Implementing Threats, Risk and Security Audits


Visitors: 180

People used to close business deals with a handshake.

They looked one another in the eye. Today, more and more transactions are electronic, anonymous and, in too many cases, fraudulent. Any organization that stores or moves important information on an electronic network is putting its information at risk. A criminal on the other side of the world or an apparently loyal employee may have the ability to wreak havoc, by stealing, deleting or exposing confidential information.

The Computer Crime and Security Survey, conducted by the Computer Security Institute and the Federal Bureau of Investigation, indicates almost two-thirds of the large corporations and government agencies it surveyed lost money when their computer security broke down.

The survey noted that 9 out of 10 respondents had computer security breaches during the previous 12 months. Proprietary information worth $170.8 million was stolen from 41 respondents. Fraud cost 40 respondents $115.8 million.

When only 45 per cent of executives in North America said they conduct security audits on their e-commerce systems, (around the world, fewer than 35 per cent had conducted security audits) it becomes obvious that organizations must improve their defenses quickly.

The first step in protecting information assets is a Threat and Risk Assessment (TRA). Without the information it provides, organizations are in danger of fixing only what is broken and ignoring potential hazards. While the specifics of a TRA will be unique at each organization, a common methodology provides a starting point.

The first step is risk assessment, to identify the most important assets and information: threats and vulnerabilities are identified; solutions are proposed and refined; corporate policies are tightened up; roles and responsibilities are assigned; standards and training are developed.

The next step is the creation of a security plan, with its own procedures, budget and implementation timetable. Once those steps are complete, any new architecture can be rolled out and new procedures put in place. At this point, the new system should be tested from the outside for any remaining weak points.

Finally, to maintain system security, security should be audited on a regular basis to keep pace with both internal changes and evolving external threats. The TRA provides the map, but organizations must make the journey. Consulting companies have identified factors that contribute to the success or failure of an IT security project. Senior managers have to support the project and demonstrate their involvement. Otherwise, their staffs will place a higher priority on other activities.

Business and technical experts should both be involved because solutions that overburden the enterprise are not acceptable. Individual business units should be responsible for their own TRA to prevent foot-dragging during implementation and finger-pointing later. Interestingly, one consultant recommended conducting assessments on a department-by-department basis, rather than all at once. The reasoning is that valuable resources can be narrowly focused, and lessons learned can be carried over to subsequent assessments.

The Threat and Risk Assessment is an important tool. Recent reports show not enough organizations are using it.

Tim Margeson is General Manager of CBL Data Recovery Technologies Inc. , a leading international provider of data recovery services to consumer, enterprise and public-sector clients who experience data loss disasters.


Article Source:

Rate this Article: 
Internet Security Threats: Who Can Read Your Email?
Rated 4 / 5
based on 5 votes

Related Articles:

Growing Mobile Security Threats Highlights The Need For Advanced Security ..

by: Chye Ni Tan (April 25, 2011) 
(Communications/Mobile Cell Phone)

640-554 Implementing Cisco IOS Network Security – Security Infrastructure On ..

by: Velma W. Johnson (June 18, 2014) 
(Computers and Technology/Certification Tests)

Network Security - Little Known Threats

by: Frank Owen (October 28, 2005) 
(Internet and Businesses Online/Security)

Watch Out For These Email Security Threats

by: Paul Wilcox (September 05, 2006) 
(Internet and Businesses Online)

The 8 Most Common Threats to Computer Security

by: Michael Maxstead (November 24, 2011) 
(Computers and Technology/Spyware and Viruses)

VoIP Security Threats Explained

by: Michael Talbert (March 04, 2007) 

Threats Network Security Protects Against

by: Frank Owen (October 28, 2005) 
(Internet and Businesses Online/Security)

Wireless Encryption and Security Threats

by: Troy Davies (November 23, 2005) 
(Computers and Technology/Mobile Computing)

Network Security - Methods For Controlling Threats

by: Frank Owen (October 28, 2005) 
(Internet and Businesses Online/Security)

Internet Security Threats: Who Can Read Your Email?

by: Mark Brooks (February 24, 2005) 
(Computers and Technology/Software)