Business threats, risks, and organizational security management strategies

Assets Threats

Assets and Threats-What is at risk?

Assets and Threats Defined

Origins of Business Threats/Types of Threats

Reconnaissance Threats

Denial of Service

Data Manipulation

Other Threats

Internal Vs. External Threats

Techniques For Preventing Attacks

How Do Natural Threats Pose A Risk

Best Measures to Protect Assets

Assets and Threats-What is at risk?

Studies suggest that threat assessment is increasingly important within the organizational context (Grassie, 2000; Schwartz, 2003). More and more organizations are faced with low probability yet high consequence threats that often result from technological advances enabling internal and external forces to attack information systems (Grassie, 2000). While all threats do not necessarily pose a risk to an organization, organizations must work to at minimum recognize potential threats and take measures to protect themselves from threats.

The purpose of this paper is an examination of typical business threats and risks and identify what steps an organization must take to identify and protect themselves from threats when considering a security risk management program. To accomplish this the researcher will examine (1) what types of business threats exist (2) what steps organizations can take to successfully mitigate risks and (3) what changes are needed in organizational structure or daily activities to prevent future risks.

In examining these issues it is important to differentiate threats from risks. Threats are potential negative forces that may impact an organizations bottom line or productivity; risks are more "probably oriented" and "business oriented" and involve the level of threat that actually exists within an organization (Grassie, 2000). Analysis of the two go hand in hand when examining an organizations risk in the short- and long-term.

Background to the Problem

Studies suggest that the cost of confidential information stolen from businesses including Fortune 1000 companies in recent years has exceeded 100 billion dollars every year (Schwartz, 2003; Sozio & Drab, 2001). Rapid technological advances have enabled ordinary hackers to acquire inexpensive surveillance and data manipulation equipment that has resulted in countless attacks on corporate and private computer systems (Schwartz, 2003; Sozio & Drab, 2001).

Fortunately organizations can adopt multiple strategies to minimize their risk. The primary step an organization must take to protect its assets is risk analysis (Grassie, 2000). Risk analysis enables an organization to determine what internal and external threats may exist within the organizational context. Risk analysis should be conducted comprehensively to include valuing assets within the organization, measuring past threats, measuring relative exposure to current threats and identifying opportunities for future threats to the organization (Grassie, 2000).

Significance of Problem

There are multiple threats that exist in society today capable of incapacitating an organization (Grassie, 2000; Schwartz, 2003). These threats if not identified early on lead to continuing business risk and the potential for catastrophic destruction of an organizations assets, including information systems, organization systems and even people within the organization.

Both internal and external threats are increasing in number as rapid technological advances provide opportunists with more ways to access organizational systems. It is important more than ever that organization work to identify with threats are plausible and develop security programs that will minimize the likelihood that a threat or catastrophe will occur in the near future.

Literature Review

Assets and Threats Defined

Shimonski (2005) defines a threat as "an expression of an intention to inflict pain, injury, evil or punishment" or "an indication of impending danger or harm" (1). An asset is anything an organization considers as "useful or valuable," whether a resource or an advantage (Shimonski, 2005). An asset is something an organization works to protect. Assets within an organization may include the systems used within an organization, the people that work within an organization and the data that systems within an organization contain (Shimonski, 2005). It is not enough for an organization to consider one vs. another; rather an organization must consider all three an essential aspect of business practice.

Origins of Business Threats/Types of Threats

Business threats can occur internally and externally. It is anything that might threaten an organizations computer networks, systems or people (Shimonski, 2005). There are unique threats that go hand in hand with each of the primary assets an organization holds dear. Shimonski (2005) outlines several categories of threat that present within an organization. These include (1) recon or reconnaissance threats, (2) DoS or Denial of Service threats and (3) data manipulation threats (Shimonski, 2005). Each of these threats are unique and deserve careful examination.

Reconnaissance Threats

"recon" attack occurs when an individual attempts to ascertain whether your network or system exists and subsequently tries to map your system possibly for planning future attacks (Shimonski, 2005). Often referred to as a probing, this form of attack involves searching for vulnerabilities within the system, which is usually accomplished via scanning systems in open ports, using ping commands or performing ping sweeps (Shimonski, 2005). Tools used to sweep systems are freely available on the web thus anyone can access them and use them to hack your computer of system (Shimonski, 2005).

