Security Management and Control

(Date)
(Institution Affiliation)

Introduction
The internet has continued to grow exponentially over time which has led to multiplication of individual, business, and government applications on the internet, with immediate benefits to the end users. These network-based services and applications, however, pose security risks to the information and individual resources of governments and companies. Information that belong to a particular company or individual is an asset that must be protected, therefore, there should adequate security measures to avoid the risk of losing that asset. Network security is a way of protecting the digital information assets of a company. This paper describes the various goals of network security which are: Maintaining information integrity, protecting the information confidentiality and ensuring that the information is available. It is therefore very important that all the networks be protected from all the threats and vulnerabilities for the company to achieve its full potential and goals.
Potential malicious attacks and threats
A threat is defined as any event or circumstance that has the potential to adversely affect the organizational assets, or operations which includes image, functions, mission, or reputation of the company through unauthorized access, disclosure, destruction, modification of information or denial of service. An attack is an exploit or intrusion, which is an assault to a system that makes intentional use of a vulnerability. Examples of malicious attacks are; Hacking, SQL injection, and Password Cracking.
Hacking: Hacking is the unauthorized access of a computer system to get information or data that belongs to someone else. The hacker accesses the system by exploiting s systems’ vulnerability or weakness. The various channels that a hacker gains access to a system are: Misconfiguration attacks, application-level attacks, and operating system attack.
SQL Injection: The attacker may inject SQL (Structured Query Language) command via the webform input box, to make changes to data or gain access to resources. An SQL commands that exploits non-validated input weaknesses may be injected in a database backend and the attacker executes SQL commands via the web application. The use of sequential commands always makes it easier for the attackers to inject SQL commands in the database backend.
Password Cracking: this is a type of an attack where there is penetration to a system network. The attacker uses tools that unlock that resource which is secured with a password. Password cracking can be very simple or sophisticated techniques like brute force attacks, hybrid and dictionary attacks. The password crackers usually identifies encrypted password, retrieve it from computer’s memory through various mechanisms and then decrypts it. The main aim of the password crackers is getting the administrator/root password of the target system, and this gives him/her the administrator rights which enable them to have access to files or applications. The attacker can install a backdoor like Trojan to be able to access to the system in future or even the network sniffer which sniffs the traffic of the network so as to get access to the information that passes around the network. A system which is more powerful in terms computing power than that of the targeted system is used by the attackers for efficient password cracking.
Security controls against potential malicious attacks.
To control hacking, there should be proper authorization techniques to a particular service or resource. The company should implement the firewall technologies that are available. These technologies include hardware devices or programs that protects the services or resources of a private network from the users of another network. Firewall monitor the incoming traffics to pass, refuse or block from accessing the company’s network. Firewall are used with proxy servers and they help by protecting the private networks from hackers or intruders.
To address SQL injection problem, there must proper authentication schemes that prevents the SQL Injection attack, for example, the use of Advance Encryption Standard (AES). The user names and password that are encrypted improves the authentication process. For proper authentication the system server should maintain three parameters for every user who is registered in that system: user’s secret key, user name, and password. The AES scheme has three phases, Registration, Login and Verification Phase. In registration phase, the user selects a unique password and username which is send to the server, which are encrypted by the use of AES algorithm that applies the unique user secret key. In verification phase, the server gets the login query and verifies the corresponding user’s secret key, and if the password and username match then they are decrypted using this key.
The company should also use the password hashing algorithms. Examples of such algorithms are SHA2, MD5, and others. The use of very strong passwords for all the account types can be very useful, lockout policies that restricts the end-user accounts to limit the number of retry attempts, and also the users should not use default account names
Data Loss and Data Theft
The company holds sensitive data that shareholders, business partners, customers, and regulators expects them to protect. However, it is unfortunate that the company experiences high-profile data leakages and massive data loss that involves sensitive corporate and personal data. Example of types of data loss and theft are, Leakage, Disappearance and damage.
Leakage: this is a loss of confidentiality where sensitive data is not controlled by the company any longer. A common example is hacked database. An instance of this is when there was an attack and hackers got an access to records where they stole over 100 million credit-card a US’s largest payment processors.
Disappearance: this is where the correct data copy is not available to the company, which is a loss of availability of the data where the information is erased or become inaccessible and the authorized people cannot get that they need.
Damage: this is the modification of the original data by the attackers. It is a loss of integrity of the data where the information is modified or corrupted, this means unauthorized changing of the information
Impact of the concerns for data loss and data theft.
The incidents of data loss can cause a significant cost to the company. The costs to the company can be very severe which includes liability costs that may not be covered by the insurance policies. The payment processing data that is lost can be repaired for several years, but the customers can clear up the problems and get their finances back. There has been extensive use of electronic records in many fields which possess risks for both the organization and consumers. For the medical records, the risk is privacy and the access of this records access would cause permanent damage rather than temporary. Consequently, the company may face increased regulatory or litigation consequences.
Security controls to protect against data theft and data loss. 1. Encryption: this involves encrypting removable media which will allow the company to ensure that any data that either the employees may take outside the company environment is always secured. Many removable personal devices that has data used for corporate purposes can be encrypted to ensure privacy. For the data that is stored in the encrypted portable device to be read, the user must have a machine that has portable media encryption software installed and it must have the corresponding encryption key 2. Digital rights management (DRM) technology: DRM is a technology that allows the company to encryption techniques to protect data. It uses a technology where the users’ identity should be authenticated first and his/her rights verified to the access the encrypted files. It is form of encryption that remains active when the device is within the company environment or on a shared personal removable device. 3. Synchronize DRM and Content Management Systems (CMS): CMSs allows the control centers for whole content, which includes content production, management and distribution. Integrating DRM-CMS gives solutions that provides the company with the assurance that document and content operations conform to current responsibility, regulatory rules, security and privacy legislation.

References
Abomhara, M., & Kien, G. M. (2015). Cyber Security and the Internet of Things: Vulnerabilities, Threats, Intruders and Attacks. Journal of Cyber Security and Mobility, 4(1), 65-88. doi:10.13052/jcsm2245-1439.414
Nicho, M., & Khan, S. (2014). Identifying Vulnerabilities of Advanced Persistent Threats: International Journal of Information Security and Privacy, 8(1), 1-18. doi:10.4018/ijisp.2014010101
Zaman, M., Ahmad, J., Azhar, M., Nawaz, A., Abbas, S., & Idrees, U. (2014). Implementation of Some Enhancements in Wireless Network Security by Finding Vulnerabilities, Threats and Attacks. Journal of Global Innovations in Agricultural and Social Sciences, 2(3), 143-151. doi:10.17957/jgiass/2.3.597