Introduction to IT Security

As Internet use is developing, more and more companies are opening their information system to their partners and suppliers. Therefore, it is essential to know which of the company's resources needs protection and to control system access and the user rights of the information system. Moreover, because of today's increasingly nomadic lifestyle, which allows employees to connect to information systems virtually from anywhere, employees are required to carry a part of the information system outside of the company's secure infrastructure. In this article, we will walk you through basic principles of IT security.

Introduction to IT Security

There are many threats on the internet nowadays, including hackers, malware, viruses, malicious softwares, cyber intrusions, data leakage etc. The threat represents the type of action that is likely to be of harm, whereas vulnerability (sometimes called flaws or breaches) represents the level of exposure to threats in a particular context. Finally, the countermeasure is all of the actions implemented to prevent the threat.

The countermeasures to be implemented are not only technical solutions but also include user training and awareness as well as clearly defined rules.

In order to secure a system, the potential threats must be identified so as to identify and anticipate the enemy's course of action. Therefore, the goal of this report is to provide an overview of possible hacker motivations, categorise them and give an idea of how they work in order to better know how to limit the risk of intrusion and cyber attacks.

Goals of IT Security

Information systems are generally defined by all of a company's data and the material and software resources that allow a company to store and circulate this data. Information systems are essential to companies and must be protected.

IT security generally consists in ensuring that an organization's material and software resources are used only for their intended purposes.

IT security generally is comprised of five main goals:

  • Integrity: guaranteeing that the data are those that they are believed to be
  • Confidentiality: ensuring that only authorized individuals have access to the resources being exchanged
  • Availability: guaranteeing the information system's proper operation
  • Non-repudiation: guaranteeing that an operation cannot be denied
  • Authentication: ensuring that only authorized individuals have access to the resources


Verifying data integrity consists in determining if the data were changed during transmission (accidentally or intentionally).


Confidentiality consists in making information unintelligible to individuals other than those involved in the operation.


The goal of availability is to guarantee access to a service or resources.


The non-repudiation of information is the guarantee that none of the parties involved can deny an operation at a later date.


Authentication consists in confirming a user's identity, i.e. guaranteeing for each party that their partners are truly who they think they are. An access control (e.g. an encrypted password) grants access to resources only to authorized individuals.

Need for a Global Approach

Information system security is often the subject of metaphors. It is often compared to a chain in the example that a system's security level is only as strong as the security level of its weakest link. Likewise, a reinforced door is useless in protecting a building if its windows are left wide open.

All this goes to show that the issue of security must be tackled at a global level and must comprise the following elements:

  • Making users aware of security problems
  • Logical security, i.e. security at the data level, notably company data, applications and even operating systems
  • Telecommunications security: network technologies, company servers, access networks, etc.
  • Physical security, or the security of material infrastructures: secure rooms, places open to the public, company common areas, employee workstations, etc.

Implementing a Security Policy

The IT system security is generally limited to guaranteeing the right to access a system's data and resources by setting up authentication and control mechanisms that ensure that the users of these resources only have the rights that were granted to them.

And yet security mechanisms can create difficulties for users. Instructions and rules often become increasingly complicated as networks grow. Thus, IT security must be studied in such a way that it does not prevent users from developing uses that they need and so that they can use information systems securely.

This is why one of the first steps a company must take is to define a security policy, which is implemented with the four following stages:

  • Identify the security needs and the IT risks that the company faces and their possible consequences
  • Outline the rules and procedures that must be implemented for the identified risks in the organization's different departments
  • Monitor and detect the information system's vulnerabilities and keep informed of the flaws in the applications and materials being used
  • Define the actions to be taken and the individuals to contact in case a threat is detected

The security policy is all of the security rules that an organization (in the general sense of the word) follows. Therefore, it must be defined by the management of the organization in question because it affects all the system's users.

In this respect, it is not the job of the IT administrators to define user access rights but rather that of their superiors. An IT administrator's role is to ensure that IT resources and the access rights to these resources are in line with the security policy defined by the organization.

Moreover, given that he or she is the only person who masters the system, he or she must give security information to the management, advise the decision makers on the strategies to be implemented, and be the entry point for communications intended for users about problems and security recommendations.

A company's IT security depends on employees (users) learning the rules through training and awareness-building sessions. However, security must go beyond employee knowledge and cover the following areas:

  • A physical and logical security mechanism that is adapted to the needs of the company and to employee use
  • A procedure for managing updates
  • A properly planned backup strategy
  • A post-incident recovery plan
  • An up-to-date documented system

The Causes of Insecurity

Insecurities are generally broken down into two categories:

  • An active state of insecurity, i.e. user ignorance of the system's functionalities, some of which can be harmful to the system (e.g. not deactivating network services that are not needed by user)
  • A passive state of insecurity, i.e. lack of knowledge of the security measures in place (e.g. when the administrator or user of a system does not know what security devices he or she has)

Read Further

Ask a question
CCM is a leading international tech website. Our content is written in collaboration with IT experts, under the direction of Jean-François Pillou, founder of CCM reaches more than 50 million unique visitors per month and is available in 11 languages.
This document, titled « Introduction to IT Security », is available under the Creative Commons license. Any copy, reuse, or modification of the content should be sufficiently credited to CCM (