Page 56 - CITS - Computer Software Application -TT

COMPUTER SOFTWARE APPLICATION - CITS

Examples of Internal Intrusions:
1 Data Theft: An employee with access to sensitive customer information steals this data to sell or use for
personal gain.

2 Sabotage: A disgruntled employee intentionally disrupts critical systems or services to cause harm to the
organization.
3 Unauthorized Access: An insider uses their privileges to access information or systems beyond their job
responsibilities.
4 Unintentional Data Exposure: An employee inadvertently sends sensitive information to the wrong recipients
or leaves confidential documents in a public area.

5 Insider Trading: In the context of financial markets, employees or individuals with access to confidential
financial information trade securities based on that information before it becomes public.
Mitigating Internal Intrusions:

To address internal intrusions, organizations can implement the following measures:
1 Access Controls: Implement the principle of least privilege, where individuals are given the minimum access
required to perform their job tasks.
2 User Monitoring: Implement monitoring systems that track and log user activities to detect unusual or
unauthorized behavior.
3 User Behavior Analytics: Use advanced analytics to detect anomalies in user behavior that might indicate
malicious intent.
4 Regular Training: Provide cybersecurity awareness training to employees to educate them about security
best practices and the potential risks of insider threats.
5 Whistleblower Programs: Establish mechanisms for employees to report suspicious activities without fear of
retaliation.
6 Separation of Duties: Divide tasks and responsibilities among multiple individuals to prevent a single
individual from having excessive control.
7 Data Loss Prevention (DLP): Implement DLP tools to monitor and control the movement of sensitive data
within and outside the organization.
8 Incident Response Plan: Develop a plan to respond to insider threats, including protocols for investigating
and addressing incidents.
By combining technical controls, policies, user education, and monitoring, organizations can reduce the risk of
internal intrusions and effectively manage insider threats to their systems, data, and operations.
Preventing and Responding to Intrusions:
• Security Measures: Implement a robust set of security measures, including firewalls, intrusion detection/
prevention systems, access controls, and encryption.
• Regular Updates: Keep all software, operating systems, and applications up-to-date with the latest security
patches.
• User Training: Educate users about security best practices, such as recognizing phishing emails and avoiding
suspicious downloads.

• Multi-Factor Authentication (MFA): Require multiple forms of verification for accessing sensitive systems or
data.
• Incident Response Plan: Develop a well-defined plan to respond to security incidents effectively. This includes
isolating affected systems, analyzing the extent of the breach, and notifying relevant parties.
• Monitoring and Logging: Regularly monitor network and system logs to detect unusual activities. Timely
detection can help mitigate potential damage.

• Vulnerability Management: Regularly assess and address vulnerabilities within the organization’s
infrastructure.

43

CITS : IT&ITES - Computer Software Application - Lesson 01-17