¶ … companies be held liable?
The issue of whether firms should be held responsible for losses sustained for external attacks on their AIS (accounting information systems) has recently come into sharp focus. On one hand, if a firm has put in place sufficient security measures, then in that case they shouldn't be held liable for any losses incurred in an external attack on their AIS. On the other hand, if a firm is negligent and has failed to put into adequate security controls, then they ought to be held liable for any losses incurred in the event of a successful security attack on their accounting information systems. There are quite a number of different types of attack that can enable access to accounting information systems (AIS), and if a company does not put measures to protect themselves against those attacks, then in the event of a successful attack the relevance and/or reliability of the financial information will be destroyed (Beard & Wen, 2007).
It is my opinion that in the event of a successful attack on a firm's financial systems, lawsuit(s) should be filed against the company. It is the responsibility of every organization to make sure that their AIS are protected against any form of unauthorized external access. On those grounds, every organization should ensure the credibility of their accounting information systems at all times. This paper fully supports the argument that organizations should be held legally...
Organizations should make sure that users' information is secured from unauthorized access, and they should also always make sure that any unauthorized disclosures of confidential information are prevented and/or fought by all means possible. Organizations should also put in place monitoring systems to regularly check their systems to prevent any kind of threats. Firms should also strive to encrypt all their accounting financial information before storage so as to make it hard for any unauthorized user to know the kind of data they have. Where appropriate, organizations should put in place strict access control systems so as to restrict the number of people who have any form of access to their AIS (Layton, 2007).
It is an organization's duty to choose the proper technical, administrative or physical controls on its financial information. Administrative controls serve three main purposes: to screen employees, to disseminate security control policies, and to regularly conduct employee awareness programs. The administrative controls and the technical controls ought to be incorporated in such a manner that any unauthorized users and hackers have only very minimal chances of…