Denial of Service

This is a serious attack that is easy to carry out. It is an attack against a system that will prevent the system from carrying out common functions (Shimonski, 2005). Microsoft systems generally offer multiple windows of opportunity for DoS attacks. DoS attacks can target an Internet access router or your PC with Trojans, utilizing a computers CPU and preventing proper functioning (Shimonski, 2005; Grassie, 2000).

Data Manipulation

This is an even larger threat today particularly for organizations that rely on data to perform day-to-day business (Garcia, 2000). Data manipulation can be attacked internally (via a disgruntled employee) or externally (Shimonski, 2005; Grassie, 2000). An attacker can also intercept traffic between two PC's and manipulate or exploit, change and modify records in this way (Shimonski, 2005). Failure to protect this data can result in extreme legal measures, thus it makes more sense to protect data rather than subject oneself to the consequences of a hack attack on data (Grassie, 2000. Organization should work to identify whether design-based threats are real and probably or highly likely as part of business security risk analysis measures (Grassie, 2000).

Other Threats

Every organization has a responsibility to protect data, which includes organizational records. Organizations rely on data to "analyze, reduce and eliminate business risks including new ventures, losses or loss of business (Sampson, 1992). There are multiple steps an organization can take to help protect data within the organization.

Specific types of threats that are technology oriented and may enable data manipulation, recon or denial of service include the following:

Key logger systems or other technologies that allow individuals to gather encrypted computer data and use them at their disposal (Schwartz, 2003).

Carnivore, a communications traffic analyzer type software that can allow someone to scan email messages within streams of information, and uses a filter to capture desired text or email addresses, whether encrypted or not (Schwartz, 2003). This program is actually developed by the FBI who claims access is guarded, but similar programs exist that allow individuals to scan emails and collect desired information.

Password retrieving software that hackers can use to gain access to passwords necessary to break encryption systems (Schwartz, 2005). One example is KLS, which requires a hacker have physical access to the computer, suggesting an internal threat. This program specifically exploits "some of the same weaknesses in popular commercial software that allow hackers to break into computers" (Schwartz, 163).

Text collectors that collect information including online conversations that travel from computer to computer (Schwartz, 2003).

Many systems mentioned above are actually hacking systems developed by government agencies for surveillance operations; the fact that the technology exists in some form or another however suggests tat it is open to exploitation (Schwartz, 2003). Even 'fair use' of such systems may cause excessive anxiety and accusations of espionage or spying (Schwartz, 2003).

How Do Natural Threats Pose A Risk

Natural disasters pose just as much risk to organizations as man created threats (Sampson, 1992). Flood, fire, hurricanes and other natural disasters can result in serious damage to an organizations computer system, database and paper records (Sampson, 1992). Whereas an organization can take steps to prevent an external hacker from accessing their computer system, it is much more difficult to predict natural threats within an organization context.

Natural disasters can also have a domino effect enabling opportunists or hackers to penetrate a system. For example, fiber optic cables lost in a storm or power outages can allow computer viruses to attack (Sampson, 1992). To help mitigate such natural disasters it is vital that organizations prepare disaster mitigation or relief plans to address the heavy losses that may occur in the event catastrophe occurs (Sampson, 1992). Most government agencies and financial institutions already require an emergency disaster plan be in place in the event a natural disaster occurs (Sampson, 1992). The focus of the plan should be ensuring that an organization can continue to operate despite a catastrophic event; protection may include adequate insurance coverage and obtaining back up records (Sampson, 1992).

Other threats an organization must consider include catastrophic threats that may result from terrorist attacks (Grassie, 2000). While this is more often a concern among government agencies and financial institutions, all businesses should be aware of the potential for terrorist threats, which can "dramatically change the outcome of risk analysis" (Grassie, 2000).

Best Measures to Protect Assets

Schwartz (2003) suggests that an organizations information assets are the most important to protect because an organizations bottom line success is "linked to these information assets" (163). Further he suggests that any given technology is supported or "described by" information assets and this reliance on information assets in itself may pose security threats (Schwartz, 163).

Technology breakthroughs are occurring daily that often undermine previous measures to protect information assets, thus it is not enough for an organization to adopt the latest technology (Schwartz, 2003). Rather, an organization must work toward continuous improvements, which will result in ever evolving measures to ensure organizational security over time.

