...Security Threats Vulnerability can be defined as “a security exposure that results from a product weakness that the product developer did not intend to introduce and should fix once it is discovered” (Microsoft TechNet, 2014). There are possibility that the two databases could have vulnerabilities such as a weakness in the technology, configuration or security policies. The vulnerabilities can lead to potential risks in the personnel records systems. Security risks can be described as actions that could cause loss or damage to computer hardware, software, data or information. Potential security risks to milPDS and Remedy are computer viruses, unauthorized access of systems, personal information theft, personally identifiable information (PII) being compromised or violated, and system failure. These vulnerabilities and security risks can result in serious issue to the center. As a center that has a main purpose of managing personal records, any compromise, whether it is information stolen or a database system losing information can be disastrous for many different reasons. After threats and vulnerabilities have been identified, an assessment should be processed to figure out how the threat and vulnerability affected the system(s). This will assist in determining what measures are needed to ensure the vulnerability is handled. There are policies, Air Force Instructions and procedures in place if threats and vulnerabilities have been detected. The Commander will...
Words: 474 - Pages: 2
...Security Considerations for Pro Trans Brian Smith CMGT/400 July 27, 2015 Professor Iwona Rusin Security Considerations for Pro Trans To identify any of the vulnerabilities that may be associated with Pro Trans, I would first conduct a detailed risk analysis report that would include data related to variable aspects of the business. First, all of the possible risks will need to be evaluated. How those risks are being controlled will need to be assessed. It will be important to identify any assets that belong to the company that can be tampered with or stolen. The past and possible threats will also need to be documented. Simulated attacks can provide information on the possible impact they would have on the company. This data includes SLE or Single Loss Expectancy rating and an Annualized Loss Expectancy rating with monetary values for both. How much control the company has over specific and general attacks is important also. This data will reveal how safe the system truly is. Conducting interviews with each department staff leader will also be a key step in assessing risk. This would give a general idea of how day-to-day operations are run, how many employees have access to the system, and how many remote locations they have. Since the servers used for data storage are connected to the same network as the servers used for software and Internet programs, there is a serious risk when using web components. For example, all of the employees in the accounting department...
Words: 2340 - Pages: 10
...Security Threats & Vulnerabilities As information technology grows also does the need to protect technology or information on the system. Before we can protect the information on a system we need to know what to protect and how to protect them. First must decide what a threat to our system is. A Security threat is anything or anyone that comprise data integrity, confidentiality, and availability of a system. Another security issue for systems is Vulnerabilities in software that can be exploited by people that want to do harm to a system. It’s up to the personnel or team that’s in charge of protecting the system from threats and vulnerabilities. The personnel that secure information technology systems are known as (ISO) Information Security Officer, (IASO) Information Assurance Security Officer, (ISM) Information Security Manager ect. No matter what name the personnel there job is the same to protect information systems. Security Officers will have to set policies that govern the system and create plan on how to handle security threat and vulnerabilities. Security threats can consist of any number issues ranging from physical attack, spoofing, password attacks, identity theft, virus attacks, and Denial of Service attacks, Social Threats, Espionage, malware, spyware, Careless Employees, and hackers. We will disuse all of these threats and ways to prevent them later in the report. In 2010 Kevin Prince, CTO, Perimeter E-Security "As these security threats are becoming more...
Words: 2408 - Pages: 10
...Control Fundamentals and Security Threats To: John Smith, Business Manager From: your name Date: n/a Subject: Security threats and the need for security measures The need for security measures is vital to the company. The risk of not protecting against known security threats can be catastrophic. For example, an insider attack can obtain business advantage (long-term business benefits), financial gain, and sabotage which can disrupt performance and corrupt data. Computer criminals known as hackers can obtain secure company information or even create malicious software to harm the system. We must implement ways to make the company more secure by installing firewalls, virus protection, spyware, and other malware protection. The following are three specific social engineering techniques and how to best prepare employees for each potential attack. • Dumpster diving a social engineering attack in which malicious users search through the organization’s trash in the hope of retrieving useful inside information. We must ensure documents and data are properly destroyed before disposing such as using a shredded for hard copies. Providing training and educating employees on guidelines on how to safely dispose of information. • Tailgating is an attack in which a malicious user follows closely behind an authorized user to bypass a security access point. Malicious users can also persuade someone to grant them access to an area without authorization by claiming to have lost or forgotten...
