---
title: "IS security threats and safeguards"
subject: "Information System"
chapter: 2
key: "semester_8/information_system:is-security-threats-controls"
source: https://www.bctengineer.com/q/semester_8/information_system/is-security-threats-controls
site: BCT Engineering
---

# IS security threats and safeguards

Information System · Chapter 2: Control, Audit and Security of Information Systems

- Asked in: 2074 Magh, 2+4 marks
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_8/information_system/is-security-threats-controls
- Whole chapter: https://www.bctengineer.com/md/semester_8/information_system/chapter-2

## Question

What do you understand by Information System security? Describe both technology and human based safeguards for Information Systems.

## Short answer

Information system security protects hardware, software, data and networks to ensure confidentiality, integrity and availability. Technology safeguards include multi-factor authentication, encryption, firewalls, anti-malware and backups. Human safeguards involve security policies, staff training, background checks, separation of duties and incident reporting procedures.

## Answer

**Information system security** is the protection of an information system's hardware, software, data, networks and people from unauthorized access, misuse, modification, destruction or disclosure. Its goals are **confidentiality** (only authorized users see data), **integrity** (data is accurate and unaltered) and **availability** (data is accessible when needed).

#### Technology-based safeguards
1. **Authentication** - strong passwords, OTP, smart cards, biometrics, multi-factor authentication.
2. **Access control** - roles and permissions, least privilege.
3. **Encryption** - protects data stored and in transit (AES, SSL/TLS, VPN).
4. **Firewalls and IDS/IPS** - block and detect attacks.
5. **Antivirus / anti-malware** and regular patching.
6. **Backup and recovery** - regular backups, redundant systems (RAID, mirror sites).
7. **Digital signatures and certificates** - integrity and identity.
8. **Audit trails and logging** - detect misuse.
9. **Physical devices** - UPS, locks, CCTV.

#### Human-based safeguards
1. **Security policies and procedures** - clear rules for use of systems, passwords and email.
2. **Training and awareness** - teach staff about phishing and social engineering.
3. **Recruitment screening** and clear job responsibilities.
4. **Separation of duties** - no one person controls a whole critical process.
5. **Supervision and management commitment** - regular reviews.
6. **Ethics and disciplinary rules** - agreements, penalties for violation.
7. **Incident reporting culture** and exit procedures (remove access when staff leave).

Both kinds are needed because most breaches involve human error or insiders.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. Which goal means data is accurate and unaltered?
   A. Integrity
   B. Confidentiality
   C. Availability
   D. Non-repudiation only
   Answer: A. Integrity protects accuracy; confidentiality limits viewers; availability keeps data accessible. (Key point: Goals)

2. Which is a technology-based safeguard?
   A. Recruitment screening
   B. Multi-factor authentication and encryption
   C. Staff training
   D. Disciplinary rules
   Answer: B. The others are human-based safeguards. (Key point: Technology safeguard)

3. Why use separation of duties?
   A. To give one person full control
   B. To avoid backups
   C. So no single person controls a whole critical process
   D. To remove the need for policies
   Answer: C. It reduces fraud and insider risk. (Key point: Separation of duties)

4. Why are human safeguards needed along with technology?
   A. Technology never works
   B. Humans are cheaper than software
   C. Laws ban technology controls
   D. Most breaches involve human error or insiders
   Answer: D. Both kinds are needed for full protection. (Key point: Why both)

## Related in Information System

- [Threats, controls and security measures](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Asecurity-threats-controls-measures) — Information System, chapter 2, asked 3×
- [Short note: HR information system](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Ashort-note-hris) — Information System, chapter 6
- [Strategic information system and benefits](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Astrategic-is-benefits) — Information System, chapter 1, asked 2×
- [Geographic Information System](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Agis-characteristics-uses) — Information System, chapter 1
- [Layered approach to security](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Alayered-security-throughput) — Information System, chapter 2
- [Multi-layer security strategy](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Amulti-layer-security-ecommerce) — Information System, chapter 2

## Related in other subjects

- [Internet-connected system threats](https://www.bctengineer.com/question.md?key=semester_6%2Foperating_system%3Ainternet-security-threats) — Operating System, chapter 8
- [Short note: information security model](https://www.bctengineer.com/question.md?key=semester_6%2Foperating_system%3Ainfo-security-model-note) — Operating System, chapter 8
- [Appropriate, intermediate and labor-based technology for LDCs](https://www.bctengineer.com/question.md?key=semester_7%2Ftechnology_environment_and_society%3Aappropriate-intermediate-labor-ldc) — Technology, Environment and Society, chapter 1, asked 2×
- [Labor-based technology and irreversibility](https://www.bctengineer.com/question.md?key=semester_7%2Ftechnology_environment_and_society%3Alabor-based-tech-irreversible) — Technology, Environment and Society, chapter 1