Skip to main content

IS security threats and safeguards

Short answer

Information system security protects hardware, software, data and networks to ensure confidentiality, integrity and availability. Technology safeguards include multi-factor authentication, encryption, firewalls, anti-malware and backups. Human safeguards involve security policies, staff training, background checks, separation of duties and incident reporting procedures.

What do you understand by Information System security? Describe both technology and human based safeguards for Information Systems.

Information system security is the protection of an information system's hardware, software, data, networks and people from unauthorized access, misuse, modification, destruction or disclosure. Its goals are confidentiality (only authorized users see data), integrity (data is accurate and unaltered) and availability (data is accessible when needed).

Technology-based safeguards

  1. Authentication - strong passwords, OTP, smart cards, biometrics, multi-factor authentication.
  2. Access control - roles and permissions, least privilege.
  3. Encryption - protects data stored and in transit (AES, SSL/TLS, VPN).
  4. Firewalls and IDS/IPS - block and detect attacks.
  5. Antivirus / anti-malware and regular patching.
  6. Backup and recovery - regular backups, redundant systems (RAID, mirror sites).
  7. Digital signatures and certificates - integrity and identity.
  8. Audit trails and logging - detect misuse.
  9. Physical devices - UPS, locks, CCTV.

Human-based safeguards

  1. Security policies and procedures - clear rules for use of systems, passwords and email.
  2. Training and awareness - teach staff about phishing and social engineering.
  3. Recruitment screening and clear job responsibilities.
  4. Separation of duties - no one person controls a whole critical process.
  5. Supervision and management commitment - regular reviews.
  6. Ethics and disciplinary rules - agreements, penalties for violation.
  7. Incident reporting culture and exit procedures (remove access when staff leave).

Both kinds are needed because most breaches involve human error or insiders.

✓ Answer checked by Claude Opus 5.5 (high effort)

Related questions

All Information System chapter 2 questions →