Introduction
Software information systems are vulnerable to many threats. These security threats can be caused by various reasons such as natural disasters, technical failures, unintentional acts such as negligence of the users, deliberate acts and management failures. These threats can have serious financial and privacy issues in the information system especially in a health care setting. Furthermore, the data of the patients can becomes mixed up due to the security issues. Additionally, computer viruses that affect the health care information systems are one of the most common forms of security threats that the information systems face.
Information security policies form the first line of defense against security threats. If there were cases of no security threats, there would be no need of having information system policies. Furthermore, having a policy is necessary to ensure that all personnel in the organization adhere to correct organization procedures. The information security helps to provide counter measures for any security threat that might develop.
Information System Security Threats
Unintentional Acts
Human errors form the major threat type in the form of unintentional acts. Individuals who are not properly trained in using the software application tool are more likely to make errors that may compromise the security of the information system (Rainer and Cegielski, 2010). Most of the human errors result from laziness, carelessness, and lack of knowledge on issues of information security. Furthermore, if the employees using the computers have not properly secured their passwords, unauthorized individuals may hack their computers and access the software application tool. Careless internet surfing can result in malware accessing the software application. This can result to cases of data mining where the attackers are able to access the records stored in the software application and can be able to manipulate them. An attacker can trick the employee to provide passwords of the software application (Rainer and Cegielski, 2010). This is what is referred to as social engineering. Moreover, thumb drives used by the employees may contain Trojan horse programs that may compromise the system. If the thumb drives are not scanned by security software, the Trojan horse program can gather data on s and passwords, which the attacker can use to compromise the information system. Power failure may also compromise the system. Other unintentional acts that may compromise the system include technological obsolescence and software failures. According to Samy and Ahmad (2009), having an outdated system software or failure to update constantly a software application can be a major security threat. Additionally the application software may fail.
Deliberate Acts
Software attacks forms the most common threat to the security of an information system such as CPAT. Malware attacks are normally motivated by the desire to make money. Examples of software attacks may include viruses, which may compromise the operation of the software application using a malicious computer code. Worm is a software attack in the form of a code that can replicate itself and will perform malicious functions on the software application. Trojan horse, which was mentioned earlier, is a form of a software program that can be able to hide itself in other computer programs and show the designed behavior when activated.
Denial Threats
According to Kim and Solomon (2010), the most common denial threat is the denial of service attack, which is responsible for preventing users from using the software application. What makes an information system vulnerable to a denial of service attack is the connection to the Internet. The denial of service attack can be modified to form a security threat referred to as the distributed denial of service attack. According to Rainer and Cegielski (2010), the distributed denial of service attack makes uses of malicious software in several computers to form what is referred to as bots. These bots can be used to send an information request to a target computer with the software application causing it to crash in the process.
Organization’s information-system policies for threat management
An organization’s information system policy needs to provide guidelines on the acceptable procedures and behavior when using software applications and the Internet in an organization. The absence of an information system policy for security management may cause more security problems for the organization. This is because such policies usually provide a form of procedure in terms of responding to security threats. An organization needs to have a form of an information security evaluation to identify the potential security threats that may affect the organization’s system. Such an evaluation is responsible for identifying the information risks, analyzing the risk to establish priorities and plan on how to protect and improve the security of the system. This implies that most of these activities are a form of guidelines to improving security measures.
The organization seems to have e well defined information system policy for threat management. The information system policy provides guidelines on the conduct of using the software application. It clearly indicates the individual who have the authorization to use the software application.
Despite the fact that the organization seems to have an information system policy for threat management, it becomes important for the organization to review constantly the information policy. This is because security threats to software applications change quickly because of the increasing changing in technology. The policy needs to have an updated list if threats and potential threats, failure to having such a list may compromise a system, as the organization will have not developed a form of risk management strategy in case the system is compromised by a new threat. Training of the personnel is essential to ensure that all procedures in the operation of the system are in accordance with the predefined policies and procedures. A problem with many organizations information polices is the lack of updating the guidelines and standards to suit current system threats to software applications. Thus, organizations need to continuously review and test security rules and controls to ensure that proper strategies can be applied in case of a security threat.
Evidence-based Threat Solutions
Social Engineering Attack Solution
Understanding and prevention of social engineering requires the application of mapping of the information system that may help in reducing the social engineering threats. Mann (2010) provides a methodology of mapping the information systems. This methodology involves the understanding the threats of the information, assessment of the strength of the people and identification of systemic protection levels. Once this is done, mapping the systems will give a visual indication of different systems. Social engineering is best addressed by increasing security awareness on how attackers use social engineering to compromise the security of systems. If the employees develop a security awareness culture they can be able to successfully prevent further social engineering attacks.
Denial of Service Attacks Solution
Service attacks such as the denial of service attack can be prevented. According to Chakrabarti (2007), solutions to denial of service attacks can be either preventative or reactive. Preventative solutions are mainly precautionary measures. These include filtering, location hiding and intrusion detection systems. Reactive solutions include logging and packet marking.
Malicious software
Malicious software includes viruses, worm, Trojan horses, and spywares. The best approach to handle viruses is to ensure that the information system of the organization is ensuring that an antivirus program is installed in the system. Ensuring that the system has a firewall installed blocks the entry of worms and Trojan horses in the system.
Human Errors
Threats to security system attributed to human errors most because of carelessness or laziness can be addressed through proper training of personnel and ensuring that security policy guidelines are followed effectively. Ongoing training can be an effective means of ensuring that employees have all the knowledge on tools used in the different software applications. Furthermore, this can help increase accountability of the different personnel.
Technological Obsolescence
The best approach to prevent security threats attributed to technological issues is to ensure that the software is frequently updated. Software patches that are not updated can provide avenues for hackers to access system files or compromise the system.
Conclusion
In the current world, technological advancement is increasing at a high rate and this implies that more and more security challenges develop every day, organization need to endure that the information security polices they develop are enforceable and effective in ensuring the security of information systems.
References
Mann, I. (2010). Hacking the Human: Social Engineering Techniques and Security Countermeasures. Burlington: Gower Publishing.
Chakrabarti, A. (2007). Grid Computing Security. New York: Springer.
Kim, D., & Solomon, M. (2012). Fundamentals of information systems security. Sudbury, Mass.: Jones & Bartlett Learning.
Rainer, R. K., & Cegielski, C. G. (2010). Introduction to information systems: enabling and transforming business. (3rd ed.). Hoboken, N.J.: Wiley.
Samy, G. and Ahmad, R. (2009). Threats to Health Information Security (http://www.ccf.org.cn/resources/1190201776262/2011/06/30/P10138301.pdf
