--- title: "Threats, controls and security measures" subject: "Information System" chapter: 2 key: "semester_8/information_system:security-threats-controls-measures" source: https://www.bctengineer.com/q/semester_8/information_system/security-threats-controls-measures site: BCT Engineering --- # Threats, controls and security measures Information System · Chapter 2: Control, Audit and Security of Information Systems - Asked in: 2072 Magh, 2+5 marks; 2071 Bhadra, 2+4+4 marks; 2072 Asoj, 4+4 marks (asked 3 times) - Video: [Cybersecurity Threats | Types of Cybersecurity Threats | Invensis Learning](https://www.youtube.com/watch?v=awhqnSskWjU) — Invensis Learning - Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14 - Page: https://www.bctengineer.com/q/semester_8/information_system/security-threats-controls-measures - Whole chapter: https://www.bctengineer.com/md/semester_8/information_system/chapter-2 ## Question What are different threats to Information System in terms of security? Discuss different controls and security measures (including physical and logical) that are to be applied to protect information systems. ## Short answer Threats include malware, hacking, denial-of-service, phishing, insider attacks, physical hazards, and human error. Physical controls such as locked rooms, CCTV and UPS protect hardware; logical controls like authentication, firewalls, encryption, access control and regular backups protect data and software. Administrative measures like policies, training and audits mitigate risks. ## Answer **Information system security** means protecting the confidentiality, integrity and availability (CIA) of data, hardware, software and networks. #### Threats 1. **Malware** - viruses, worms, trojans, ransomware, spyware. 2. **Hacking / unauthorized access** - password cracking, SQL injection, exploits. 3. **Denial of Service (DoS/DDoS)** - flooding to make the service unavailable. 4. **Phishing and social engineering** - tricking users to reveal credentials. 5. **Sniffing and spoofing** - intercepting traffic, faking identity. 6. **Insider threats** - careless or malicious employees. 7. **Physical threats** - theft, fire, flood, power failure, earthquake. 8. **Software failure and human error** - bugs, wrong configuration, accidental deletion. 9. **Data theft and fraud.** #### Physical controls - Locked server rooms, guards, CCTV and access cards/biometrics. - Fire detection and suppression, UPS and generators, air conditioning. - Protection from flood and earthquake; off-site backup storage. - Equipment tagging, cable locks, secure disposal of media. #### Logical (technical) controls - **Authentication** - passwords, OTP, multi-factor, biometrics. - **Access control** - role-based permissions, least privilege. - **Encryption** - for stored data and data in transit (SSL/TLS, VPN). - **Firewalls, IDS/IPS** - filter and monitor network traffic. - **Antivirus and patching** - detect malware and fix vulnerabilities. - **Audit logs** - track user actions. - **Backup and recovery** - regular backups, tested disaster recovery plan. - **Digital signatures** for integrity and non-repudiation. #### Administrative measures - Security policy, employee training and awareness. - Separation of duties, background checks, incident response plan. - Regular security audits, risk assessment and penetration testing. ## Check yourself The answer's key points as multiple-choice questions, with the correct option and why. 1. What does CIA stand for in IS security? A. Control, inspection, audit B. Confidentiality, integrity, availability C. Cost, information, access D. Cryptography, identity, authentication Answer: B. These are the three main goals of information system security. (Key point: CIA) 2. What does a Denial of Service attack do? A. Floods the service so it becomes unavailable B. Steals passwords by phishing C. Encrypts data for a ransom D. Records keyboard strokes Answer: A. DoS/DDoS attacks target availability. (Key point: DoS) 3. Which is a physical control? A. Encryption and TLS B. Firewalls and IDS C. UPS, locked server rooms and CCTV D. Password policy Answer: C. Physical controls protect equipment and premises. (Key point: Physical controls) 4. What does least privilege in access control mean? A. All users get admin rights B. Nobody can access data C. Permissions are never reviewed D. Users get only the permissions they need Answer: D. Role-based permissions limit damage from misuse. (Key point: Least privilege) ## Related in Information System - [IS security threats and safeguards](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Ais-security-threats-controls) — Information System, chapter 2 - [Multi-layer security strategy](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Amulti-layer-security-ecommerce) — Information System, chapter 2 - [Strategic information system and benefits](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Astrategic-is-benefits) — Information System, chapter 1, asked 2× - [Geographic Information System](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Agis-characteristics-uses) — Information System, chapter 1 - [Short note: HR information system](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Ashort-note-hris) — Information System, chapter 6 - [Security audit and security protocols](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Asecurity-audit-role-protocols) — Information System, chapter 2 ## Related in other subjects - [Physical vs logical clock; sync method](https://www.bctengineer.com/question.md?key=semester_7%2Fdistributed_system%3Aphysical-clock-sync-difficulty) — Distributed System, chapter 5, asked 2× - [Synchronising physical clock using logical clock](https://www.bctengineer.com/question.md?key=semester_7%2Fdistributed_system%3Async-physical-with-logical) — Distributed System, chapter 5, asked 2× - [Physical vs logical clocks; Lamport](https://www.bctengineer.com/question.md?key=semester_7%2Fdistributed_system%3Alamport-physical-compare) — Distributed System, chapter 5 - [Physical/logical clocks; NTP and Berkeley](https://www.bctengineer.com/question.md?key=semester_7%2Fdistributed_system%3Aphysical-logical-ntp-berkeley) — Distributed System, chapter 5