is availible for public use. This is divided up into two areas, data driven for marketing, and data driven for public records.

* '''Targeted Marketing''' - The first people to take unfair advantage of technology in business are arguably the marketing departments. Through the use of cookies, a company can find and archive to their databases loads of personal information about the visitors to their companies and or client's websites. This is where the waters get muddy, because often the users have no idea that their identities, habits and buying records are being recorded and stored. The real problems with this come when these companies, in an attempt to add extra sources of revenue, start to sell this information to other companies. This is what happened in the cases of Verisign (formerly Network Solutions) and even moreso with the DoubleClick corporation. The nail in the coffin that makes this entire practice so upsetting and angering to the average Joe, is the extreme difficulty in being "opted out" of inclusion into these databases. Also getting removed from any lists a user has been added to can be a wild goose chase of neverending unsubscribe emails.
* '''Identity Theft''' - Just by spending a few minutes and possibly a few dollars on sites like peoplefind one can get to nearly anyone in the US and abroad. The ease with which a malicious person can assume someone's identity both online and in real life can be startling. Most people don't even realize that their names, home telephone numbers and home addresses are already probably populated on several public records search databases across the web. Often times the reason it is so easy to find information is not the fault of the subject of the search. Companies often use very powerful information as the key to customer records, such as a person's social security number or the use of a drivers license number. All of this information once obtained can be used quickly and often unchecked to assume the identity of a person. A hacker by the name Kevin Mitnick has written several articles on the ease with which one can obtain all the details of a person's life from public online databases (one, two).

=== Ethical Implications of Database Privacy Compromise ===

* Who is to blame? Consider a situation where a database protected private data, but there was no attempt to ensure its security except the statement that no one is to misuse it. A person who compromises the database in a misuse fashion has committed an ethical infraction (we are ignoring his/her motives), but isn't the developer who required security but doesn't secure also culpable? What if the developer implemented security, but did it in such a poor fashion that no security was added; is he still culpable?
* Deontologists and Utilitarians would both agree that the developer is wrong for not completely securing a private database when the techniques used to compromise it are well-known. Utilitarians would argue that since databases must be secured to prevent someone from compromising it and thus committing an ethical wrong, developers have an ethical responsibility to ensure the security of systems they develop where security is a requirement.

= Bibliography =

=== Database Privacy Issues ===
* [http://www.stack.nl/~galactus/remailers/ Anonymity and privacy on the Internet] ''Arnoud "Galactus" Engelfriet''
* [http://www.inetcon.com/priv.html Ethical implications of email privacy] ''Victoria A. White''
* [http://www.hackcanada.com/canadian/freedom/canadna.html Canada's DNA Database: Privacy's last stronghold destroyed] ''HackCanada.com''

=== Database Security ===
* [http://en.wikipedia.org/wiki/SQL What is SQL?] ''wikipedia.org''
* [http://www.baycongroup.com/sql_command_reference.htm SQL Commands] ''baycongroup.com''
* [http://www.securiteam.com/securityreviews/5DP0N1P76E.html SQL Injection Walkthrough] ''SecuriTeam.com''
* [http://www.unixwiz.net/techtips/sql-injection.html SQL Injection by Example] ''Steve Friedl, Unixwiz.net''
* [http://www.owasp.org/software/labs/phpfilters.html PHP Input Sanitation Filters] ''owasp.org''

=== Securing a Databases Privacy ===
* [http://www.4guysfromrolla.com/webtech/061902-1.shtml Protecting Yourself From SQL Injection] ''Ross Overstreet''
* [http://www.windowsitpro.com/Article/ArticleID/42216/42216.html?Ad=1 Protecting Against SQL Injection] ''Umachandar Jayachandran''
* [http://java.sun.com/docs/books/tutorial/jdbc/basics/prepared.html Using Prepared Statements in Java] ''java.sun.com''

