Advantages And Disadvantages Of Layered Security And Security Flaws In Information Systems

Defense in depth identifies the need for many security layers to be utilised in defense of the system from the bottom as physical security to the top as Data security.

In today’s IT world every organization has a responsibility to protect the information and sensitive data they have. Protecting data is not only responsibility of security and IT staff but every individual is involved in protecting the information. The risks to information security are not digital only, but it involves technology, people and process that an organization may have. These threats may represent the problems that are associated to complex and expensive solution, but doing nothing about these risks is not the solution.

While digital network connectivity and electronic data exchange have paved the way to greater efficiencies in government systems, they have also opened the door to potential malicious attacks by hackers and malware that can jeopardize a system’s availability and overall security. Effective IT security rests on a careful mix of systematic security engineering, interoperable security standards and regulations, and intelligent information, procedures, technology and security personnel.

In order to diminish both security and privacy risks to organizations, measures need to be taken to combat risks throughout the various stages of the threat’s life cycle. Specific processes must be implemented to identify threats, procedures to follow when the attack occurs, and finally methods to recover from the attack (Houlding, 2011).

I previously identified several types of attacks, threats and vulnerabilities that exist with your multilayered network. I have now been charged with the responsibility of developing a strategy to deal with these risks as well as a plan to mitigate each risk to reduce the impact that each will have on your organization.

There is a myriad of perpetrators from cybercriminals and hacktivists to nation states, who would have a motive to gain access to her system. Since motive cannot be denied the focus shifts to denying method and opportunity. As method is concerned with skills, knowledge and tools, ongoing monitoring of methods of attack remains a constant challenge for security personnel. Mapping effective controls on vulnerabilities can attempt to deny the opportunity of attack.

Identifying threats and risks as well as understanding each helps improve a user’s chances of keeping information secure. After identifying the risks, there are four ways to deal with them; avoidance, acceptance, mitigation, and transfer. Another way to minimize

Defense-in-layers is an approach that advocates for applying security measures in overlapping layers to ensure that the whole security posture is covered. The security layers are to complement each other by ensuring that an unmitigated vulnerability at one layer is mitigated by another control available within another layer. Figure 1 illustrates how the defense-in-layers approach works.

Confidentiality, Integrity and Availability are the three hardest aspects to preserve in information Security. Confidentiality, being the most important aspect, is the prevention of unauthorized disclosure of information. Integrity protects the information within the document by making certain that only authorized users and parties can modify the information. Lastly availability insures that information and services are available when needed. These three aspects form a bond between companies and consumers insuring the information is in safe hands. However, IT systems and networks are prone to more malicious attacks then ever before and the number of computer crimes is increasing every day. Examples include Hacking, Viruses and vulnerabilities,

When it comes to network defense, there is never a safe zone where a network is prone to attacks, which is why it is always a good idea to make use of the in-depth strategic defense. This is a coordinated use of multiple security countermeasures to protect the integrity of the information assets in an enterprise. This type of defense makes it difficult for an enemy to get into, because of its complex and multilayered defense system (Rouse, 2007).

Based on our experience with this project, it is clear that the risk of network attacks is very real and should be given significant attention by a company to prevent any serious damage resulting from such attacks. We have a few points that would make sense for a company to implement in order to reduce risk.

A Defence in Depth strategy has always remained in fashion and a constant within security-clever organizations. Like the body’s immune system, this strategy is focused on multiple layers of defence to protect against any new threat. It includes defences and controls covering both networks and hosts and encompasses all phases of threat protection from prevention, to detection, to response.

Information security professional’s job is to deploy the right safeguards, evaluating risks against critical assets and to mitigate those threats and vulnerabilities. Management can ensure their company’s assets, such as data, remain intact by finding the latest technology and implementing the right policies. Risk management focuses on analyzing risk and mitigating actions to reduce that risk. Successful implementation of security safeguards depends on the knowledge and experience of information security staff. This paper addresses the methods and fundamentals on how to systematically conduct risk assessments on the security risks of information systems.

Safety of information is the most valuable asset in any organization particular those who provide financial service to others. Threats can come from a variety of sources such as human threats, natural disasters and technical threats. By identifying the potential threats to the network, security measure can be taken to combat these threats, eliminate them or reduce the likelihood and impact if they should occur.

Security breaches are a well-known problem that have been solved in different ways: automatic detection tools cite{li2010comparative}, documentation of best practicescite{owasp2015} and software development process activities (such as penetration testing cite{arkin2005software}, modeling cite{mcdermott1999using, swiderski2004threat}, architectural analysis cite{halkidis2008architectural,mcdermott1999using,howard2003writing} and so on). Despite the research community efforts to create techniques and tools for developing more secure software, there is a gap for techniques that address the security problem using an architectural point of view cite{rehman2009research}. Given that this research