Significant increases in computer interconnectivity, especially in the use of internet are revolutionizing the way our government, our nation, and much of the world communicate and conduct business. The benefit of IT revolution is enormous and vast amounts of information is now available at the click of a mouse, which facilitates research on virtually every topic imaginable within a short time, sometimes less than a day.
However apart from the benefits, this widespread interconnectivity poses significant risks to the computer systems, and more importantly the critical operations and infrastructures they support, such as telecommunications, national defense including the military war fighting capabilities, government services and emergency services. The same factors which benefit operations, speed and accessibility, if not properly controlled make it possible for individuals and organizations to inexpensively interfere with these operations from remote areas for purpose of fraud or sabotage, or for other malicious, or mischievous purposes.
Apart from virus threat, natural disasters and inadvertent errors by authorized computer users can have devastating consequences if information security is poorly protected. On the backdrop of this network security has become one of the major concerns of our modern society. As cyber attack gets more and more sophisticated, the problem of detecting them becomes a real challenge (GAO, 2000, p. 3). Since the late 1990s, most work organizations have come to depend on information technology for internal operations such as record-keeping, external transactions such as financial transfers, and mediated communications of all types (e.
g. , email). As connectivity among devices has increased, so has the likelihood of intrusion, theft, defacement, and other forms of loss. Surprisingly, although organizations tend to be more concerned about vulnerability to external threats, recent industry research suggests that a substantial proportion of security incidents originate from inside the organization. Security breaches in organization have spurred increased spending on information security specialists and technology.
With an increase in installation of information security measure in most organizations, a substantial IT sub-industry designs, develops, and markets of security devices such as firewalls. One organizational constraint that impacts the effectiveness of these technologies, however, lies in the behaviors of the human agents who access, use, administer, and maintain information resources. Appropriate and constructive behavior by end users, system administrators, and others can enhance the effectiveness of information security while inappropriate and destructive behaviors can substantially inhibit its effectiveness (Stanton et al, 2005).
Information security alone cannot guarantee protection. One can build the biggest fortress in the world and someone could come up with a bigger battering ram. Information security is the preventive steps one can take to guard information and capabilities. Information is guarded from the exploitation of any vulnerability and against impending threats. What is information security? Most organizations, whether they are government, commercial or military, are now highly dependent upon their computer systems and networks in order to function.
Large amounts of digital data are stored and processed in large computer systems and transmitted between computers linked together in complex communication networks. Without appropriate safeguards this data is susceptible to interception during transmission, or may be subject to various forms of attack whilst in storage or during processing. Computer misuse is seen by many as a growth industry and a serious threat which is frequently undetected and under reported.
The threat posed from malicious acts is intangible and notoriously difficult to quantify, and only those incidents which are discovered appear in official statistics. However, it is clear from events which all to frequently do get reported that there is a real danger from unwarranted computer intrusions, whether they be for fun, curiosity or something more sinister. Over the past decade or so, the information security industry has grown into a multi billion dollar business, providing solutions to the perceived threats to data confidentiality, integrity and availability (Buzzard, 1999).
Computer security is a grey area. You cannot protect your systems and networks against every conceivable or theoretical weakness, and it is therefore practical to adopt a risk management approach. Risk may be defined as the likelihood of a successful attack resulting in a breach in security and/or damage. It is a function of threat (from both malicious and accidental acts) and vulnerability, compounded by other factors such as asset value, system size, complexity and attractiveness to the attackers. Connection to public network introduces the risk of intrusion by external attackers.
This issue holds true for all networks but most acute with respect to internet, since almost anyone in the world can obtain an internet connection, and the communications technology used is inherently insecure. The important risk factor in the information security system is vulnerability to risk. Attackers and hackers generally exploit, well known weaknesses in a system, which persist because of inadequate attention to security by system developers and a lack of knowledge and expertise on the part of system administrators (Buzzard, 1999).