This paper examines the major categories of IT security vulnerabilities that organizations face and proposes corresponding solutions for each. Drawing primarily on Gerhard Eschelbeck's research and the RAND Vulnerability Assessment and Mitigation Methodology, the paper identifies three generations of external threats — from early macro viruses to fast-propagating worms — alongside internal, physical, cyber, and human/social vulnerabilities. For each threat category, the paper outlines practical countermeasures including antivirus maintenance, network auditing, patch management, firewalls, standardized cyber-threat language, and employee training programs. The discussion highlights the evolving complexity of information security risks and the need for layered, continuously updated defenses.
In the past, the worst threat to an information system was a natural disaster capable of destroying all stored data. Today, however, the category of risks has become thoroughly diversified. Because of the increasing use of information systems as data storage and processing tools, it has become ever more important to provide suitable solutions for each type of threat. This paper presents a series of problems one may face when ensuring IT security in an organization, together with a set of corresponding solutions. Both external and internal vulnerabilities are addressed, as well as cyber, physical, and social ones.
According to a study by Gerhard Eschelbeck,[1] there are several generations of external threats and vulnerabilities worth discussing.
First Generation threats comprise external virus attacks, generally delivered by email or through file sharing. The main characteristic of these attacks is that human action is required for the virus to be replicated and spread to other computers. Examples from this category include the Melissa Macro virus, the LoveLetter VBScript worm, and the SoBig virus.
Second Generation threats refer to "active worms leveraging system and application vulnerabilities."[2] Viruses and Trojans are major representatives of this category, characterized by automatic replication and spreading. Common examples include the Slapper worm, the SQL Slammer worm, and the Blaster worm.
Third Generation external threats are much more difficult to handle. Viruses and worms in this category are far more insidious: they target viable potential victims in advance and, as a result, propagate much faster. These targets include Instant Messaging and Voice-over-IP systems. Even more concerning, traditional defenses are not always fully effective against these threats.
In terms of internal vulnerabilities, many appear to originate from Microsoft. According to Eschelbeck, the top ten internal vulnerabilities are all Microsoft-related.
Eschelbeck proposes several actions to be taken against viruses and worms: keeping antivirus software up to date, conducting "regular security audits of networks and systems,"[3] implementing patch management, and continuously evaluating and receiving constant feedback on the organization's security policy.
The first solution is directly related to the continuous evolution of viruses and worms, which are direct threats to information systems. Many antivirus programs receive regular updates for new viruses; however, it is often the case that the program itself needs to be updated or replaced with a more capable one. A Norton Antivirus application created ten years ago, for example, will no longer be adequate despite updates to its virus database.
The second action involves "network audit solutions and systems."[4] These are complex management systems implemented to spot potential vulnerabilities in a timely manner, install and update patches where needed, and flag the need for any updates to the security system.
Patch management involves identifying possible software breaches and failures and intervening promptly to resolve them through a "timely and consistent remediation process."[5]
Finally, ongoing evaluation and constant feedback regarding the security policy is an overarching concept and mechanism that encompasses all three measures described above.
"Hardware, software, and procedural vulnerability types"
"Firewalls, common language, and employee training"
4. IT Physical Security. NCI Information Systems release. Available at www.nciinc.com/solutions/nciitphyssecurityfinal.pdf
5. Anton, Philip; Anderson, Robert; Mesic, Richard. The Vulnerability Assessment and Mitigation Methodology. National Defense Research Institute. September. Available at http://www.rand.org/publications/MR/MR1601/MR1601.pdf
You’re 54% through this paper. Sign up to read the remaining 2 sections.
Sign Up Now — Instant Access Already a member? Log inAlways verify citation format against your institution’s current style guide requirements.