Words: 360 - Pages: 2
...sharing and even business transactions is exchanged on mobile devices such as laptop computers, palmtops, tablet computers, smartphones and cell phones. The new age group of young people have never known a life without a mobile device with internet capabilities. Mobile Devices are an integral part of personal and social lives it is only logical that users should have awareness of security during the use of mobile devices. Individuals and organisations have both been beneficiaries on the rapid expansion of information and communication technologies (ICTs). Inevitably however, these offerings by mobile devices also bring about security vulnerabilities which users in Thohoyandou are not aware of. According to Lookout principal security analyst Marc Rogers, 2013, following simple precautions like sticking to the Google Play Store can ensure the security of a mobile device. This is rather not always the case as hackers and crackers make use of trustful applications to distribute malware. This study intends to outline security vulnerabilities and deliver clear recommendations on essential security technologies and practices to help mobile device users in Thohoyandou. Correct misconceptions or myths in order to bring about changes in attitudes and usage behaviour. INTRODUCTION The internet has transformed South Africa in just a drastic time, almost anything we see touch visualize is somehow connected to the internet. With systems that create, retrieve, process and...
Words: 2908 - Pages: 12
...Threats to Computer Security Source: An Introduction to Computer Security: The NIST Handbook National Institute of Standards and Technology Technology Administration U.S. Department of Commerce Special Publication 800-12 Computer systems are vulnerable to many threats that can inflict various types of damage resulting in significant losses. This damage can range from errors harming database integrity to fires destroying entire computer centers. Losses can stem, for example, from the actions of supposedly trusted employees defrauding a system, from outside hackers, or from careless data entry clerks. Precision in estimating computer security-related losses is not possible because many losses are never discovered, and others are "swept under the carpet" to avoid unfavorable publicity. The effects of various threats varies considerably: some affect the confidentiality or integrity of data while others affect the availability of a system. 1. Errors and Omissions Errors and omissions are an important threat to data and system integrity. These errors are caused not only by data entry clerks processing hundreds of transactions per day, but also by all types of users who create and edit data. Many programs, especially those designed by users for personal computers, lack quality control measures. However, even the most sophisticated programs cannot detect all types of input errors or omissions. A sound awareness and training program can help an organization reduce the number and severity...
Words: 1147 - Pages: 5
...Common Information Security Threats to Fundraising Organizations Klay C. Kohl CMGT/400 May 19, 2015 Robert Quintin Common Information Security Threats to Fundraising Organizations Introduction The advantages for fundraising organizations when integrating donor databases with their website are endless. Moreover, the security risk considerations from accessing online databases are an exponentially higher risk. These risks exist whether they are a small fundraising organization comprised mostly of volunteers or a Fortune 500 corporation. These risks fortunately, can be greatly reduced, and often, as in many cases, eliminated altogether when information security concerns are a priority in the design, implementation, and maintenance of the organizations offline access portal. In this article, we’d like to address some common security risks associated with database transactions online, discuss common technology behind these interactions, and describe controls that can be taken to mitigate the risks involved. Security concerns and the SDLC The system development life cycle (SDLC) commences with the initiation phase of the system planning process, continuing through system acquisition, development, implementation, and maintenance. Specific decisions about security must be made in each of these phases to assure that the system is secure. During this initiation phase, organizations conduct a preliminary...
