Threats to Information Security

Information surrounds us all the time; we are immersed in the dense cloud of data that is constantly changing. This data has become a valuable asset, a source of power and wealth for those who possess it. People have begun to hunt for information, new sources of vulnerability have emerged – threats to Information Security. What are they? How dangerous can information be in the wrong hands? What options are there for protection? Find out in our article.

The concepts of "security" and "information threat"

Let's define the basic concepts: information, threat, and security, and what they mean.

Information is a collection of data about any selected subject, phenomenon, process, social object, etc., that can be used to characterise them. The value of information cannot be measured; different data may have different values for different members of society. But one thing is common to all: information definitely has value.

Threat is any intentional or unintentional impact on information with the aim of obtaining and using it to cause harm to the subject of information.

Security is a basic concept of protection against threats to any entity (individual, organisation, state).

General situation regarding Information Security threats

A set of Information Security measures involves several stages to ensure the integrity of the information system. These include preventive measures (aimed at anticipating Information Security incidents), identification and detection of threats (aimed at establishing the exact parameters of a dangerous situation and detecting it within the information system), localisation of threats (limiting criminal impact and eliminating the dangerous situation that has arisen) and mitigation of consequences (measures to restore the integrity of information and the reliability of the Information Security system).

It is important to understand that when an Information Security incident occurs, each measure will be important, as will ensuring a comprehensive and consistent approach to their implementation. However, it is worth agreeing that prevention and warning of an IS incident is much more effective than even the most relevant and modern elimination programme. In the field of Information Security, the rule "prevention is better than cure" is also relevant.

Types of Information Security threats

It is customary to distinguish three main types of threats to Information Security:

1. threats to confidentiality;
2. threats to integrity;
3. threats to denial of service.

Confidentiality threats are the most typical, so to speak, Information Security problems. Ultimately, the nature of information itself requires defining the scope of access to it and establishing confidentiality frameworks. A confidentiality threat is the emergence of the possibility of unauthorised access to and use of information.

Integrity threats are the process of intentionally or deliberately violating the unity and authenticity of information in order to prevent its use in its original form. They can be caused by affecting the information itself or the infrastructure used to store and transmit it.

Threats of denial of service – disruption of the information system with the aim of preventing access to stored information.

What types of threats exist?

There are a large number of threats to Information Security, as many as there are types of information today.

• Threats by target:

• the state;

• businesses;

• private individuals.

By type of intention:

• financial;

• reputational;

• disclosure of intentions.

By threat source:

• outside the information system;

• inside the information system.

By type of damage:

• general;

• local;

• private.

By degree of impact on the information system:

• passive (the structure and content of the system remain unchanged);

• active (the structure and content of the system undergo changes).

Information Security threat groups:

• technical;

• anthropogenic;

• natural.

Threats in the direction of action

Let us consider in more detail the threats to Information Security for the state. In this case, the subject of information is the state as the bearer of confidential data. From the point of view of an object of attention for fraudsters in the information sphere, this is not the most obvious target. The state is represented by a multitude of institutions that ensure the unity and functioning of this political entity: healthcare and logistics facilities, educational institutions, the media, legislative and executive bodies, information centres, and much more. In other words, any institution whose information could pose the threat to the constitutional rights and freedoms of citizens, to the implementation of the country's state policy, to state infrastructure, or to state information networks and systems is a target for attack.

Information Security is an important part of creating a comprehensive national security strategy. This also includes:

• technological;

• production;

• currency and credit;

• raw materials;

• energy;

• environmental;

• information;

• food security.

In order to implement state policy on information space security, it is necessary to take into account potential threats and develop a strategic approach to Information Security. This includes creating and enforcing legislative and government requirements, supporting international and national Information Security policy standards, providing technical and technological support for measures, and implementing training and awareness programmes on Information Security among the population, etc.

Main threats to Information Security for the state:

• information warfare;

• cyber attacks;

• cyber espionage;

• cybercrime;

• cyberterrorism;

• disclosure of state secrets and leakage of other confidential data.

The main tasks of the state, as the primary target of information threats and the main provider of Information Security tools, are to quickly detect and respond to threats to a country, ensure high-quality protection of information boundaries, and create an infrastructure that is friendly to Information Security tools.  

The development of the country's security policy takes into account four important factors that form a comprehensive set of measures. These include:

1. legislative support for measures to protect information for all parties involved in the process;

2. compliance with international and regional Information Security standards;

3. ensuring that the rights and obligations of all participants in the process are respected;

4. creating a secure Information Security framework for the state.

Information Security threats to the enterprise

The company possesses a large amount of sensitive data and is a target for various types of fraudsters. The following data may be of particular interest to hostile parties:

1. databases and information storage systems;

2. file system and its contents;

3. access passwords, user authentication and authorisation data;

4. intellectual property;

5. instructions and descriptions of unique technological processes, etc.

The ways in which confidential information can be obtained at an enterprise correspond to three main groups of security threats and correspond to anthropogenic, technogenic and natural threats.