=== Commerce and Private Information ===
* ''Marketing vs Privacy''
** [http://www.bgassociates.com/essay2.htm Database Privacy] ''Brent Green & Associates, Inc.''
** [http://www.cio.com/archive/cio_021596_qa.html Privacy versus profit] ''Carol Hildebrand, cio.com''
** [http://www.tbtf.com/resource/priv-marketing.html Privacy marketing] ''Nick Szabo, Tasty Bits from the Technology Front''
* [http://www.privacytimes.com/NewWebstories/carder_priv_1_27.htm Specialists: 'Carders' Target Credit Numbers] ''PrivacyTimes.com''
* ''Lotus Marketplace''
** [http://www.cpsr.org/dox/conferences/cfp91/culnan.html The Lessons of the Lotus Marketplace] ''Mary J. Culnan''
* ''P-TRAK''
** [http://www.news.com/News/Item/0,4,1527,00.html Research service raises privacy fears] ''Rose Aguilar, news.com''
** [http://www.news.com/News/Item/0,4,1539,00.html Service pulls Social Security numbers] ''Rose Aguilar, news.com''

=== The Government and Privacy ===
* The [http://www.ssa.gov Social Security Administration] Web-site controversy
** [http://www.news.com/News/Item/0,4,9555,00.html Social Security site closed] ''Janet Kornblum, news.com''''''
** [http://www.cnn.com/TECH/computing/9903/29/secssn.idg/ SEC database exposes Social Security numbers] ''CNN.com''
* [http://www.eff.org/pub/Privacy/cfp2_convention.summary Computers, Freedom and Privacy - 2: A Report] ''Steve Cisler''
* [http://www.securityfocus.com/news/142 DEA agent charged with selling data] Kevin Poulsen, ''Security Focus''

=== Identity Theft ===
* [http://www.cs.rutgers.edu/~watrous/people-hunting.html People hunting (on and off the Web)] Donald Watrous, Rutgers University
* [http://www.cnn.com/TECH/computing/9910/11/id.theft.idg/ Fighting the Plague of Identity Theft] ''CNN''
* [http://www.theregister.co.uk/content/6/17358.html Stomp the identity thieves] Kevin Mitnick, ''TheRegister.co.uk''

== Source Files ==
* [http://ethics.csc.ncsu.edu/privacy/database/study.php '''Original Study Guide''']
* [http://ethics.csc.ncsu.edu/privacy/database/ '''Original Bibliography''']

CSC 379:Research Assignment Sample

2008-07-26T12:49:40Z

Jmsevits: /* Study Guide */

CSC 379:Research Assignment Sample

2008-07-26T12:40:15Z

Jmsevits:

= Study Guide =

= Bibliography =

=== Database Privacy Issues ===
* [http://www.stack.nl/~galactus/remailers/ Anonymity and privacy on the Internet] ''Arnoud "Galactus" Engelfriet''
* [http://www.inetcon.com/priv.html Ethical implications of email privacy] ''Victoria A. White''
* [http://www.hackcanada.com/canadian/freedom/canadna.html Canada's DNA Database: Privacy's last stronghold destroyed] ''HackCanada.com''

=== Database Security ===
* [http://en.wikipedia.org/wiki/SQL What is SQL?] ''wikipedia.org''
* [http://www.baycongroup.com/sql_command_reference.htm SQL Commands] ''baycongroup.com''
* [http://www.securiteam.com/securityreviews/5DP0N1P76E.html SQL Injection Walkthrough] ''SecuriTeam.com''
* [http://www.unixwiz.net/techtips/sql-injection.html SQL Injection by Example] ''Steve Friedl, Unixwiz.net''
* [http://www.owasp.org/software/labs/phpfilters.html PHP Input Sanitation Filters] ''owasp.org''

=== Securing a Databases Privacy ===
* [http://www.4guysfromrolla.com/webtech/061902-1.shtml Protecting Yourself From SQL Injection] ''Ross Overstreet''
* [http://www.windowsitpro.com/Article/ArticleID/42216/42216.html?Ad=1 Protecting Against SQL Injection] ''Umachandar Jayachandran''
* [http://java.sun.com/docs/books/tutorial/jdbc/basics/prepared.html Using Prepared Statements in Java] ''java.sun.com''