To protect human assets within the organization a corporation must also engage in cultural security measures. Culture is an important determinant of "whether and how remote risks are considered in actual protection applications" (Grassie, 136). Every company has a unique culture that determines what actions are acceptable and what are not; an organization that embraces an open environment that is knowledgeable of security measures and tolerates only "limited security restrictions" is prone to different threats than an organization that embraces only tight security measures (Grassie, 136). In an open environment organizations are less likely to devote resources to protect itself from low probability but high-risk threats (Grassie, 2000). An organizations past risk history may also determine what procedures are put into place to mitigate risk. A workplace that exhibits more "antisocial behaviors" is more likely to be at risk than an organization that is more cohesive (Grassie, 2000).

Garcia (2000) suggests that organizations take into consideration what assets require protection; these may include physical assets such as communications equipment, computer networks, information assets, human resource databases, proprietary formulas and even "strategic planning information" (44). Personnel and visitors are also assets however requiring protection in the organizational context (Garcia, 2000).

Methods

The intent of the research in this study is to examine what (1) what types of business threats exist (2) what steps organizations can take to successfully mitigate risks and (3) what changes are needed in organizational structure or daily activities to prevent future threats from posing serious risk or consequence. To accomplish this feat the researcher engaged in qualitative methods that help explain how people "define their needs" and why or how they "seek assistance" given a particularly phenomena (Darlington & Scott, 2002).

Particularly the researcher was interested in surveying the current literature that exists with respect to assets and threat management to determine what organizations are doing correctly to help mitigate risk. Methods employed for this study include data collection, observation and documentation analysis of multiple studies conducted previously analyzing security risk management within organizations (Darlington & Scott, 2002). From the data colleted the researcher then disseminated findings by carefully comparing and synthesizing the information gathered from the literature review.

Because the research is qualitative in nature it is difficult to generalize the findings of the research across all settings. While the researchers acknowledges this limitation, the researcher did take steps to obtain data that would provide the reader with "sufficient information" regarding the phenomena at hand using data gathered that as best as possible can be generalized to a majority of organization in similar settings (Darlington & Scott, 2002). The researcher aimed to gather data that included samples representative of the phenomena in general so that a better understanding of the phenomenon being investigated (assets and threats) could be calculated.

Conclusions

As technology continues to advance more and more organizations are relying on information systems to manage complex data transfers. While this enables organizational efficiency in most cases, it also poses increasing threats to organizational systems and other assets within an organization. An organizations assets are its lifeline, thus it is more important than ever than organizations adopt practices that will ensure the safety and well being of all assets within the organization, large and small.

Much of the threats and risks that exist within an organization result from internal and external forces. Fortunately there are a number of steps organizations can take to mitigate potential risks and threats. Organization must work to develop access controls, intrusion detection and other complete systems designed and installed to protect assets against risks (Garcia, 2000). Such tools are best utilized after an organization has engaged in proper risk analysis (Garcia, 2000). In a rapidly changing and dynamic work environment where technology systems are advancing at a phenomenal pace, organizations simply can't afford not to adopt measures to protect their assets. Assets come in many forms, and include an organizations information systems, organizational systems and people (Garcia, 2000; Grassie, 2000; Schwartz, 2003; Sampson, 1992).

All of these assets must be considered when analyzing risk within the organization. True security and protection can be achieved when organizations appropriately allocate resources to the most pressing threats within an organizational context (Garcia, 2000). For an organization to identify what threats are most pressing they must first assess what threats exist, how likely each of those threats are to result in probable loss, what the consequences of a loss would be and how much it would cost to protect the organization from such losses (Garcia, 2000).

There are multiple internal and external threats that exist within the organizational context. Each is handled in a different manner. For an organization to successfully mitigate risk and manage threats it must take several steps. Based on the research reviewed the following steps are most important for mitigating risk and protecting assets within the organization: (1) performing an internal audit that identifies assets within the organization, (2) identifying the value of assets and the costs of losing assets, (3) identifying known risks and potential threats in the present and future, (4) identifying resources that can be allocated to risk management, (5) developing security risk management programs to protect assets, (6) developing emergency plans to enable a business to continue should a catastrophic threat devastate an organizations assets. It is also important that an organization takes into consideration its people and culture and adopt an environment that promotes security risk management from the top down. Ultimately this will help minimize potential risks and enable a safer and more secure work environment.