Introduction
Information systems security continues to be top on the list of specific issues affecting system executives. Traditional factors that could affect information security vary from breaking forcefully into computer and storage rooms to devastation by flood, fire, earthquake, and hurricanes. Current efforts concentrate on safeguarding data and information systems from unintentional or accidental unauthorized access, modification, disclosure, or destruction. These events may lead to undesirable effects that may spread from corporate failure to disrupted or degraded service to customers. Presently, many organizations rely so much on telecommunications and computer-based information systems. A breakdown causes either inconvenience or total damage. Dependence on computer and telecommunications structures has redefined company threat. Studies reveal that 90 percent of firms that are reliant on data processing systems face a crisis in the event when damage occurs to their data networks (Carter, 1988). Therefore, the management should prioritize the safety of information mechanisms before anything else.
However, even while the causes of risks to the information systems could be classified broadly into the identified groups, it is noteworthy that most of such causes could be attributed to human factors. The objective of this essay is to describe the extent to which human activity, intentional or unintentional, could lead to a compromised information system in any organization. The essay first notes the causes of insecurity of information systems, in which human factors are extensively described. The essay also explores the major types of cyber attacks, which is a further elaboration of human involvement in the insecurity of information systems.
Delegate your assignment to our experts and they will do the rest.
The Causes of Insecurity to Information Systems
There are many causes of insecurity in information systems, and most of such causes are attributed to human error as described in this section of the essay. First, according to existing literature, the use of weak passwords is a major factor that continues to threaten the safety of information in the technology space (Mkbarron, 2011). Many people use weak passwords that are easy to predict, which means that they give a leeway to hackers and malicious people to gain access to private information. There is a need to note that modern password-cracking software has the ability to break weak passwords. Across the globe, people tend to create passwords that follow specific patterns, for example, names of pets, year of birth, among others, which indicates how vulnerable they could be in the event of an attack. It is argued that such individuals avoid generating passwords randomly due to the difficulty to remember.
Further literature argues that lack of a proper security structure in many organizations has left them exposed to risks. For example, as Morrow (2012) posits, because of inability to afford the services of qualified IT staff, many organizations rush to connect to the internet directly with no extra protection plans. The management of such organizations is usually convinced that having a firewall guarantees the safety of a network. However, it is noteworthy that the absence of proper protection leads to a vulnerability of both hardware and software to attacks from viruses and hackers (Morrow, 2012). Furthermore, poor configuration control and management has contributed to the fall of a number of organizations to cyber-attacks. In this case, the lack of strong policies and rules as to which devices and persons can connect to the network has cost many firms. Therefore, weak restriction measures lead to a gamble in the safety of data as malicious individuals find it easy to break into the system and gain access to private information.
Extant literature still posits that the use of removable devices compromises the safety of data. For instance, according to Loch, Carr, and Warkentin (1992), devices such as flash drives and external hard drives present a passageway for malware to pass between hosts and networks. Individuals who purpose steal important information from an organization, which might later cause negative outcomes for the institutions, could also use these devices. For example, individuals who operate in very competitive environments might want to crash competitors to gain competitive advantages. Researchers also suggest that physical security plays an integral part in safeguarding data in any organization (Morrow, 2012).Physical security entails measures put in place to control access by people to a given computer premise, which raises the chances of insertion of external devices onto computer systems to facilitate data breach. Premises that do not have entrance restrictions are vulnerable to vandalism and theft. When strangers are allowed to enter every room and given freedom to have access to organizations systems, some take advantage of the express permission and might decide to access sensitive information.
Moreover, some authors suggest that a number of organizations are short of an efficient and proper data backup and recovery systems. In the event that computers are damaged, many organizations lose critical information, which might jeopardize their operations (Morrow, 2012). Some have installed such systems but lack the capacity to hold large amounts of data. On the other hand, some systems could be faulty because of poor monitoring and maintenance. In other cases, information devices and documents might also not be properly disposed and destroyed, which increase the risk of their exposure to suspicious people. For example, paper documents such as catalogs and reports could contain important data, which means that if not shredded and incinerated, they may be altered and retrieved. Disposed computers or portable devices that might have been used to store and process important data remain prone to access until data is erased properly. Malicious persons could use recovery tools in case electronic devices are not discarded appropriately.
Further research in this area reveals that using administrative systems and devices to engage with social media platforms poses a high risk to the safety of information. Social media sites are usually adversely targeted by malware are regularly used to get information on identity theft and receive a high level of spam (Mkbarron, 2011). The fact that many firms have not restricted their employees from accessing some social media websites using their facilities means that they could be easy targets in the events of attacks. Specifically, there is a need to consider that unsuspecting employees might be lured to fall into the trap of giving access to strangers to have contact with sensitive information.