=== Commerce and Private Information ===
* ''Marketing vs Privacy''
** [http://www.bgassociates.com/essay2.htm Database Privacy] ''Brent Green & Associates, Inc.''
** [http://www.cio.com/archive/cio_021596_qa.html Privacy versus profit] ''Carol Hildebrand, cio.com''
** [http://www.tbtf.com/resource/priv-marketing.html Privacy marketing] ''Nick Szabo, Tasty Bits from the Technology Front''
* [http://www.privacytimes.com/NewWebstories/carder_priv_1_27.htm Specialists: 'Carders' Target Credit Numbers] ''PrivacyTimes.com''
* ''Lotus Marketplace''
** [http://www.cpsr.org/dox/conferences/cfp91/culnan.html The Lessons of the Lotus Marketplace] ''Mary J. Culnan''
* ''P-TRAK''
** [http://www.news.com/News/Item/0,4,1527,00.html Research service raises privacy fears] ''Rose Aguilar, news.com''
** [http://www.news.com/News/Item/0,4,1539,00.html Service pulls Social Security numbers] ''Rose Aguilar, news.com''

=== The Government and Privacy ===
* The [http://www.ssa.gov Social Security Administration] Web-site controversy
** [http://www.news.com/News/Item/0,4,9555,00.html Social Security site closed] ''Janet Kornblum, news.com''''''
** [http://www.cnn.com/TECH/computing/9903/29/secssn.idg/ SEC database exposes Social Security numbers] ''CNN.com''
* [http://www.eff.org/pub/Privacy/cfp2_convention.summary Computers, Freedom and Privacy - 2: A Report] ''Steve Cisler''
* [http://www.securityfocus.com/news/142 DEA agent charged with selling data] Kevin Poulsen, ''Security Focus''

=== Identity Theft ===
* [http://www.cs.rutgers.edu/~watrous/people-hunting.html People hunting (on and off the Web)] Donald Watrous, Rutgers University
* [http://www.cnn.com/TECH/computing/9910/11/id.theft.idg/ Fighting the Plague of Identity Theft] ''CNN''
* [http://www.theregister.co.uk/content/6/17358.html Stomp the identity thieves] Kevin Mitnick, ''TheRegister.co.uk''

CSC 379:Research Assignment Sample

2008-07-26T12:39:42Z

Jmsevits: /* Table of Contents */

= Table of Contents =

=== Database Privacy Issues ===
* [http://www.stack.nl/~galactus/remailers/ Anonymity and privacy on the Internet] ''Arnoud "Galactus" Engelfriet''
* [http://www.inetcon.com/priv.html Ethical implications of email privacy] ''Victoria A. White''
* [http://www.hackcanada.com/canadian/freedom/canadna.html Canada's DNA Database: Privacy's last stronghold destroyed] ''HackCanada.com''

=== Database Security ===
* [http://en.wikipedia.org/wiki/SQL What is SQL?] ''wikipedia.org''
* [http://www.baycongroup.com/sql_command_reference.htm SQL Commands] ''baycongroup.com''
* [http://www.securiteam.com/securityreviews/5DP0N1P76E.html SQL Injection Walkthrough] ''SecuriTeam.com''
* [http://www.unixwiz.net/techtips/sql-injection.html SQL Injection by Example] ''Steve Friedl, Unixwiz.net''
* [http://www.owasp.org/software/labs/phpfilters.html PHP Input Sanitation Filters] ''owasp.org''

=== Securing a Databases Privacy ===
* [http://www.4guysfromrolla.com/webtech/061902-1.shtml Protecting Yourself From SQL Injection] ''Ross Overstreet''
* [http://www.windowsitpro.com/Article/ArticleID/42216/42216.html?Ad=1 Protecting Against SQL Injection] ''Umachandar Jayachandran''
* [http://java.sun.com/docs/books/tutorial/jdbc/basics/prepared.html Using Prepared Statements in Java] ''java.sun.com''

