Data security threats and control measures

Data and information are the key components in day to day running of any organization in today’s information age. Data security involves protecting data from theft, unauthorized access, and modification. Information is secured to achieve 3 main objectives namely confidentiality, integrity, and availability of data. The process involves securing all hardware, software, networking devices, and any other device involved in storing retrieval, and transmission of data.

Some of the main threats to data are malware, hackers, and employees’ natural catastrophe among others. To secure data organizations can implement control measures that can be used to mitigate the threats. Some of the data security control measures include using updated antivirus, encryption, firewalls, user access right, and user training among other controls discussed in the article.

Data and information threats

A threat to data is any act that can compromise the confidentiality, integrity, and accessibility (CIA) of data and information. Data that is stored or transmitted has several threats which include the following:

1. Malware programs

These are programs that are developed to disrupt the normal operation of the computer. They can be computer worms that can replicate themselves and take up the computer memory. Trojan horses disguise themselves as good software but behind the user’s knowledge, they are destroying other useful programs. Malware is a threat to data because it can destroy it completely which means we need a way to stop these threats.

2. Hackers

These are individuals who try to access other people or organizations’ computers without authorization. They can range from computer novices who just learn a new code on the internet and want to try to those professional hackers who know what they are doing.

Professional hackers can even hide their tracks. Some hackers do what they do some just for fun while others, try and see how far they can go. The most serious hackers use information collected to harm other people or organizations. 

Yet others are activists who want to force the government or organization to do what they want or they believe information should be free, so they get hidden information and give it to the public like wiki leaks.

3. Insider threat (employees)

The weakest point of any system is the human point. Organization employees can be a threat to data if they don’t follow the ICT policies set aside for that organization. If policies like changing the password after one month and the length of the password are not followed and the company data is accessed by unauthorized personnel then that employee becomes a threat to that system.

ICT personnel who have more system access rights can also compromise the system if they are fired or have disagreements with management. This makes them the main threat to the system within the organization.

4. Natural disasters and calamities

These include factors like fire, floods, earthquakes, or any other disaster that humanity has no control over. When these events come and they destroy the main computer and data they become threats. 

This can be reduced by ensuring that there is an offsite data backup. Also, the organization can invest in equipment to fight some of these disasters like a fire extinguisher or having a server room on the upper floor where floods cannot reach quickly.

5. Ransomware

These are types of malware where hackers compromise the system and demand payment ramson before giving back control. These kinds of attacks mostly happen when systems are connected over the internet.

6. Social engineering

This is where the attacker depends on interacting with the target person to collect data without the victim’s realizing. In social engineering, hackers will try to ask for personal data that may not seem sensitive but can be used to compromise the system.

7. Systems loopholes

When systems are developed they are not perfect but have errors and bugs. Security bugs should be prioritized to ensure they are not used as a gateway to the system. Always ensure you use the latest version of the system.

Control measures data from threats.

1. Data encryption

Encryption is a method of coding a message in a way that only the computer or user who knows how the coding was done can be able to encode and read the message. Mostly when transmitting messages over the network there is a probability that a message can be intercepted on the way and confidential information acquired illegally. To avoid this data can be encrypted when it is being stored and transmitted so that even if it lands in the hand of another user will be unusable.  

The encryption process involves the sender creating a cipher text out of the plain text by encrypting then the message is transmitted and when it reaches the destination device the cipher text is then encrypted back to plain text so that the user can read the message.

2. Physical protection

This involves protecting the room or the space where the data is stored together with the computers and other information devices that are there. The protection can include among others installing CCTV cameras to monitor the room, an intruder detector, locking the room, limiting users who can access the data room, using biometrics to access the server room, etc.

3. Firewalls

A firewall is used to protect a private network from protocols and services that can be abused by hosts outside the private network such as the internet to harm the devices. For a firewall to be effective the user needs to set the rules that will be used to filter the required services from those that will be denied access. A firewall is as good as the rules that are set.

A good firewall should only permit traffics that is authorized and it must withstand any attack against itself since it has nothing to protect it. Also, all communication to and from the private network should pass through the firewall.

4. Data backup

This involves creating a copy of the data and keeping it save in another location from the main data that is in use. You can keep the data in the same disk but different partition but the problem is if the hard disk crashes it goes even with your back up hence recovery is not possible.

The backup can be made on a different disk then the disk is stored in the same physical location (building or room, onsite backup). The problem with this is that in case of a natural disaster threat discussed early happening you lose both data and its backup.

The recommended type of data backup is to store it in different locations (offsite backup) so that if you lose data you can go and pick the backup and restore data. Today this can be implemented by using cloud computing backup services such as Google Cloud

5. Up-to-date antivirus software

Antivirus programs are used to scan, detect and remove malware threats from the computer. There are many Antivirus software from different vendors some for free others for a fee i.e. Kaspersky, Norton, Avast, etc. Antivirus protects data by ensuring the computer with data is protected from all malware.

6. System user training

This involves training employees on how to ensure they follow the ICT policies to ensure that the company systems are not vulnerable because of their carelessness. When the users are trained they can observe security procedure that ensures that the systems are secure and mitigate data threats.

7. Use of passwords and usernames.

Each system user should have a unique username and password that they use to log in to the system. This will ensure that only authorized users have access to the system. Again the system log can record any change made by the user within the system for accountability.

8. Assigning user access rights

System users should be assigned rights and system privileges depending on what they use the system for. System administrators have the highest right compared to the general system user who can only view the data but cannot change it.

Advantages of data security in organizations

1. Data confidentiality

When data is secure the users are assured that the information that is supposed to be confidential and private will remain that. With organizations having to guard their sensitive data such as product design, formulae, and other company secrets data protection mechanism comes in hard to enable achieve this objective.

2. Help achieve data integrity

Data integrity means that data changes are done only by authorized personnel. Securing data ensures this is met and the integrity of data is observed to the maximum possible. Integrity can also mean ensuring that data is not interrupted before it is saved to the database or any other because that can create inconsistent data in a database.

3. Data is available to the authorized users

When data is secured it means it can be accessed by authorized people without the fear of unauthorized persons accessing the same. Information is useless if it is not available when needed and to the right people. Securing data ensures that attacks such as denial of service never happen which means data will be available all the time.

4. Access control

By securing data the administrator can be able to control the access level of each user by assigning roles depending on the type and confidentiality of data that they need to access. It makes system management effective and efficient.

5. Competitive edge over competitors

When an organization has secured its data it has an upper hand compared to competitors whose data is exposed. Secure data create confidence with customers and business partner to continue doing business. They are sure the data they share with the company is safe from third parties misuse.

Challenges of data security

Organizations are prioritizing data security since most operations are done in the cloud. However, still there are many drawbacks to the implementation of data security control.

1. The weakest point of data security is the user point. Users of the system are the main challenge when it comes to securing data. Careless users regarding data and computer security mean they leave their computer logged in, and they can be vulnerable to social engineering among other threats.
2. Public cloud computing services that are offered over the internet are another challenge to data security. 
3. Implementing data security procedures is expensive for small organizations or individuals to implement.
4. New technologies are coming up every day which means security should be evolving together with the new technology. This is not possible which exposes the system to data threats.
5. Most small and medium companies don’t have recovery methods when an attack occurs which is the main challenge. Some companies take backup but don’t have a procedure on how to restore the same in case of an attack that affects the main system. 
6. It requires a data security expert to configure security systems and do the monitoring. Most organizations are not ready to employ such specialists for the work.
7. Different countries have different laws that deal with data security. This becomes a challenge since data is stored in the cloud.