Question

Need Help!

Computer Security:

4. Important factors in insider threat evaluation are employee's Capability, Opportunity and Motivation. As relates to each of those factors, what factors could a security professional monitor to help them detect potential threats? [15 points)

Answer 1

There are many factors that a security professional could use to monitor and detect potential threats. Some of the influential factors are:

1) Security Policies:

Security Policies are the rules and regulation to prevent misuse of privilege. Security Policies include guidelines for various security related operations , audits. They prevent unauthorized access and limit the access for a user. Security Policies should be regularly updated for the requirements of the organization.

2) Physical Security:

The critical infrastructure of the organization should be kept remote not within the reach of any unauthorized person. They should be locked with critical access control systems. Access to systems should multiple level of verification like bio-metric, access cards etc.

3) Strong authentication / encryption mechanisms:

With increase of computing resources over years, most of the encryption, authentication mechanisms will be easily cracked if we use a small password/key. The password policy should be complex enough to stop outsiders from cracking/ brute-forcing the access to particular resource.

4) Information Disclosure / Log Evaluation:

Often most of the organization's private information which is critical will be leaked online through various medium. It is always search for any potential leaks and take necessary actions. By investigating log files we can find various anomalous activity of attacks and threats used to exploit the system. By doing that we can always keep our system safe and block those threats in the future.