Words: 1404 - Pages: 6
...Common Information Security Threats NAME CMGT400 – Intro to Information Assurance and Security DATE INSTRUCTOR Common Information Security Threats Information is one of the biggest and most important assets an organization has. This information is what drives a company, such as Bank of America, to be profitable and retain a customer’s trust. Without the customer’s trust, an organization will lose those customers, and therefore will be unsuccessful. So, in order to manage information securely, a risk assessment of all data storage devices and data transmitters should be produced to weigh the potential risks involved, the vulnerabilities of the risks, the impact the risks may cause, and the mitigation needed to safeguard any threats from occurring. The most well known, and one of the biggest threats to information loss are undoubtedly viruses, Trojan horses, and worms. These threats are no longer only considered childish annoyances as they once were. They can cause serious damage to an organization whether it’s financially, or to their reputation. Often referred to as malware, which means malicious code, these programs infect information systems that can replicate at a rapid rate by exploiting vulnerabilities in a computer’s operating system or network. These malicious tools can be used to steal company data, destroying information completely, or bringing down an entire corporation to its knees. In addition to malware, Distributed Denial of Service (DDoS) attacks...
Words: 1137 - Pages: 5
...Common Information Security Threats Paper Courtney Gardner CMGT/400 2-25, 2013 Terry Green Common Information Security Threats Paper The growing number of security treats an organization faces from day to day grows substantially as each day passes. Even the failed attempts to access secure data bear fruit of some kind in the form of another vulnerability being discovered or a different tactic is used that the company wasn’t prepared for. One organization that can’t afford not to be prepared is the Chase Bank organization. This financial institution is very accustomed to fending off skilled cyber thieves. It gets hit every day by thousands if not tens of thousands of attacks on their infrastructure and networks I will discuss three major threats that Chase faces DDoS attacks, Mobile Banking and Phishing. Transferring funds out of users' accounts is a major security treat they face. This can be achieved many ways which makes it an active job for the security admins of banks. Online banking has opened the banks to a wide variety of vulnerabilies that much be patched or mitigated to the lowest degree possible. Being the victim of a DDoS attack is always a possibility for Chase as they contact a large amount of online tractions and overseas money handling. Attackers can employee DDoS attacks, or distributed denial of service attacks, named for denial of customer service by aiming large capacities of network traffic to a website until it forced to or collapse. To help combat...
Words: 1188 - Pages: 5
...In the aftermath of the September 11, 2001, attacks in the United States, it was clear that the provisional security regime for defending against internal terrorist threats was not equal to the new challenges. This new focus on homeland security will have a secondary effect on the efforts of the United States to deal effectively with a range of soft security threats in that it will increase attention to those concerns, particularly as they are seen as enablers of terrorism. The establishment of the Department of Homeland Security is the largest reorganization of the United States government in over 50 years, and will necessitate a reordering of the inter-departmental relationships on security matters as well as those critical to soft security...
Words: 349 - Pages: 2
...Information Security Threats for Colleges CMGT/400 August 11, 2014 Common Information Security Threats Technologic advances occur at a rapid pace, with new devices coming out at frequent intervals. These new devices are appealing to college students who want to do everything as quickly and easily as possible. Because of the numerous smartphones, tablets, and laptops used by students and employees, college campuses face various security issues from mobile devices that connect to the network, often unintentionally. Identification of Threats There are many threats a network faces when the IT department allows students to connect to the network or Internet using mobile devices. Some threats affect the campus network only, while other threats directly affect students or employees. For the campus network, threats include Social media vulnerabilities, Unauthorized access to employee or student information, and Email attacks (phishing) For students, the main threat comes from identity theft, often a result of inappropriate practices connected to social media and email attacks. Often, attacks to a college network occur because of unintentional and misguided errors from students. Information Vulnerabilities Students use mobile devices, ranging from smartphones to tablets to laptops, to access class schedules, grades, email, and social network sites. Many devices have the capability to store user ID’s and passwords but personal security measures on...
