As Internet use is developing, more and more companies are opening their information system to their partners and suppliers. Therefore, it is essential to know which of the company's resources needs protection and to control system access and the user rights of the information system. Moreover, because of today's increasingly nomadic lifestyle, which allows employees to connect to information systems virtually from anywhere, employees are required to carry a part of the information system outside of the company's secure infrastructure. In this article, we will walk you through basic principles of IT security.
There are many threats on the internet nowadays, including hackers, malware, viruses, malicious softwares, cyber intrusions, data leakage etc. The threat represents the type of action that is likely to be of harm, whereas vulnerability (sometimes called flaws or breaches) represents the level of exposure to threats in a particular context. Finally, the countermeasure is all of the actions implemented to prevent the threat.
The countermeasures to be implemented are not only technical solutions but also include user training and awareness as well as clearly defined rules.
In order to secure a system, the potential threats must be identified so as to identify and anticipate the enemy's course of action. Therefore, the goal of this report is to provide an overview of possible hacker motivations, categorise them and give an idea of how they work in order to better know how to limit the risk of intrusion and cyber attacks.
Information systems are generally defined by all of a company's data and the material and software resources that allow a company to store and circulate this data. Information systems are essential to companies and must be protected.
IT security generally consists in ensuring that an organization's material and software resources are used only for their intended purposes.
IT security generally is comprised of five main goals:
Verifying data integrity consists in determining if the data were changed during transmission (accidentally or intentionally).
Confidentiality consists in making information unintelligible to individuals other than those involved in the operation.
The goal of availability is to guarantee access to a service or resources.
The non-repudiation of information is the guarantee that none of the parties involved can deny an operation at a later date.
Authentication consists in confirming a user's identity, i.e. guaranteeing for each party that their partners are truly who they think they are. An access control (e.g. an encrypted password) grants access to resources only to authorized individuals.
Information system security is often the subject of metaphors. It is often compared to a chain in the example that a system's security level is only as strong as the security level of its weakest link. Likewise, a reinforced door is useless in protecting a building if its windows are left wide open.
All this goes to show that the issue of security must be tackled at a global level and must comprise the following elements:
The IT system security is generally limited to guaranteeing the right to access a system's data and resources by setting up authentication and control mechanisms that ensure that the users of these resources only have the rights that were granted to them.
And yet security mechanisms can create difficulties for users. Instructions and rules often become increasingly complicated as networks grow. Thus, IT security must be studied in such a way that it does not prevent users from developing uses that they need and so that they can use information systems securely.
This is why one of the first steps a company must take is to define a security policy, which is implemented with the four following stages:
The security policy is all of the security rules that an organization (in the general sense of the word) follows. Therefore, it must be defined by the management of the organization in question because it affects all the system's users.
In this respect, it is not the job of the IT administrators to define user access rights but rather that of their superiors. An IT administrator's role is to ensure that IT resources and the access rights to these resources are in line with the security policy defined by the organization.
Moreover, given that he or she is the only person who masters the system, he or she must give security information to the management, advise the decision makers on the strategies to be implemented, and be the entry point for communications intended for users about problems and security recommendations.
A company's IT security depends on employees (users) learning the rules through training and awareness-building sessions. However, security must go beyond employee knowledge and cover the following areas:
Insecurities are generally broken down into two categories: