CASE STUDY 4 A UCLA electrical engineering student was charged with stealing more than $1 million of equipment from the telephone company. He accomplished this by breaching the security of the company's on-line computer system. By posing as a journalist, he was given tours of the company's computer facilities and was given copies of all documents requested. He found other documents in the trash cans outside the supplies department. The documentation included inquiry passwords for the equipment budgets and the inventory control system. On one document he found a handwritten phone number for an equipment storage location. He called this number, posed as a storage attendant, and obtained the password for ordering telephone equipment. Armed with the telephone-ordering password, it was a simple matter to order equipment. He had the equipment delivered to a remote site. He then signed the bill of lading and returned it to the central office. His ability to make inquiries in the budget and inventory systems was put to good use. He restricted his order size to prevent each equipment storage location from exceeding its equipment budget. His knowledge of inventory levels and reorder points permitted him to order sufficient quantity to reduce inventory below the reorder point. Knowing that an order would be placed to replenish the inventory item, he was then able to contact the telephone company's purchasing agent and sell the equipment back to him. What on-line access and other security controls might have prevented this fraud