From a practical point of view, the main threats to Information Security at any level of an enterprise can be:

• the relevance of software and antivirus versions, the use of unlicensed software;

We have written many times about the importance of timely software updates. The latest versions of software take into account the latest security threat data and warn of potential vulnerabilities.

• refusal to differentiate access to information for employees;

Zero Trust models have become popular, where every network participant is considered like a potential threat to Information Security. This is due to emergence of an increasing number of remote services (cloud storage) and the inclusion of workstations outside the organisation's security perimeter (remote working) in an enterprise perimeter.

• intentional or unintentional insider trading;

This is a leak of information due to the fault of individuals within the organisation's security perimeter. It is not always a deliberate action. Often, employees are not even aware that they are sharing prohibited data. To prevent this type of threat, it is necessary to conduct more training and education on Information Security techniques within the company, ensure that rights, duties and responsibilities of each individual are documented, and establish a regime of commercial secrecy.

• use of personal messengers, social networks, email services in the workplace;

The use of personal accounts in a workplace is a common problem for employers. This affects not only an employee's efficiency as an individual (according to a Microsoft study, employees are distracted by social media on average every 10 minutes of working time), but also the overall security profile. As a rule, attention to detail is significantly lower in personal communication, which leads to insider leaks and the transfer of confidential data.

• careless attitude towards information carriers;

Prohibition on the use of Personal Data storage devices, copying of data.

• lack of access updates to workstations.

This is also a common threat. Information Security departments do not always monitor employee credentials in a timely manner. Situations may arise where a dismissed employee connects remotely to their computer. This can lead to information leaks. Alternatively, the security of employee login details and passwords may not be ensured, and everyone has access to each other's workstations.

As a measure to control employees and increase the stability of the entire Information Security system, it is recommended to use Data Loss Prevention (DLP) systems. An example of such a system is Anexet. For more details, see the presentation.

Threats to private information

In many ways, threats of a private nature will overlap with threats to the state or to businesses. These include unlawful acquisition, use and trading of confidential information by third parties.

A major difference for this group of threats is the use of social engineering tools, due to the fact that the ultimate victim of the fraudsters is personalised. It is possible to calculate pressure points, create a psychological profile and use it, track habits and the schedule of use of information sources, and so on.

Social engineering is a set of techniques that exert psychological pressure and manipulate third parties for personal gain.

The main techniques used in social engineering are:

• methods of manipulating emotions;

This method requires creating a psychological profile of the potential victim in advance, planning patterns of behaviour and developing scenarios for responding to these patterns.

• pressure and rush;

This method is very popular among modern telephone scammers, as it is designed to elicit a specific reaction from their victims. It requires a victim to respond quickly to a request so that they are unable to analyse their actions in a timely manner and focus on them.

• expanding the circle of trust.

Another way to obtain confidential information without hacking. The fraudster seeks to approach their future victim, creates a positive image of themselves, and enters their inner circle of acquaintances. This game of trust helps when a victim stops controlling their reactions and relaxes. In this case, the scammer needs to be patient and simply wait for the right moment.

It is important to remember that the protection of Personal Data will always be in the hands of a data subject, and it is primarily the data subject who should be interested in the security of their information. They should also apply methods of protection that are available at home.

Types of Information Security threats by type of intent

Based on their intentions, Information Security threats are usually divided into three types: financial, reputational and disclosure of intentions.

As the name suggests, financial threats are potential Information Security incidents that result in financial damage to the victim.

The financial damage in this case consists of:

1. losses from the assessment of lost information;

2. technological and labour costs for data and infrastructure recovery (equipment costs, payment for related services, employee salaries, etc.);

3. compensation for damages to affected parties.

Reputational damage is a negative impact of an intangible nature that is reflected in a negative change in social relations (decreased trust, lower ratings, etc.). It can be inflicted on the state, organisations and individuals.

The threat of disclosure of intentions is the likelihood of revealing potentially valuable information about intentions to act, consequences of which cannot yet be assessed in financial or reputational terms.

Information Security threats by threat source

Information Security threats are divided into those originating from outside the information system and those originating from within the information system. Outside the information system, threats can originate from hostile entities (competitors, fraudsters, special services, etc.) using various means of intrusion (hardware, software, etc.). Natural disasters and catastrophes are also considered external sources of threats.

Threats within the information system originate from system participants (insiders, dishonest employees, technical problems with equipment, etc.), with insider risks generally considered the most likely within the information system. Let's take a closer look.

Definition of insiders

Insiders are the main category of security risk within the perimeter of the information system. These risks are difficult to calculate because they are difficult to predict and prevent.

Insiders are defined as participants within the internal perimeter of Information Security who intentionally or unintentionally transmit confidential information outside of this perimeter. This category of users is quite broad, as there are many factors, both hidden and obvious, that influence the motives behind their actions.

These include:

• obtaining personal gain;

Insiders deliberately commit crimes in office because it brings them financial or moral benefits.

• interest;

This motive may be triggered by curiosity, the desire to access restricted data in order to enhance one's own experience.