=== Commerce and Private Information ===
* ''Marketing vs Privacy''
** [http://www.bgassociates.com/essay2.htm Database Privacy] ''Brent Green & Associates, Inc.''
** [http://www.cio.com/archive/cio_021596_qa.html Privacy versus profit] ''Carol Hildebrand, cio.com''
** [http://www.tbtf.com/resource/priv-marketing.html Privacy marketing] ''Nick Szabo, Tasty Bits from the Technology Front''
* [http://www.privacytimes.com/NewWebstories/carder_priv_1_27.htm Specialists: 'Carders' Target Credit Numbers] ''PrivacyTimes.com''
* ''Lotus Marketplace''
** [http://www.cpsr.org/dox/conferences/cfp91/culnan.html The Lessons of the Lotus Marketplace] ''Mary J. Culnan''
* ''P-TRAK''
** [http://www.news.com/News/Item/0,4,1527,00.html Research service raises privacy fears] ''Rose Aguilar, news.com''
** [http://www.news.com/News/Item/0,4,1539,00.html Service pulls Social Security numbers] ''Rose Aguilar, news.com''

=== The Government and Privacy ===
* The [http://www.ssa.gov Social Security Administration] Web-site controversy
** [http://www.news.com/News/Item/0,4,9555,00.html Social Security site closed] ''Janet Kornblum, news.com''''''
** [http://www.cnn.com/TECH/computing/9903/29/secssn.idg/ SEC database exposes Social Security numbers] ''CNN.com''
* [http://www.eff.org/pub/Privacy/cfp2_convention.summary Computers, Freedom and Privacy - 2: A Report] ''Steve Cisler''
* [http://www.securityfocus.com/news/142 DEA agent charged with selling data] Kevin Poulsen, ''Security Focus''

=== Identity Theft ===
* [http://www.cs.rutgers.edu/~watrous/people-hunting.html People hunting (on and off the Web)] Donald Watrous, Rutgers University
* [http://www.cnn.com/TECH/computing/9910/11/id.theft.idg/ Fighting the Plague of Identity Theft] ''CNN''
* [http://www.theregister.co.uk/content/6/17358.html Stomp the identity thieves] Kevin Mitnick, ''TheRegister.co.uk''

CSC 379:Research Assignment Sample

2008-07-26T12:39:16Z

Jmsevits: /* Study Guide */

= Table of Contents =

CSC 379:Research Assignment Sample

2008-07-26T12:39:03Z

Jmsevits: /* Study Guide */

= Study Guide =

=== Database Privacy Issues ===
* [http://www.stack.nl/~galactus/remailers/ Anonymity and privacy on the Internet] ''Arnoud "Galactus" Engelfriet''
* [http://www.inetcon.com/priv.html Ethical implications of email privacy] ''Victoria A. White''
* [http://www.hackcanada.com/canadian/freedom/canadna.html Canada's DNA Database: Privacy's last stronghold destroyed] ''HackCanada.com''

=== Database Security ===
* [http://en.wikipedia.org/wiki/SQL What is SQL?] ''wikipedia.org''
* [http://www.baycongroup.com/sql_command_reference.htm SQL Commands] ''baycongroup.com''
* [http://www.securiteam.com/securityreviews/5DP0N1P76E.html SQL Injection Walkthrough] ''SecuriTeam.com''
* [http://www.unixwiz.net/techtips/sql-injection.html SQL Injection by Example] ''Steve Friedl, Unixwiz.net''
* [http://www.owasp.org/software/labs/phpfilters.html PHP Input Sanitation Filters] ''owasp.org''

=== Securing a Databases Privacy ===
* [http://www.4guysfromrolla.com/webtech/061902-1.shtml Protecting Yourself From SQL Injection] ''Ross Overstreet''
* [http://www.windowsitpro.com/Article/ArticleID/42216/42216.html?Ad=1 Protecting Against SQL Injection] ''Umachandar Jayachandran''
* [http://java.sun.com/docs/books/tutorial/jdbc/basics/prepared.html Using Prepared Statements in Java] ''java.sun.com''