Words: 1428 - Pages: 6
...Information Security Threats Mitigation By Francis Nsofwa Mubanga Keller Graduate School of Management Devry University Professor Sandra Kirkland SE572 July 14th, 2011 Table of Contents Introduction 1 Steps 1 Denial-of-Service attacks (DoS) 1 Distributed Denial-of-Service attacks (DDoS) 1 Masquerading and IP Spoofing attacks 2 Smurf attacks 2 Land .c attacks 2 Man-in-the-Middle attacks 3 Conclusion 3 References 4 Introduction Our company faces the largest information security threat and we need to take steps to mitigate the risks associated with each one of them. Steps Denial-of-Service attacks (DoS) We will analyze the attack as best as we can and implement the correct defense. We will ask ourselves if there are any common packet signatures that are easy to filter against. We will ask ourselves if all attackers hitting a single target if they can be sacrificed. We will also need to find out as to which network the attack is coming from, and if we can verify it (remember that spoofed packets can come from anywhere, including our own network). Once we’ve found a reasonable match for the attack, pass the filters to our upstream provider(s) and seek their help getting them propagated outwards. We will need to make sure we filter or redirect traffic with a minimum amount of actual downtime (Kaeo, 2004). Distributed Denial-of-Service attacks (DDoS) CluB: a Cluster-Based architecture is the method we will use to prevent DDoS attacks...
Words: 789 - Pages: 4
...Protecting systems against various systems threats such as passwords and cracking tools with brute force or attacks into the system by gaining authentication for access rights including a password, policy, to educate the users. SECURITY CONSIDERATIONS IN THE INFORMATION SYSTEM DEVELOPMENT LIFE CYCLE. Each information security environments unique, unless modified to adapt to meet the organization’s needs. The System Development Life Cycle (SDLC) the system development life cycle starts with the initiation of the system planning process, and continues through system acquisition and development, implementation, operations and maintenance, and ends with disposition of the system. Service decisions about security made in each of these phases to assure that the system is secure. The initiation phase begins with a determination of need for the system. The organization develops its initial definition of the problem that solved through automation. This followed by a preliminary concept for the basic system that needed, a preliminary definition of requirements, and feasibility and technology assessments. Also during this early phase, the organization starts to define the security requirements for the planned system. Management approval of decisions reached is important at this stage. The information developed in these early analyses used to estimate the costs for the entire life cycle of the system, including information system security. An investment analysis determine the...
Words: 1444 - Pages: 6
...Project Part 1: Current Security Threats The top three security threats that Aim Higher College faces are the following: * Mobile devices connecting to the network * Social Media * Compromised routers intercepting sensitive information These threats are the most common that any college faces. The threats have remained at the top of the list every year for a variety of reasons. This list of threats is also unique to college campuses. I will discuss each of the threats in this report. College students love new technology and each year smaller and more powerful devices are hitting the market. Students on the campus have a variety of devices ranging from cell phones, tablets, and laptops. These devices connect to the campus network and are used by students to check email, class schedules, get grades, and many other uses. The challenge is to allow these devices the necessary access and still have a secure network. Each device has to be checked for viruses, spyware, and other types of malware while still maintaining the C-I-A triad. A balance must be found between usability and security. Each time a remote device is connected to the network there is a possibility that the network can be compromised by one these devices. Every device should be authenticated, scanned, and identified. The use of social media has increased in recent years. Students and teachers both use things like Facebook, Myspace, and others. These applications have the potential to transmit malware...
Words: 589 - Pages: 3
... social networking, attack kits, mobile threats, zero-day and rootkits. These targeted attacks are exactly what it says, they target what they are designed to hit, whether it is a company (small or large), and individual or a specific machine. [ (Symantec, 2011) ] Symantec recorded over 3 billion malware attacks but yet Stuxnet stands out more than the others. However, lets us not forget Hydraq. Each one was highly sophisticated and was tailored for specific targets. Although Hydraq was old-fashioned, what made it stand out was what and whom it stole. Of course targeted attacks didn’t begin until 2010, and it won’t end. Once inside, the attack attempts to avoid detection until its objective is met. [ (Symantec, 2011) ] In 2010, the volume and sophistication of malicious activity increased, the Stuxnet worm became the first with the ability to affect physical devices while attempting exploits for an unprecedented number of zero-day vulnerabilities simultaneously. Although unlikely to become commonplace, Stuxnet does show what a skilled group of organized attackers can accomplish. [ (Symantec, 2011) ] Although providing a look at the security threats that are out there on the internet that us as users face on a daily basis, unless we know what we are dealing with, there is no way to defend against it. This is why it is important that we keep our software updated to help prevent attacks. [ (Symantec, 2011) ] Implementing security measures such as isolated networks can protect...
Words: 340 - Pages: 2
