As we have moved into the 21st century, technology has become so pervasive in our daily lives that it is almost unavoidable. It was only less than 20 years ago, that one would look to their local newspaper to find work or pay bills via the postal system that has served us reliably for so many years. However nowadays finding work involves going on the internet and searching many online job search sites and debit cards along with online banking have largely replaced cash or check payments in our daily financial transactions. With this in mind let us look at why information security is important and some of the sources of information threats.
Why is information security important? The threat of hackers abounds in the world of IT. Proving that your company has a secure and stable network assures your clients/customers that their information is safeguarded. Can your company withstand the costs and negative publicity that could occur if there is a security breach? Just look at the hack of the Sony network that cost the company $2.74 billion overall and damaged the company’s brand image (Osawa, 2011). It is important to think of a security breach in terms of dollars lost in operations. Sales, customer service, staff productivity and workflow could all be affected by the downtime that will occur. Even after systems are restored, many times, additional checks need to be done to ensure that all facets of the network are clean before business can return to a normal operational state (Slade, 2014).
Secondly, Insurers are increasingly interested in how companies secure their information assets. It is often a consideration in renewal discussions. Since customers are beginning to do more of their business online, this is one factor that resonates with all companies, no matter how small or large the trend will only continue to grow. Insurance agencies are beginning to demand that businesses protect consumer privacy. It is becoming more and more common for insurers to ask for proof that sensitive information is secure and network security software is up-to-date (Slade, 2014). With network breaches becoming so common that it is not a matter of if you will get hacked but when, leads to higher premiums for toughs companies who have poor network security policies in place.
Moreover, having consistent security practices and IT maintenance procedures ensures a smooth road for business operations. New security threats are emerging every day, from malware programs that can be inadvertently installed on a user’s machine, to phishing attempts that deceive employees into giving up confidential information, to viruses, worms, and strategic identity theft attempts. IT professionals are the first to know about new threats. One of the benefits of having a consistent technology expert on your roster is that they can offer a fast reaction time and be proactive in safeguarding your IT system when new warnings first emerge (Slade, 2014). Overall information security is important because it protects you and your customers from unwanted data breaches and provides trust in the IT platform for critical transactions like banking that require the trust of the user to be effective.
Now that we have looked at why information security is important, let us look at some of the threats that exist starting with my personal favorite the ones caused by your users. Social engineering this is one of the oldest and most effective threats to IT security. This is the act of psychological manipulation of people into performing actions or divulging confidential information. A type of confidence trick for the purpose of information gathering, fraud, or system access, it differs from a traditional “con” in that it is often one of many steps in a more complex fraud scheme (Anderson, 2008). The 2011 HBGary Hack used social engineering to gain admin access to their email servers (Bright, 2011).
Continuing with along the lines that your users are evil, the next threat on my list is called the “insider threat”. An Insider Threat is a malicious threat to an organization that comes from people within an organization, such as employees, former employees, contractors or business associates, who have inside information concerning the organization’s security practices, data and computer systems. The threat may involve fraud, the theft of confidential or commercially valuable information, the theft of intellectual property, or the sabotage of computer systems (CERT, 2014). To see how much damage an inside can cause your organization all we have to do is look at everyone’s favorite antihero Edward Snowden who used his privileged access to pillage the NSAs servers for program data that caused incalculable harm to US intelligence programs (Basani, 2013).
Tornados, hurricanes, floods, and earthquakes are all natural disasters that can cause irrevocable harm to your organization. The effects of acts of god can only be mitigated by proper planning and polices. First off, do not build your data center where things like Tornados, hurricanes, floods, and earthquakes are common. Environment is assessed for risk and exposure to natural disasters. Areas that are prone to such risks (seismic vulnerability, extreme weather events, flood plain jeopardy) are typically assigned a higher risk factor and, thus, are generally excluded from consideration (RONALD BOWMAN, 2012). Secondly to protect your data in case you decide to build your datacenter on less than ideal land you need to practice off site backups.
Technology its self is also a threat. Malicious and non-malicious threats exist and can cause serious damage to your IT infrastructure. Malware short for malicious software is a type of malicious threat. Malware refers to software programs designed to damage or do other unwanted actions on a computer system. Common examples of malware include viruses, worms, Trojan horses, and spyware. Viruses, for example, can cause havoc on a computer’s hard drive by deleting files or directory information (Tech Terms, 2014). Malware can appear in the form of executable code, scripts, active content, and other software (Nash, 2014). Malware can be and do many things such as steal passwords, record keystrokes from your keyboard, hold your computer hostage with ransomware, install backdoors, and collect or destroy data on your computer (Landesman, 2014).
Non-malicious security threats like poorly written software and untrained users are a challenge for small IT departments as they rarely have the resources for a software security vulnerability assessment. Poorly written software may contain Zero day exploits that allow malicious hackers to gain access to your systems. This is evident in the recent Nasdaq hack where two known zero day vulnerabilities where used to gain access (Riley, 2014). Poor security practices and the lack of any security vulnerability assessment on out facing applications allowed for the takeover. Lastly untrained users are critical threat to your IT systems they seem to have the uncanny ability to plug virus laden USB drives into anything looking like a USB port causing all sorts of havoc.
Overall information security is critical to organizations operations and well beaning. Furthermore, the security threats I listed can be largely mitigated but not totally eliminated. IT managers today have the difficult task of balancing cost vs. benefits of mitigating threats, all the while accepting the blame for any incident that they fail to identify or resolve.
Works Cited
Anderson, R. J. (2008). Security engineering: a guide to building dependable distributed systems. Indianapolis, IN: Wiley.
Basani, V. (2013, 07 03). Edward Snowden and the NSA: A Lesson About Insider Threats. Retrieved from Businessweek: http://www.businessweek.com/articles/2013-07-03/edward-snowden-and-the-nsa-a-lesson-in-the-insider-threat
Bright, P. (2011, 02 16). Anonymous speaks: the inside story of the HBGary hack. Retrieved from Ars Technica: http://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/
CERT. (2014, 07 19). Insider Threat. Retrieved from CERT Carnegie Mellon University: http://www.cert.org/insider-threat/index.cfm
Landesman, M. (2014, 07 19). Most Damaging Malware. Retrieved from About.com: http://antivirus.about.com/od/virusdescriptions/tp/worstvirus.htm
Nash, T. (2014, 07 19). An Undirected Attack Against Critical Infrastructure . Retrieved from US-CERT Control Systems: http://ics-cert.us-cert.gov/sites/default/files/recommended_practices/CaseStudy-002.pdf
Osawa, J. (2011, 05 09). As Sony Counts Hacking Costs, Analysts See Billion-Dollar Repair Bill. Retrieved from The Wall Street Journal: http://online.wsj.com/news/articles/SB10001424052748703859304576307664174667924
Riley, M. (2014, 07 17). How Russian Hackers Stole the Nasdaq. Retrieved from Businessweek: http://www.businessweek.com/articles/2014-07-17/how-russian-hackers-stole-the-nasdaq
RONALD BOWMAN, T. D. (2012, 11 01). Data Centers: Site Selection 101 . Retrieved from Site Selection: http://www.siteselection.com/issues/2012/nov/data-centers.cfm?s=ra
Slade, E. (2014, 07 19). Top 3 Reasons Why Information Security & IT Maintenance is Important. Retrieved from Howard County Maryland: http://www.howardcounty.com/Top_3_Reasons_Why_Information_Security__IT_Maintenance_is_Important-a-1224.html
Tech Terms. (2014, 07 19). Malware. Retrieved from Tech Terms: http://www.techterms.com/definition/malware