Many studies also suggest that there are organizations, which do not update their software (e.g. Whitman, 2004; Zissis and Lekkas, 2012; Morrow, 2012). Old software may contain loopholes that may be exploited to tamper with systems. New and updated software contains features that might guarantee more safety of data compared to old software. Some organizations also go the easier and cheaper way of obtaining counterfeit software, not knowing about the risks (Whitman, 2004). In buying such software, organizations miss to apply manufacturer-recommended patches. Malicious actors may find opportunities to mess up with a company’s systems. Data could also be at risk when organizations connect to a number of internet websites. Browsing webpages that have not yet passed through security updates might cause some individuals to pass malicious codes to computers and networks. In addition, hackers or criminals aim at individuals to get entry to private information through emails containing malicious code in what is called phishing. When the infected emails are opened, the user’s machine can be tampered with. In addition, the use of portable devices such as laptops and handheld devices such as smartphones to conduct an organization’s business poses huge security threats. The ability to secure them is low because they are regularly used for other activities other than the organizations’. These devices can easily get lost or even stolen and safety jeopardized by malicious code penetrating the applications and the operating system.
Lastly, insights reveal that cloud computing present a threat to data security. When firms use cloud computing, data protection services are delegated to a third party. This totally alters the enterprise security formation. A large amount of customer information is kept in shared avenues, which escalate a number of data availability, and encryption issues ( Zissis & Lekkas, 2012 ). Moreover, the entity that gives the cloud computing services encounters similar data security huddles and responsibilities same as the organization that owns the data, including patching and shielding their applications against malicious code.
Major Types of Cyber Attacks
The rapid growth of internet connectivity has its side effects, and key among them is security vulnerabilities, which are majorly characterized by cyber attacks. Computer scientist Yu, (2014) argues that cyberspace has become the best venture for intelligent criminals, who are motivated by financial and political gains. There are different types of cyber-attacks, including denial-of-service (DoS) attacks, malware and ransomware, password attacks, phishing, malvertising, ‘Man in the middle' (MITM), credential reuse, and SQL injection attack among others.
According to research, Denial-of-Service (DoS) is among different internet-based attacks, which is critical and continues to pose a threat to the cyberspace security (Brown, 2011). DoS is where hackers transmit large volumes of data through a network to the level the system is overloaded, and it cannot function. DoS occurs when hackers use one computer to hack the system, but when several are used, it is referred to as distributed-denial-of-service (DDoS) attack (Yu, 2014). These attacks can also be made by simply dislodging plugs that connect the server of the website to the internet. Such attacks are usually directed to huge companies, institutions or governments as a sign of protest. Regular inspections and monitoring of internet connections are encouraged to deal with these threats. In addition to that, regular software updates and consistent online monitoring of the flow of data is necessary to find out any threatening spikes in traffic before they paralyze the system. Moreover, tools used in detecting DDoS and Dos attacks are required in addition to the purchase of extra bandwidth to handle high traffic (Yu, 2014).
Furthermore, different researchers argue that servers, websites, and computers that are connected to the internet are at risk of malware and ransomware attacks (e.g. Brown, 2011; Jasma, 2002). Malware is a generic term to refer to different software such as worms, viruses, spyware, and Trojan horses among others that are designed to damage servers, networks, and computers. Malware are in the form of codes with malicious intent to infect a computer system to steal confidential information or destroy essential data (Brown, 2011). They are typically introduced into the system through software downloads, email attachments that look harmless to the computer such as a PDF or Word document, but in the real sense, they have a malware installer. After installation, the malware can monitor the user's actions and keystrokes and secretly send valuable information and data to the hacker's computer. On the other hand, ransomware is a particular version of malware that blocks the user from accessing computer, and it demands payments before restoring the normal functioning. A preventive measure such refraining from downloading attachments from unknown sources and clicking suspicious links is vital to evade malware attacks. Updating computer security systems such as anti-viruses is also of utmost significance.
Password attack is another threat that comes with internet. In this method of attack, a third party (hacker) tries to crack the user's password so that she/he can gain access to the user's account, database, and any other sensitive digital space or system. Attackers usually have software that is run on their system. The software will then help the attackers to compare different word combinations in the user's password against a dictionary file. Brute force attacks can also be employed where the attackers try to guess passwords. To prevent this, Jamsa (2002) advises users to come up strong passwords that entail the use of a combination of lower and upper case letters, numbers, symbols, and a minimum of eight characters. The use of dictionary words is not recommended because it is easy to guess. Another researcher, Cole, E. (2002) suggests a regular change of passwords so that by the time the hacker cracks the older password, there is already a new one.
In the last few years, there has been a rapid increase in the number and sophistication of phishing attacks. Phishing attacks take place when hackers maliciously send text messages and authentic-looking emails, which have links that direct their targets to dummy sites to obtain user's financial information and personal credentials such passwords, credit card numbers and identification card numbers (Jakobsson and Myers, 2007). The stolen information and data is then used to commit various nefarious deeds such as corporate espionage, fraud, and identity theft. Phishing can be prevented through proper verification of the sent texts and emails from the respective institutions before submitting any information.