=== Commerce and Private Information ===
* ''Marketing vs Privacy''
** [http://www.bgassociates.com/essay2.htm Database Privacy] ''Brent Green & Associates, Inc.''
** [http://www.cio.com/archive/cio_021596_qa.html Privacy versus profit] ''Carol Hildebrand, cio.com''
** [http://www.tbtf.com/resource/priv-marketing.html Privacy marketing] ''Nick Szabo, Tasty Bits from the Technology Front''
* [http://www.privacytimes.com/NewWebstories/carder_priv_1_27.htm Specialists: 'Carders' Target Credit Numbers] ''PrivacyTimes.com''
* ''Lotus Marketplace''
** [http://www.cpsr.org/dox/conferences/cfp91/culnan.html The Lessons of the Lotus Marketplace] ''Mary J. Culnan''
* ''P-TRAK''
** [http://www.news.com/News/Item/0,4,1527,00.html Research service raises privacy fears] ''Rose Aguilar, news.com''
** [http://www.news.com/News/Item/0,4,1539,00.html Service pulls Social Security numbers] ''Rose Aguilar, news.com''

=== The Government and Privacy ===
* The [http://www.ssa.gov Social Security Administration] Web-site controversy
** [http://www.news.com/News/Item/0,4,9555,00.html Social Security site closed] ''Janet Kornblum, news.com''''''
** [http://www.cnn.com/TECH/computing/9903/29/secssn.idg/ SEC database exposes Social Security numbers] ''CNN.com''
* [http://www.eff.org/pub/Privacy/cfp2_convention.summary Computers, Freedom and Privacy - 2: A Report] ''Steve Cisler''
* [http://www.securityfocus.com/news/142 DEA agent charged with selling data] Kevin Poulsen, ''Security Focus''

=== Identity Theft ===
* [http://www.cs.rutgers.edu/~watrous/people-hunting.html People hunting (on and off the Web)] Donald Watrous, Rutgers University
* [http://www.cnn.com/TECH/computing/9910/11/id.theft.idg/ Fighting the Plague of Identity Theft] ''CNN''
* [http://www.theregister.co.uk/content/6/17358.html Stomp the identity thieves] Kevin Mitnick, ''TheRegister.co.uk''

= Table of Contents =

2008-07-25T12:21:10Z

Jmsevits: /* Existing Topics */ add of instructions

= New Topics =

'''For these topics, you will be creating the study guide and bibliography sections, instead of providing an update an existing page. Examine the [http://ethics.csc.ncsu.edu/ ethics.csc.ncsu.edu website] for examples. Since your pages will be created and maintained in wiki-form, please design your pages with wiki markup (not HTML). Formatting resources are provided on the [[CSC 379]] wiki homepage.'''

==Smart Mobs==
'''social/smartmobs'''

As cell phones, text messaging, GPS, and other technologies make mobilization of groups easier, people are continually finding new uses. Both physical and virtual actions now frequently take place; protests, flooding email accounts and online polls, to impromptu gatherings. Explore smart/flash mobs, and the ethical considerations they raise. Include information on important instances of smart mobs and the future of smart mobs.

==Social Dossiers==
'''social/lifebits'''

Bits and pieces of information about ourselves can be found everywhere online, and most are unaware of just how much information about them is available. Anyone with sufficient time and/or software can assemble social dossiers from this information. Examine the array of personal information available online, efforts to assemble and utilize this information, and ethical considerations raised.

[http://ethics.csc.ncsu.edu/social/lifebits/new.html Helpful Links]

==Phishing==
'''abuse/spam/phishing'''

Phishing efforts are growing in variety and sophistication. They pose many privacy and security risks. Examine the practice of phishing, its forms, and the ethical considerations raised.

[http://ethics.csc.ncsu.edu/abuse/spam/phishing/new.html Helpful Links]

==Encryption==
'''privacy/encryption'''

Provide a general overview of the ethical considerations of encryption and its use. Within your coverage, explore specifically if governments should be allowed to impose restrictions on the types of encryption that can be used as well as where and how encryption methods may be used.

