Different Approaches for Ensuring an Information System Security

Keeping an information system secure depends on the ability to keep abreast of threats.

No information system, especially one connected to the Internet, is ever wholly secure. Monitoring existing and emerging threats and trying to protect against them is an industry unto itself.

External Threats

In 2007, information security professionals from noticeboard.com and the ISO27001security newsgroup compiled a list of external threats to security. The list included criminal and terrorist organizations, hackers, fraudsters, business competitors and malware authors. It also included natural disasters such as hurricanes, floods and government regulators whose requirements can sometimes compromise the privacy of users. Technology itself can also be seen as an external threat as new technology can erode the effectiveness of current security.

Internal Threats

Internal threats to computer security can include malicious employees. It can also include employees who do not follow proper security procedures and employees who are trying to access information for personal gain or at the bequest of unethical competitors. Internal threats are anyone with authorized access whose actions threaten system security.

Solutions

Solutions to information security include software first and foremost. Security software including firewalls, encryption software and password protection are included in nearly all information security systems. Hardware can also be part of the solution. Some servers and operating systems are more secure than others. Proper internal security policies and educating staff on those policies is also an important part of information system security.

References

• Server Administration: Information Security: A Coherent Approach
• Educase Review: A Unified Approach to Information Security Compliance by M. Peter Adler, 2006

Resources

• WikiCFP: Security Book 2011 : Strategic and Practical Approaches for Information Security Governance