MIST 2090 part A final

decentralization (4 conditions for using the crowd for estimation purposes)

the people making the guesses should be able to draw on their private, local knowledge

clear outcomes

the people who worked on Linux knew what the end result of their work would be (directly and indirectly)

aggregation (4 conditions for using the crowd for estimation purposes)

there must be some way of aggregating the guesses into a single collective guess (by taking the average)

conventional technical approaches to security include...

- MFA - monitoring & anomoly detection - software updates

ways to organize the crowd

- formal hierarchies - markets - self-organizing structures

characteristics of effective self-organizing structures (like Linux)

- openness - noncredentialism - verifiable & reversible conditions - clear outcomes - self-organization - geeky leadership

compare a database to a spreadsheet

Although they're very powerful and useful, spreadsheets are generally not the best tool to store large or complicated sets of data advantages of using a database model: - redundant data - data access - data security - big data

primary key

For each entity, we list attributes (properties) that we want to store values for, one of which is called the _____ an attribute that can have a unique value for every instance (record) that you store in a table (ex: SSN, student ID number)

ox weight example

In a contest where people bought tickets to guess the weight of an ox, the average guess of the crowd was one pound off from the real weight of the ox. This is an example of leveraging the knowledge of the crowd.

cryptocurrencies & BTC technology

It is essential that blockchain technology NOT follow the free/perfect/instant economics of information goods. Blockchain acts as a distributed / decentralized ledger system that logs transactions. It is considered secure because you can't make free copies of bitcoins or use the same one over and over. The distributed database enables the security and effectiveness of the system, which is entirely due to the crowd. There is tension between the fact that bitcoin is a digital good (which typically follows free/perfect/instant), while blockchain prevents you from using free copies of bitcoin. Blockchain is how bitcoin is linked to the crowd.

openness

Linus made his initial request for contributions as broad as possible - anyone could help

geeky leadership

Linus was engaged and informed about the work

role of good management of future companies / how to lead effectively"

Managers provide social skills of coordination, negotiation, persuasion, and social perceptiveness. This is more relative today because the world is complex and fast-changing, and coordination is more important today than ever before. In addition, humans are social creatures and want to work together. Most of us don't find algorithms persuasive; we need a good story or anecdote. How to lead effectively in this age includes egalitarianism (especially of ideas) and transparency of information.

shortfalls of the conventional technical approach

Skilled hackers prefer social engineering attacks over brute force attacks (it is easier to fool a human than a machine) Biometric authentication and MFA prevent attacks from outsiders but not from rogue insiders - insider threats include both negligence and malice - motives for malicious attacks include financial gain and revenge Conventional technical approaches to IT security risks overemphasize identifiable risks and underemphasize insider threats & social engineering attacks

The relationship between transaction cost economics and self-organizing (why might companies be considered passe?)

TCE - hierarchical model might be more costly than the market model b/c technology decreases transaction costs self-organizing models - hierarchical model might be more costly b/c there are ways to organize production & labor that require very little capital at all

problems arising from the non-hierarchical / messy crowd

The crowd is not organized / focused on solving problems, presenting 2 difficult problems: - it can be hard to find what you're looking for in an ocean of uncontrolled information (the core can curate information, but there's just too much in the crowd) - some of its members behave in hurtful ways (the core can evict bad actors, but that's hard to do on the web) Effective solutions will probably leverage machine learning AI technologies (ex: Reddit website)

relational database model

The organization scheme chosen for a database is called its logical data model; the most popular set of standard rules for database organization is known as the _____ components include entities, relationships, and attributes

when/why outsiders can be more effective than experts...

When things get really complex, don't look to the experts. Instead, call in the outsiders to help with complex, multidisciplinary tasks with objective evaluations as to the potential solutions . New knowledge is being created in other fields and it is slow to enter the core; many problems, opportunities, and projects benefit from different perspectives, people, and teams.

formal hierarchies (ways to organize the crowd)

a boss tells everyone how to focus their resources (ex: labor) in exchange for money

foreign key

a foreign key in one table is always the primary key in another table

what is the difference between a hot and cold backup site?

a hot site - fully operational & instantaneously usable replica of the firm's mission-critical IT assets (very costly) a cold site - the opposite extreme; inexpensive but very slow to start up and resume business operations

redundant data (advantages of using a database over a spreadsheet)

a relational model with primary & foreign keys allows you to avoid storing redundant data in a single table (such as on a spreadsheet)

data security (advantages of using a database over a spreadsheet)

an administrator can grant each user a different level of access ensuring that confidential info is not accessed by unauthorized parties

organizational security frameworks

an organization's suite of security controls, made up of many entities, protection mechanisms, processes, and procedures

database

an organized collection of data, at the heart of most all useful information systems (search engines, ATM/credit transactions, TPS, personal info management tools) Databases are an important component in making any technology work successfully.

