Internal Threats From Hackers And Malicious Software

Sadly, there is no way to alleviate the numerous amounts of threats that haunt networks and computers worldwide. The foundation and framework for choosing and implementing countermeasures against them are very important. A written policy is vital in helping to insure that everyone within the organization understands and behaves in an appropriate manner with regards to the fact that sensitive data and the security of software should be kept safe.

Other security elements are in reference to data recovery, database administration, handling a breach in security and administrative security policies such as access procedure, employee transfer and excessive user access. As I assume the role of the chief security officer, database designer, database administrator, and chief applications designer this project is very important to the armed services and the Virgin Islands National Guard as we strive to provide global security.

In today’s IT world every organization has a responsibility to protect the information and sensitive data they have. Protecting data is not only responsibility of security and IT staff but every individual is involved in protecting the information. The risks to information security are not digital only, but it involves technology, people and process that an organization may have. These threats may represent the problems that are associated to complex and expensive solution, but doing nothing about these risks is not the solution.

Information security enabled by technology must include the means of lowering the impact of intentional and unintentional errors entering the system and to prevent unauthorized internally or externally accessing the system  actions to reduce risk data validation, pre-numbered forms, and reviews for duplications. It is crucial that the mission plan include the provision of a disaster recovery and business continuity plan. On the other hand, there is much more intrusion activity today than ever before. Obviously, there is an increased concern for attacks through companies’ network in an effort to either commit malice or affect the integrity of an organization’s most valuable resource. Therefore, it is important that companies do not get complacent in their IT infrastructure security. The fact of the matter, there is no perfect system; however, it behooves organizations to protect their information by way of reducing threats and vulnerabilities. Moreover, Whitman and Mattord (2010) said it best, “because of businesses and technology have become more fluid, the concept of computer security has been replaced by the concept of information security. Companies

After the information system is installed, the IS security controls must be monitored and assessed on a continuous basis. Continuous monitoring ensures the security controls in place are effective. In this step, there are five tasks. The first task requires managers to determine the security impact based on the threat environment. The second task is conducting assessments on certain security controls as outlined in their Continuous Monitoring Strategy. The third task is correcting discrepancies found in the assessment. The fourth task requires updating the Security Authorization package based on the previous results. The fifth task requires the appropriate officials to make a risk determination and acceptance by reviewing the reported security

Multiple of organizations have gone to great lengths to make sure their networks are fully functioning correctly because it is the best way to facilitate information being shared and distributed as well as keep sensitive information secured. Organizations will eventually become exposed to potential malicious attacks and threats over a period of time. One of the potential threats to any organization is internal threats, which is a disgruntled employee that knows how the organization they work for operates. They already have some sort of access to a computer system in order to cause the most damage to an organization for a specific reason by putting a virus, Trojan horse, or a worm inside the network (Microsoft, n.d.). The second potential threat to any organization could be malicious individuals, groups, or organizations that are known as structured external threats (Tech-FAQ, 2012). These attackers are highly skilled on how a network works, and already know what damages and losses they will cause an organization. The motives for many structured external threats have to do with greed, politics, terrorism, racism, and criminal bribes (Tech-FAQ, 2012). The third potential threat to any organization is an unstructured external threat, which is an attacker often known as a script kiddie because they lacks the skills to develop the threat on their own when they try to attack an organization. They would use any cracking or scripted tools on the Internet that are already made to

Moreover, now days using information system is not as walking as in the park, it has many new security treats that the company might lose their confidential data, financial and personal information.

While all of these technologies have enabled exciting changes and opportunities for businesses, they have also created a unique set of challenges for business managers. Chief among all concerns about technology is the issue of information security. It seems to be almost a weekly occurrence to see a news article about yet another breach of security and loss of sensitive data. Many people will remember high profile data breaches from companies such as T.J Maxx, Boston Market, Sports Authority, and OfficeMax. In the case of T.J. Maxx, a data breach resulted in the loss of more than 45 million credit and debit card numbers. In many of these incidents, the root cause is a lack of adequate security practices within the company. The same technologies that enable managers can also be used against them. Because of this, businesses must take appropriate steps to ensure their data remains secure and their communications remain

Protecting each asset requires collaboration from every employee. Different assets have a different probability of failure do to vulnerabilities, threats and require annual information security training for each employee.

Within any organization, Information Security and Assurance has a huge role in protecting the network systems by all means necessary. This is why the Information Security and Assurance Department plays a key role in defeating the threat of today and the future. The first and foremost task we must execute is to conduct an analysis on the current information technology systems. Upon recognizing and discovering several issues within the organization’s existing information technology systems, we can start preparing resolutions for each and every one of them. To protect your sensitive information and systems, you must avoid a fortress mentality and be capable of adapting to an ever-changing environment Vladimirov, A. A., Gavrilenko, K. V., Mikhailovsky, A. A., ebrary, I., & Ebrary. (2010). Possessing the criterion for Information Security and Assurance with the specialization in CyberSecurity, I set forth the following proposal, The Information Security and Assurance Initiative. This program is to design, educate, and maintain an IT platform to support and answer the organization’s mission, visions, and goals without compromising the systems’ integrity and security. We will form an Information Security and Assurance Department that has the capability, experience and professionalism to bring this program to the next level without compromising the integrity and security of this organization.

Information security professional’s job is to deploy the right safeguards, evaluating risks against critical assets and to mitigate those threats and vulnerabilities. Management can ensure their company’s assets, such as data, remain intact by finding the latest technology and implementing the right policies. Risk management focuses on analyzing risk and mitigating actions to reduce that risk. Successful implementation of security safeguards depends on the knowledge and experience of information security staff. This paper addresses the methods and fundamentals on how to systematically conduct risk assessments on the security risks of information systems.

Designing a working plan for securing the organization s information assets begins by creating or validating an existing security blueprint for the implementation of needed security controls to protect the information assets.  A framework is the outline from which a more detailed blueprint evolves.  The blueprint is the basis for the design, selection, and implementation of all subsequent security policies, education and training programs, and technologies.  The blueprint provides scaleable, upgradeable, and comprehensive security for the coming years.  The blueprint is used to plan the tasks to be accomplished and the order in which

There are two types of management approach to the IT security function in the organization. The first is the bottom-up approach. The implementation of the IT security audit is from the grass-root level, whereby, the systems administrator and technical officers are the one making the decision on how to improve the security systems. This is advantageous because they possess technical expertise to enable them to execute these IT security functions. However, even with the best technical expertise, IT security within an organization would still be vulnerable due to lack of participation support from top management and the users of these IT systems. Another management approach is the top-down approach.

Security is that the most significant and important issue for firms worldwide. Organizations want a secure and reliable infrastructure for his or her systems to mitigate the chance of malicious activity from each external and internal sources. Organizations worldwide have major security considerations specifically

“In today’s competitive business environment, information is the lifeline of many organisations. It should therefore be protected, secured and managed accordingly” (Broderick, 2001; Finne, 2000; Posthumus and Von Solms, 2004; Squara, 2000, cited in Kritzinger & Smith, 2008). The protection of that value information is called ‘information security’. Its primary goal is protect the information ensuring its availability, confidentiality and integrity (Posthumus & Von Solms, 2004; Kritzinger & Smith, 2008; Tashi & Hélie, 2009; Fuchs, Pernul & Sandhu, 2011). Information security management is also about ensuring the security of information conducting proactive management of information security risks, threats and vulnerabilities (Posthumus & Von Solms, 2004; Kritzinger & Smith, 2008)