¶ … worst that could happen to an information system was a natural disaster destroying all information, nowadays, the category of risks has become thoroughly diversified and, because an increasing use of informational systems as data storage and processing tools, it has become more and more important to provide suitable solutions in each situations. In the paragraphs here below, we present a series of problems one may face in ensuring IT security in an organization, together with a set of solutions that may be applied. We have referred to external and internal vulnerabilities, as well as cyber, physical and social ones. External/Internal Vulnerabilities

According to an excellent study by Gerhard Eschelbeck

, there are several generations of external threats and vulnerabilities worth discussing:

First Generation threats comprise external virus attacks, generally by email or forms of file sharing. The main characteristic of these attacks is that human action is needed in order for the virus to be replicated and spread to other computers. Examples from this category include the Melissa Macro virus, the LoveLetter VBScript worm or the SoBig virus.

Second Generation threats refer to "active worms leveraging system and application vulnerabilities"

. Viruses and Trojans are major representatives of this category, characterized by automatic replication and spreading. Common recent examples are the Slapper worm, the SQL Slammer worm and the Blaster worm.

Third Generation external threats are much tougher to handle, as the viruses and worms in this category are much more insidious, targeting viable potential victims in advance and, as such, having a faster propagation. These targets include Instant Messaging and Voice-over-IP systems. Even more worrying, traditional defenses are not always fully effective against these threats.

In terms of internal vulnerabilities, many of them seem to come from Microsoft. Indeed, according to Gerhard Eschelbeck, the top 10 internal vulnerabilities are...

These include keeping anti-viruses up-to-date, "regular security audits of networks and systems"
, patch management and a continuous evaluation and constant feedback on the security policy that an organization has in place. Let's see briefly what each refers to.

The first solution is clearly closely related to the continuous evolution of viruses and worms, direct threats to the information systems. Many anti-viruses have themselves regular updates for new viruses, however, it may be often the case that the program itself needs to be updated or even changed with a more performing one. It is obvious that a Norton Antivirus created ten years ago will no longer be suitable, in spite of updates in its virus database.

The second action is referring to "network audit solutions and systems"

. These are complex management systems that are implemented in order to be able to spot in time possible vulnerabilities, update and install patches where needed and inform upon the need for any update in the security system.

Patch management is related to identifying possible software breaches and crashes and intervening in time to solve these by providing a "timely and consistent remediation process"

Finally, the ongoing evaluation and constant feedback for the security policy is an overall concept and mechanism comprising all three ideas I have already mentioned in the paragraphs here above.

Problem: Physical, Cyber and Human/Social Vulnerabilities

Physical vulnerabilities include hardware, network and communications vulnerabilities. These range from outside attacks on the system (hacker, etc.) to actual breaking and entering the server room, the office space where the systems are located, etc.

Cyber vulnerabilities include breaches in the operating systems and in the software applications that an organization uses. Common examples in this…