define a management information system

an organized integration of hardware and software technologies, data, processes, and human elements designed to produce timely, integrated, relevant, accurate, and useful information for decision-making purposes

technical (logical) security controls

authentication, encryption, firewalls, biometrics, etc

what areas are there "best practices" for security control?

continuity planning & disaster recovery employees / HR data management

verifiable & reversible contributions

contributors can't irreversibly break or worsen the software - it is democratic in nature

self-organizing structures (ways to organize the crowd)

create an environment where anybody can pitch in that is open, doesn't require credentials, people can choose what they work on, etc

entities (components of the relational database model)

data is stored in one or more tables corresponding to entities (things & concepts for which you wish to store data in the database) - tables consist of records which correspond to rows in the tables - records store data on a single instance of an entity - a record consists of one or more fields (attributes)

big data (advantages of using a database over a spreadsheet)

databases can handle larger datasets more effectively

noncredentialism

diplomas, job titles, recommendation letters, experience, grades, etc, don't matter - if your work is good, there aren't requirements or barriers to helping

the core

dominant organizations, institutions, groups, and processes of the pre-Internet era

relationships (components of the relational database model)

entities are connected through relationships 3 choices for relationships between 2 entities include: 1:1 1:m m:m

attributes (components of the relational database model)

fields are often referred to as attributes and correspond to columns of the tables

markets (ways to organize the crowd)

focus the crowd's info resources, let people freely transact with each other without centralized control

what should the core rely on the crowd for?

get work done find the right resource conduct market research acquire new customers acquire innovation trading AVOID products for which safety and quality is paramount (and the consequences of potential missteps involve very high stakes)

The "stories" behind the hacking methods illustrated in the in-class video

https://www.youtube.com/watch?v=bjYhmX_OUQQ

when using the crowd for estimation purposes, what 4 conditions must be met?

independence diversity decentralization aggregation

monitoring & anomaly detection (conventional technical approaches to security)

intrusion detection and intrusion prevention ex: flagged account after numerous failed login attempts & blocked access to critical systems from international IP addresses

diversity (4 conditions for using the crowd for estimation purposes)

it is important to have a diverse set of guesses (ex: farmers, butchers, livestock experts, housewives, etc) and therefore have a wide distribution of backgrounds to avoid systematic error / bias

physical security controls

locks, monitoring, mantraps (can't open both doors @ same time), environmental controls

(data) integrity

maintaining and assuring the accuracy & reliability of the information and systems over its lifecycle - accidental or unintentional modifications to data cannot occur undetected - integrity threats include data entry error (undercharging) and incorrect modifications of data - safety measures include access/change controls and audit trails

data access (advantages of using a database over a spreadsheet)

multiple users can query a single database simultaneously

the crowd

new participants and practices enabled by the net and its attendant technologies

self-organization

people decided for themselves which aspects of Linux to work on

administrative security controls

policies, standards, procedures, guidelines, personnel screening, training

AIC triad`

represents the heart of information security (also referred to as the CIA Triad), 3 concepts commonly applied to all info systems and often forms the basis of security policies, rules of corporate governance, etc AVAILABILITY INTEGRITY CONFIDENTIALITY

employees / HR (best practices for security control)

rotation of duties mandatory vacations split knowledge (separation of duties concept) dual control (2 or more people perform the same action) strict procedure for employee termination

software updates (conventional technical approaches to security)

routine patching of newly-discovered vulnerabilities

security controls

the following controls should be utilized to achieve security management directives: - administrative - technical (logical) - physical

confidentiality

the property that info is not disclosed or otherwise made available to unauthorized individuals, entities, or processes - not the same as privacy; confidentiality is a component of privacy that is specific to unauthorized viewers of information - confidentiality threats include shoulder surfing and social engineering - safety measures include access controls and encryption of data (at rest, in transit)

database management system (DBMS)

the software application that lets you create and work with a database

continuity planning & disaster recovery (best practices for security control)

the tactical plan for quickly resuming your firm's business operations after a catastrophe (aka an attack against availability) typically relies on backup sites (hot vs cold)

independence (4 conditions for using the crowd for estimation purposes)

the various guesses must be independent of one another; each person must guess without the knowledge of what other people have guessed

data management (best practices for security control)

unlink sensitive data from other data to minimize the damage if it is stolen systems with sensitive data should be walled off from the other systems in the data environment anonymize sensitive data if you only need aggregates for analytics initiatives encrypt data both in transit and in storage so that it is unreadable if it does fall into the wrong hands

MFA (conventional technical approaches to security)

uses something you know (a password), something you have (an ATM card), and something you are (your fingerprint)

1:1 relationship

when an instance of 1 entity can have a relationship with 1 (and only 1) instance of the other entity

1:m relationship

when an instance of the first entity can have a relationship with 1 or more instances of the second entity, but instances of the second entity can be related to only 1 instance of the first

m:m relationship

when instances of each entity can be related to 1 or more instances of the other entity