• without motive;

This concerns apathetic, inattentive employees who, through unwillingness or laziness, transmit confidential information outside the security perimeter.

• revenge;

Often, these are employees who are about to be dismissed or hidden aggressors within a team. In such cases, their primary desire will be to maximise a damage to a company.

• psychological issues;

Each participant in the security perimeter is primarily a person with their own psychological problems (which may be personal or provoked), which may affect their motives.

• blackmail;

The goal of insider penetration is to obtain confidential information and then use it for blackmail within a company (employees, management) or outside it.

• political or ideological differences;

This may also be a motive for insider data leaks.

• external pressure.

An object within the security perimeter may itself become the subject of blackmail, with demands to provide data of interest to an external party.

How insiders can be useful to interested parties:

1. An insider is a participant in the security system who has the necessary qualifications and access to confidential information.

2. The insider holds a position and has sufficient qualifications not only to find data, but also to extract it safely and deliver it in the required form.

3. An insider may deviate from the plan, act according to the situation, or wait for a convenient moment to infiltrate. For external infiltration, such luxury is not so readily available.

4. An insider can win over other employees and create a company loyal to the influence.

Countering insiders

As we can see, many advantages work in favour of insiders. They are difficult to identify, they are already inside the information system, they can act covertly, and the true motives of such employees are not always clear. However, this does not mean that the problem should be ignored and the situation left to take its course. A set of measures can help detect insiders and prevent information leaks.

• when hiring;

A potential employer can assess a job applicant as early as the interview stage: evaluate their psychological stability, motivation, request information from previous employers, investigate for offences, and so on. Even this set of actions will weed out the most active and promising potential insiders.

• during operation.

After formal employment, it is important not to neglect either a new employee or an entire team. After all, a potential insider may become motivated while performing their duties, or they may even be a «plant» in an organisation from the outset. The HR department and security staff can carry out the following measures:

• educational (to inform employees about their rights and obligations regarding the preservation of information within the perimeter, as well as the consequences of unlawful actions);

• psychological testing and questionnaires (surveys and testing will help to identify dissatisfied and unreliable employees based on indirect evidence);

• documentary (officially documented policy on Information Security within a company, introduction of a «trade secret» regime);

• Software and hardware (use of technical means to restrict access to information, introduction of an employee authentication system, installation of DLP systems;

• during dismissal. 

This is also an important point, as this period is often the most tense in employer/employee relations. It is necessary to record the transfer of information from the departing employee, especially outside the information system, and ensure the correct termination of the employment relationship.

For more information on how to recognise an insider, read our article.

Information Security threats by threat source and impact on IS

Information Security threats are classified according to the type of damage they cause:

•    general (characteristic of all subjects of information);

•    local (territorially bound or activity-oriented);

•    private (designed to exert direct pressure on a private individual, taking into account individual characteristics of a potential victim).

By degree of impact on the information system:

•    passive (the structure and content of the system remain unchanged);

•    active (the structure and content of the system is subject to change).

Information security threats via unauthorised access channels

One of the most devastating threats to Information Security in terms of destruction and damage is damage caused by unauthorised access.

Unauthorised access (UA) is the unauthorised intrusion into the Information Security system by circumventing approved security rules. There are three types of unauthorised access: personal (through a person), hardware (through the connection of specialised equipment) and software (using software). Let's take a closer look.

Personal channels of the NSD:

• through information carriers (theft, forgery);

• through reading information from visual sources (screenshots, photos and videos, keyloggers);

• through documents (theft, copying);

• through monitoring printouts.

NSD software channels:

• through malicious software and viral content (viruses, spam, spyware);

• through access to account management (IDM);

• DDoS attacks;

• targeted attacks;

• hacking websites and social networks and obtaining administrator rights;

• mobile devices.

Hardware (via electromagnetic, vibroacoustic, visual, and information channels of information leakage).

Risks and threats to Information Security

Often, concepts in Information Security can be equated with each other: personal and private information, risks and threats, and so on. However, these definitions are not always equivalent. While personal and private information are essentially synonymous and define the same type of data from different angles, risks and threats to Information Security cannot be equated. Here's why.

Information Security risks are a set of negative factors that can affect the integrity, availability, and susceptibility of information. In other words, this is an existing real situation. Threats, in turn, are opportunities that arise in the security system to impact information through vulnerabilities. For example: the threat of unauthorised access to files on a computer when a security vulnerability arises (the user has not logged out of their work profile), the threat of a malicious virus being introduced due to a software vulnerability (use of unlicensed software on work computers), and so on.

Thus, Information Security risk can be defined as threats to Information Security that have been exploited. In this case, the formula for Information Security risk would look like this:

Conclusion

Information Security is a broad topic that must be approached consistently and thoughtfully. Information today is a valuable resource that must be protected from internal and external threats. Use all available protection measures and ensure a secure perimeter within your information circle. You may not feel the benefits of this action immediately, but you will definitely appreciate the value of Information Security when risks arise and threats materialise.