Need for Information Security and Threats to Information Systems

1. Need for Information Security

Today, Information is the most valuable asset of any organization—even more valuable than its office buildings or furniture! If a bank’s building catches fire, insurance can rebuild the walls; but if the bank’s database of customer account balances is wiped out or stolen, the bank will collapse overnight.

Top 5 Core Reasons Why Organizations Need Information Security:

1. Protecting Critical Data Assets: Intellectual property, formulas, student marks, medical records, and financial data must be protected from theft or corruption.
2. Ensuring Business Continuity: Prevents hackers or ransomware from halting daily factory, hospital, or banking operations.
3. Enabling Safe Technology Adoption: Without information security, companies could never safely use Cloud Computing, Work-from-Home VPNs, or Mobile Banking.
4. Protecting Customer Privacy & Brand Reputation: Prevents embarrassing data leaks that destroy customer trust and crash company stock prices.
5. Complying with Cyber Laws: Mandatory under the Indian IT Act 2000, RBI cybersecurity guidelines, and GDPR/DPDP privacy laws.

2. Threats to Information Systems

What is a Threat?

In cyber security, a Threat is any potential danger, event, person, or circumstance that has the power to exploit a weakness (Vulnerability) in an Information System and cause harm, loss, or damage to an organization’s assets.

Classification of Threats to Information Systems

All threats to an Information System are broadly divided into 4 major categories:

Category 1: Malicious Software (Malware) Threats — Must Know Differences!

1. Computer Virus:
   • A malicious code fragment that attaches itself to a clean host file (like an .exe or .docx file).
   • Key trait: It requires human action (like double-clicking the infected file or sharing a USB drive) to run and spread!
2. Worm:
   • Unlike a virus, a Worm is a standalone program that does NOT need a host file or human clicks!
   • It automatically self-replicates and spreads across computer networks on its own by exploiting network vulnerabilities, consuming huge bandwidth.
3. Trojan Horse:
   • A malicious program that disguises itself as a legitimate, useful, or free software (like a free PDF converter or cracked game).
   • Once you install it, it secretly opens a Backdoor allowing a hacker to control your PC remotely. (Does not self-replicate).
4. Ransomware:
   • Locks all files on an Information System using strong encryption and displays a timer demanding a ransom payment (usually in Bitcoin) in exchange for the decryption key.
5. Spyware & Keyloggers:
   • Secretly runs in the background, recording every keystroke you type on your keyboard (Keylogger) to steal your bank passwords and credit card numbers.
6. Logic Bomb:
   • Secret malicious code planted inside company software (often by an insider programmer) that stays sleeping until a specific trigger condition is met (e.g., “On Friday the 13th, or if my employee ID is deleted from payroll, wipe the company database!”).

Category 2: Human Threats (Insider vs. Outsider & Social Engineering)

1. Accidental Human Errors (Careless Employees):
   Over 80% of security incidents start with human mistakes—writing passwords on sticky notes, sending confidential files to the wrong email address, or misconfiguring cloud databases.
2. Malicious Insiders:
   Current or former employees, contractors, or guards who already have valid login passwords and abuse their access to steal customer data or sabotage servers.
3. Social Engineering (Hacking the Human Mind):
   Instead of hacking a firewall, the attacker tricks a human employee into handing over passwords:
   • Phishing / Vishing: Fake emails or phone calls pretending to be the bank or IT support desk.
   • Shoulder Surfing: Secretly looking over someone’s shoulder while they type their ATM PIN or password.
   • Tailgating: Walking closely behind an authorized employee through a biometric office door without swiping an ID card.

Category 3: Network and Software Application Threats

• SQL Injection (SQLi): Typing malicious database commands into a website’s login box to dump the entire database.
• Cross-Site Scripting (XSS): Injecting malicious JavaScript into a web page viewed by other users.
• DoS / DDoS Attacks: Crashing the information system’s server by flooding it with fake traffic.

Category 4: Physical, Hardware, and Environmental Threats (Non-Human)

• Natural Disasters: Earthquakes, floods, lightning strikes, or fires destroying the server room.
• Hardware & Power Failures: Hard disk crashes, motherboard failure, power blackouts, or air-conditioning failure causing servers to overheat.
• Physical Theft: Thieves physically breaking into an office and stealing laptops or server hard drives.

💡 DAVV Exam Preparation Tips

10-Mark Question: “Why is there a need for Information Security? Explain the various threats to Information Systems in detail.”

• Write 5 clear points on the Need for Information Security.
• Classify threats into 4 categories: Malware Threats, Human/Social Engineering Threats, Network/Software Threats, and Physical/Environmental Threats.
• Clearly differentiate between Virus (needs host file + human action), Worm (standalone, self-replicates across network), and Trojan Horse (disguised as useful app, opens backdoor).