[http://ethics.csc.ncsu.edu/privacy/encryption/new.html Helpful Links]

==Voting Receipts==
'''risks/reliability/voting/receipts'''

With nearly all votes counted in the United States by computers, paper trails have been considered important to ensure a separate physical record of votes cast. With the emergence of electronic voting, the receipt of a vote is created by the computers, not manually by the user. Explore the ethical considerations that the issue of voting paper trails raise.

[http://ethics.csc.ncsu.edu/risks/reliability/voting/receipts/new.html Helpful Links]

= Existing Topics =

For these topics you will be performing an update on an existing topic. Pages for the study guide and bibliography sections are included on the [http://ethics.csc.ncsu.edu ethics.csc.ncsu.edu website], which you will be transitioning to their new wiki-form. Since your pages will be created and maintained in wiki-form, please design your pages with wiki markup (not HTML). Formatting resources are provided on the [[CSC 379]] wiki homepage.

==Cyberwarfare==
'''risks/security/cyberwar'''

Provide a general overview of the ethical considerations related to cyberwarfare. Examine new methods of cyberwarfare, include recent instances, and ethical considerations.

==Intellectual Property Law==
'''intellectual/law'''

Provide a general overview of the ethical considerations related to intellectual property law. Ensure that trade secrets is included in your coverage.

==Cyberlicenses / Shrinkwrap Licenses==
'''intellectual/licensing/cyberlicenses''' and '''intellectual/licensing/shrinkwrap'''

Provide a general overview of the ethical considerations related to shrinkwrap and cyberlicenses. Expand on licensing related to ownership of content created through web services, such as Facebook and MySpace.

==Computer Modeling==
'''risks/models'''

Provide a general overview of the ethical considerations related to computer modeling, both from a science/engineering, and social/economic perspective. On a science/engineering view, computer modeling is often used to illustrate complex information, but has a high potential for providing misleading and dishonest presentations of reality. Include coverage of the ethical considerations for instances of misleading, dishonest, and controversial uses of modeling. On a social/economic view, include ethical considerations related to developments in computer modeling in virtual communities, such as Second Life.

==Depersonalization==
'''social/technoharm''' (update, add studyguide)

General.

==Privacy of Medical Information==
'''privacy/medical'''

With emerging patient-centric services such as [https://www.google.com/health Google Health] and more medical providers deciding to digitize and manage the health records of their patents through networked systems, traditional practices undergoing change. Provide a general overview of the ethical considerations related to digital medical information.

==Electronic Voting==
'''risks/reliability/voting/electronic'''

Provide a general overview of the ethical considerations related to electronic voting.

==Instant Messaging==
'''commerce/anticompetitive/instant'''

Most of the references on this page are three or four years old. The issue is whether a small number of companies should unfairly dominate the market for instant messaging. Update the existing page with new references, and the study guide with new issues.

{| cellpadding="4"
|-
| [http://ethics.csc.ncsu.edu/commerce/anticompetitive/instant/ Current Main Page]
| [http://ethics.csc.ncsu.edu/commerce/anticompetitive/instant/study.php Current Study Guide]
|}

==Security Precautions==
'''risks/security/precautions'''

What security precautions do web and network administrators need to take to guard against hacker attacks, such as distributed denial-of-service attacks? What precautions are needed against other forms of hacking? Against cyberwarfare and terrorist threats? Update topic page and study guide to cover current/future precautions related to recent occurrences.

'''Social Engineering''' should be included as a major section within this topic. If you would like to make a new page focused on social engineering, you may if you choose this topic.

{| cellpadding="4"
|-
| [http://ethics.csc.ncsu.edu/risks/security/precautions Current Main Page]
| [http://ethics.csc.ncsu.edu/risks/security/precautions/study.php Current Study Guide]
|}

CSC 379 SUM2008:Topics

2008-07-25T12:16:50Z

Jmsevits: formatting update

CSC 379 SUM2008:Topics

2008-07-25T12:15:09Z

Jmsevits: /* Computer Modeling */

CSC 379 SUM2008:Topics

2008-07-25T12:14:17Z

Jmsevits: /* Computer Modeling */ update of topic description