Understanding Threats to Information Systems

<div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEheomyyZrQDxbKlHFBtwQrjl1IzysuRRLoAw5lY7Zx6lEzzYLpXvOLxxvRUfRZTeUyBoRlbv7_sSrvOojv9H6nhsWepOfKmeD1CRpvergNffKKm0iy_yxFRg7dT64y92knbAOW9oQilO9dk/s1600/threats+to+IS.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEheomyyZrQDxbKlHFBtwQrjl1IzysuRRLoAw5lY7Zx6lEzzYLpXvOLxxvRUfRZTeUyBoRlbv7_sSrvOojv9H6nhsWepOfKmeD1CRpvergNffKKm0iy_yxFRg7dT64y92knbAOW9oQilO9dk/s1600/threats+to+IS.png" /></a></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;">To better understand the various ways in which the confidentiality, integrity, or availability of information assets can be threatened, consider first that threats to information systems can be subdivided into two major groups: (1) threats that originate from nature, and (2) threats that originate from human beings. With respect to the former, there are myriad natural threats which might prove injurious to information systems, including disasters such as floods, fires, earthquakes, mudslides, tornadoes, sinkholes, hurricanes, and so forth. With respect to the latter, it is important to consider the intention of the human being who poses the threat when classifying threats that originate from humans. <o:p></o:p></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;">Among threats that originate from human beings, the intention of the human who poses the threat might be benign or it might be malicious. As examples of benign or non-malicious intent, consider situations in which harm is caused by accident or through a simple human error, such as when someone trips over a power cord or accidentally deletes an important file. These examples are illustrative of harm that is actualized through benign or non-malicious intent. When there is malicious intent -- that is, when a human being seeks to deliberately cause harm to an information system -- that malicious intent can be classified as either random or targeted. The difference between random and targeted malicious attacks depends simply upon whether the attacker is targeting a specific organization, individual, or entity. If a specific target is under intentional attack, then we can classify the attack as a directed, targeted malicious attack. If, however, an attacker engages in a malicious attack and does so without the intention of harming a specific organization, individual, or entity, then we can classify the attack as a random malicious attack.<o:p></o:p></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div><br /><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;">By using this topology to understand and classify threats to information systems, organizations can design and prepare proper policies and defensive countermeasures to mitigate those threats.</span><o:p></o:p></div>

Understanding Threats to Information Systems

To better understand the various ways in which the confidentiality, integrity, or availability of information assets can be threatened, cons...

Read more »

