An online company who accepts credit card details wants to secure its customers’ details, and safeguard against damage.
Vulnerabilities: Theft (information and money), Unauthorized access, Identity theft
Threats can come from both external and internal factors. For example, the credit card owner maybe a victim of thievery, assuming that the thieve has the victims credit card and its pin code then it would be easier for the thieve to access the contents stolen credit cards. A company is not also safe from their own employees. Assuming that the online company has an employee, who had ill intent from the beginning, he can easily access the credit card’s information from the company’s database presuming that the employee has access to the company’s database and other sensitive materials.
Security Measure: Access control software, firewall, intrusion detection systems(IDS), intrusion prevention system(IPS), credit limit, Security Information Management, cipher codes.
Among the listed security measures, the best ones for this case are encryption and Intrusion detection systems. What intrusion detection does is basically establishing a barrier between a trusted internal network and untrusted external network, its functions are like of that a firewall but much stricter and organized. Encrypting customer details would also help the company prevent further loses, a thief might be able to acquire monetary content from the victim’s credit card but at least the details of the victim is protected against identity theft.
A communications company employing a lot of young, technically able people, wants to ensure its online facilities are not being abused.
Vulnerabilities: Theft of Information, Theft of time, Identity theft, Hacking
Threats can still come from both internal and external factors. Employing technically able people can be a double edge sword. You would not have to worry about getting hacked or have your company’s sensitive information be compromised if a company hire the right and able people. On the other hand, these types of people can also access the company’s communication line and compromise both the company and the company’s clients. Young people are also vulnerable into committing theft of time, this is because a lot of young people spend most of their time using social media networks and playing games.
Security Measure: Clustered firewall, Intrusion prevention systems(IPS), behavior monitoring algorithms, Access List, Establishing call routes, Virtual private networks.
Behavior monitoring systems can help the company monitor any abnormalities, suspicious activities, and irregularities of activities that their facilities or systems may be subjected into.
A high-security establishment needs to ensure that only authorized users can access certain parts of the system.
Vulnerabilities: Theft of information, Unauthorized access
In this case the establishment is more vulnerable to internal threats rather than external threats. Since the company has establish a high-security profile, external breaches to their systems would be very difficult. This means that the company would only need to worry about internal threats and factors.
Security Measure: Access control list, Log management software, encryption, biometrics, cipher.
Access control list added with biometric scanning are the best security measure for this problem. Access control list enforces privilege separation between authorized and unauthorized employees. Access are granted only to those who are registered in the computer file system. Including an additional biometric access requirement would add another layer of security to the system.
A private consultant has a contract with a research organization working on highly sensitive issues. He needs to be sure his communications are secure, and some of the documents he sends might be used as legal proof of his recommendations.
Vulnerabilities: Theft of information, computer espionage
The consultant is most vulnerable to external threats since the consultant is sending classified documents on a communication line that may not be safe. Hackers can easily tap into communication lines especially when those communication lines are not highly secured.
Security Measure: Encryption, Intrusion prevention systems(IPS), Virtual private network(VPN)
Intrusion prevention system would enable the private consultant to monitor its communication line. Once an abnormality in the communication line is detected, the attack will be actively blocked. Adding an encryption to the file document would add an additional security layer to the document. Using VPN’s would enable the user to encrypt the connection from an end point to a network, virtual private networks use secure socket layers to authenticate the communication between the device and the network (Types of Security Network, CISCO).