Another type of cyber attack that has been significantly reported is malvertising. Here, the user's computer is compromised with a malicious code after clicking on the affected ad. Hackers usually use an ad network to upload infected advertising feeds to different sites (Donaldson, et al., 2015). By clicking on these feeds, the user will download malware unknowingly. Extra caution must be taken before clicking on advertising feeds. Users should refrain from any ad that sounds too good or promises riches with little input. Again, updated operating systems and software are significant tools to safeguard one's data and information. Moreover, Donaldson et al. (2015) argue that website operators need to have stable configuration over public-facing website so that hackers find it difficult to perform any changes, and in the event of changes, they can be easily identified and rectified.
It has also been established from different researchers that Man in the middle (MITM) cyber attacks have become common and they usually target multiple customers and multiple financial institutions. According to Baldoni and Chockler (2012), MITM is carried out by tricking a legitimate user into starting a connection with a rogue server that is configured to mimic the behavior of the legitimate server. In this process, hackers impersonate endpoints in an online information exchange platform, and they obtain information from the user and the entity she or he is communicating with. The hackers capture the unique session ID between user computer or any other electronic gadget and the remote web server. One of the prevention methods is to use encrypted wireless access points which use WAP, WPA security or greater. The use of the virtual private network (VPN) is a better investment for online security.
Many researchers agree that the reuse of credentials can pose a risk to individual's account and data and is caused by the user. Despite internet security experts recommending the use of unique passwords for each account or website, some users still reuse their passwords. The moment hackers get access to a collection of passwords and usernames from a breached website or service that is usually acquired from some black markets websites on the internet, they will use the acquired credentials to log into more critical accounts and sites (Dasgupta, Roy, and Nag, 2017). Credential reuse is risky, and internet users can make use of password managers to assist in managing different credentials.
Furthermore, research also establishes that SQL Injection is another threat, which targets explicitly servers that store critical data for websites and services. Structured query language (SQL), as a programming language used to communicate with a database. The SQL injection uses a malicious code to get the server to divulge information it usually would not (Clarke, J. 2012). The most lucrative targets are servers that store private customer information from the website such as usernames and passwords, credit card numbers and other credentials.
Conclusion
While there could be different categories of causes of insecurity of information systems, this paper has argued that human causes are the most rampant. It is described that the activities of individuals could risk the security of information systems, which means that organizations that could be ignorant of such risks stand to lose critical data that may affect their performance negatively. It is also noted within the study that most of the causes of information systems insecurity are intentional, which suggests the need for institutions to install proper technology policies to curb the adverse effects associated with them.
References
Baldoni, R., & Chockler, G. (2012). Collaborative financial infrastructure protection: Tools, abstractions, and middleware . Heidelberg: Springer.
Ball, L., & Harris, R. (2002). SMIS members: a membership analysis. MiS Quarterly , 19-38.
Brown, B. C. (2011). How to stop e-mail spam, spyware, malware, computer viruses, and hackers from ruining your computer or network: The complete guide for your home and work . Ocala, Fla: Atlantic Pub. Group.
Carter, R. (1988). Dependence and disaster-recovering from e. d. p. systems failure. Management Services , 32 , 20-2.
Clarke, J. (2012). SQL injection attacks and defense [recurso electrónico] . Sin Lugar: Syngress
Cole, E. (2002). Hackers beware . Indianapolis, Ind: New Riders
Dasgupta, D., Roy, A., & Nag, A. (2017). Advances in user authentication .
Donaldson, S. E., Siegel, S. G., Williams, C. K., & Aslam, A. (2015). Enterprise cybersecurity: How to build a successful cyberdefense program against advanced threats .
Jakobsson, M., & Myers, S. (2007). Phishing and countermeasures: Understanding the increasing problem of electronic identity theft . Hoboken, N.J: Wiley-Interscience.
Jamsa, K. (2002). Hacker proof . Australia: Thomson/Delmar learning.
Loch, K. D., Carr, H. H., & Warkentin, M. E. (1992). Threats to information systems: today's reality, yesterday's understanding. Mis Quarterly , 173-186.
Mkbarron, (2011), Data Security: Top Threats to Data Protection
Morrow, B. (2012). BYOD security challenges: control and protect your most sensitive data. Network Security , 2012 (12), 5-8.
Niederman, F., Brancheau, J. C., & Wetherbe, J. C. (2011). Information systems management issues for the 1990s. MIS quarterly , 475-500.
Whitman, M. E. (2004). In defense of the realm: understanding the threats to information security. International Journal of Information Management , 24 (1), 43-57.
Yu, S. (2014). Distributed denial of service attack and defense .
Zissis, D., & Lekkas, D. (2012). Addressing cloud computing security issues. Future Generation computer systems , 28 (3), 583-592.