Vulnerabilities, Threats, and Controls in Information Security

<span style="font-family: Arial,Helvetica,sans-serif;">In <a href="http://computersecurityconcepts.blogspot.com/2013/09/information-security-and-human.html">an earlier post</a>, I noted that one of the major goals of information security is to mitigate security risks. Another major goal of information security as a discipline and as a profession is to try to protect valuable information assets. In order to approach the study of methods of protecting these assets, we can adopt what is known as a <i>vulnerability/threat/control</i> framework. To begin, consider a vulnerability, which is a weakness in some aspect of an information system. If a vulnerability is exploited, then that exploitation has the potential to cause loss or harm. A human being who intentionally exploits a vulnerability is perpetrating an attack on the system. An attack, then, can be defined as an intentional exploitation of a system vulnerability. Next, we can consider a threat, which is simply a set of circumstances that has the potential to cause loss or harm. As we will see shortly, threats and vulnerabilities are very closely related. Finally, we have controls, which are things that we do or things that we have which help to eliminate or reduce a vulnerability. Note that another name for a control is a <i>countermeasure</i>.</span><br /><div style="text-align: center;"><span style="font-family: Arial,Helvetica,sans-serif;"><br /></span></div><span style="font-family: Arial,Helvetica,sans-serif;">When first learning about information security, many people become confused regarding the difference between a threat, a vulnerability, and a control. I will therefore provide a simple example that I hope will help you to remember the difference between these three security concepts. Imagine that you are walking over a bridge. Whenever you walk over a bridge there is always a certain threat to your safety; namely, that the bridge might collapse underneath you.</span><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0ytd7wnla8sEVsNBTHYjrJJyutGpXipgVKRWajUZmqFue0a1SD8vLLQExKIxl8cnsVmcISmpt4UnEWaLE2rlTE79LOrHi-yd9REGafIqFK3iS5IUaIUJ40g_UnEXun3oyvLePj_CAqxcI/s1600/bridge+01.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0ytd7wnla8sEVsNBTHYjrJJyutGpXipgVKRWajUZmqFue0a1SD8vLLQExKIxl8cnsVmcISmpt4UnEWaLE2rlTE79LOrHi-yd9REGafIqFK3iS5IUaIUJ40g_UnEXun3oyvLePj_CAqxcI/s1600/bridge+01.png" /></a></div><div style="text-align: center;"><span style="font-family: Arial,Helvetica,sans-serif;"><br /></span></div><span style="font-family: Arial,Helvetica,sans-serif;">Here, the possibility of the bridge collapsing is a threat to your safety. Now imagine that there is a weakness in the bridge. For this example, let’s say that the mortar between the blocks of stone from which the bridge is constructed has begun to crumble or deteriorate.</span><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhy5Bwz12VxQif0qTr3IOjkEXECjfG_YawT06-dIAywXv27-TC984NSubURfxFhBYqfht6vXjAJnLp1edaBWdYXYg3i5NR8tvJhyphenhyphentlZTzczeDfzkqouxSVxNO2E0LngOKypTdMc7EvQs6fI/s1600/bridge+02.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhy5Bwz12VxQif0qTr3IOjkEXECjfG_YawT06-dIAywXv27-TC984NSubURfxFhBYqfht6vXjAJnLp1edaBWdYXYg3i5NR8tvJhyphenhyphentlZTzczeDfzkqouxSVxNO2E0LngOKypTdMc7EvQs6fI/s1600/bridge+02.png" /></a></div><div style="text-align: center;"><span style="font-family: Arial,Helvetica,sans-serif;"><br /></span></div><span style="font-family: Arial,Helvetica,sans-serif;">The weaknesses in the mortar are vulnerabilities, and if those vulnerabilities were to be exploited, the threat of the bridge collapsing would be actualized, and might cause you physical harm.</span><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJFOM5pXsxFlx8zmAw4Zg7PXZPtYmgCG_K3h8uksuLQ_vR1wHRo1FYRYLqO9gNI3ntJtJy0BG-mmYQc1K_t2_2rMf8yQFE5s5IY_AIod5F0bOJ9_59OGv7NTJyGunzrJRhZh9YtAzIn9BL/s1600/bridge+03.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJFOM5pXsxFlx8zmAw4Zg7PXZPtYmgCG_K3h8uksuLQ_vR1wHRo1FYRYLqO9gNI3ntJtJy0BG-mmYQc1K_t2_2rMf8yQFE5s5IY_AIod5F0bOJ9_59OGv7NTJyGunzrJRhZh9YtAzIn9BL/s1600/bridge+03.png" /></a></div><div style="text-align: center;"><span style="font-family: Arial,Helvetica,sans-serif;"><br /></span></div><span style="font-family: Arial,Helvetica,sans-serif;">A control, then, is something that we do or something that we have which helps us to eliminate or reduce a vulnerability. In this example, we might apply bracing to reinforce the bridge or we might try to repair the cracks in the concrete, thus reducing the possibility that the vulnerability will be exploited.</span><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhisy2E_f5jzEmj_Ziw0pBXqTNpTCkYkhwmrdWlcHhXz-IuVdfQeMbBkftUestKSQMuf7z2bowKRo7FBopVOuKYWcRPuqij4pI5NlhDhvPu8w_fmHSOziNrI9aNneDUGvgct_6dbOSIa5xB/s1600/bridge+04.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhisy2E_f5jzEmj_Ziw0pBXqTNpTCkYkhwmrdWlcHhXz-IuVdfQeMbBkftUestKSQMuf7z2bowKRo7FBopVOuKYWcRPuqij4pI5NlhDhvPu8w_fmHSOziNrI9aNneDUGvgct_6dbOSIa5xB/s1600/bridge+04.png" /></a></div><div style="text-align: center;"><span style="font-family: Arial,Helvetica,sans-serif;"><br /></span></div><span style="font-family: Arial,Helvetica,sans-serif;"></span><span style="font-family: Arial,Helvetica,sans-serif;">Broadly, then, threats are blocked or prevented from being actualized by controlling vulnerabilities.</span>

Vulnerabilities, Threats, and Controls in Information Security

In an earlier post , I noted that one of the major goals of information security is to mitigate security risks. Another major goal of inform...

Read more »