Introduction Over the past years, there have been increasing cases of information security threats. As the information technology professionals stay up to date with the latest technologies, they navigate through complicated playing field. There has been a newly introduced terminology that has brought a lot of confusion in the area of technology. This paper focuses on the background of information security. It also looks at the information technology threats as well as the importance of planning policies to mitigate these risks. History of Information Security The computers were initially created to facilitate the swift exchange of information from one person to another (Jouini, 2014). The initial information technology infrastructure was created around the mainframe computers while others were established around the personal computers. At first, it seemed impossible to advance these computers to the present generation computers and information technology gadgets. However, as information technology revolutionize, new avenues are opening for the possibility of crimes. Cyber criminals take advantage of these opportunities to steal the passwords of the computers and get access to the private information as well as make devastating effects on computers and networks. The nature of the use of computers has changed over the years. Various networks have been developed to enable the sharing and circulation of information and data. Regulating the access to these possessions is problematic as one need to stabilize the need for access to free information with the value of the content of the data he or she receives (Layton, 2016). Most of the information today is very sensitive while others are not. The information technology has today progressed over just the usernames and passwords. The field today encompasses digital strategies, the process of biometric identification and integrated security strategies. The Need for Security Many organizations agree that putting up the policies for information security is expensive and time-consuming. Most users also get interrupted by the substantial security policies that complicate their works and in turn develop bad politics within organizations (Omar, 2017). As such, it is essential to plan an audit policy on large networks that may consume a lot of time and money. Most users believe that there is no need to implement the security policies if there is no secret work done. Developing a poor security plan can lead to detrimental effects and even devastating disasters. A password policy which enables the users to use weak or poor passwords is the paradise for the hackers (Von Solms, 2013). The absence of firewall or protection for the proxy between the firm and the local area network is a loophole for the company to become a cybercrime target. Organizations should figure out the amount it may take them to efficiently implement the information security policies to safeguard their information as well as their ass.

1. Introduction
Over the past years, there have been increasing cases of
information security threats. As the information technology
professionals stay up to date with the latest technologies, they
navigate through complicated playing field. There has been a
newly introduced terminology that has brought a lot of
confusion in the area of technology. This paper focuses on the
background of information security. It also looks at the
information technology threats as well as the importance of
planning policies to mitigate these risks.
History of Information Security
The computers were initially created to facilitate the swift
exchange of information from one person to another (Jouini,
2014). The initial information technology infrastructure was
created around the mainframe computers while others were
established around the personal computers. At first, it seemed
impossible to advance these computers to the present generation
computers and information technology gadgets. However, as
information technology revolutionize, new avenues are opening
for the possibility of crimes. Cyber criminals take advantage of
these opportunities to steal the passwords of the computers and
get access to the private information as well as make
devastating effects on computers and networks.
The nature of the use of computers has changed over the
years. Various networks have been developed to enable the
sharing and circulation of information and data. Regulating the
access to these possessions is problematic as one need to
stabilize the need for access to free information with the value
of the content of the data he or she receives (Layton, 2016).
Most of the information today is very sensitive while others are
not. The information technology has today progressed over just
the usernames and passwords. The field today encompasses
digital strategies, the process of biometric identification and
integrated security strategies.

2. The Need for Security
Many organizations agree that putting up the policies for
information security is expensive and time-consuming. Most
users also get interrupted by the substantial security policies
that complicate their works and in turn develop bad politics
within organizations (Omar, 2017). As such, it is essential to
plan an audit policy on large networks that may consume a lot
of time and money. Most users believe that there is no need to
implement the security policies if there is no secret work done.
Developing a poor security plan can lead to detrimental effects
and even devastating disasters. A password policy which
enables the users to use weak or poor passwords is the paradise
for the hackers (Von Solms, 2013). The absence of firewall or
protection for the proxy between the firm and the local area
network is a loophole for the company to become a cybercrime
target.
Organizations should figure out the amount it may take them to
efficiently implement the information security policies to
safeguard their information as well as their assets. This cost
can be compared with the value that the organizations would
incur suppose they lost their information, assets, and hardware,
as well as their services, gets disrupted. The central notion
behind this strategy is to find the best balance between the two
(Layton, 2016). If the information only needs to be protected at
a minimal level, and any data loss may not lead to the
disruption of the services in the company, then it will cost less
to defend this data. However, if the information of the firm is
susceptible, this means that it will need maximum protection
and therefore will be more expensive.
Security Threats, Attacks, and Vulnerabilities
Data is the most crucial asset in any firm. The enterprises get
their competitive advantage in the market by knowing how to
handle their information successfully (Rhodes-Ousley, 2013).

3. The dangers of information security come from the people who
would like to get the information and misuse it so that they can
interfere with the standard business practices in the firm.
The entity of security is to safeguard the sensitive or valuable
information of the organization while making it accessible to
the authenticated users.
The attackers attempting to interrupt the standard business
processes make good use of the vulnerabilities by using some
methods, tools, and techniques (Omar, 2017). They always have
motives or goals of disrupting the standard practices in the
business to steal the most private information and use this
information later on to manipulate the organization. Information
technology managers should understand the different aspects of
security to establish the policies and measures that can be used
to safeguard the information and assets of an organization as
well as restrict their vulnerabilities.
Natural Disasters
It is nearly impossible to stop nature from happening.
Hurricanes, earthquakes, lightning, floods, and fire can cause
severe damage to the computer systems, therefore, interfere
with the information that is present in these computers (Jouini,
2014). This can lead to the loss of private information,
interruption, and loss of productivity as a result of the
disruption of the services in the firm. The information
technology administrators can implement a few safeguards to
protect the computer systems against the damage resulting from
the natural disasters. The best strategy is to develop a disaster
recovery and a contingency plan that would include other
threats such as wars, riots and terrorist attacks.
Human Threats
Malicious threats can also be caused by the employees of an
organization as well as non-employees who just want to
interrupt and damage the company. The most dangerous
attackers are the employees who were once employed in a group
(Siponen, 2014). This is because they are aware of all the
security codes in place as well as the security measures

4. implemented by the firm. The insiders are most likely to
develop objectives and goals and finally have legitimate access
to the system. They are always very accustomed to the
computers and the applications used in the organization. The
insiders can use Trojan horses, plant viruses, and worms that
will enable them to browse through the system's file.
The insider attackers can influence all the components of the
information security. They can reveal all the private information
of the firm by just browsing through the system (Layton, 2016).
Trojan horses are dangerous to the confidentiality and the
integrity of the data found in the computer system. The inside
attackers affect the accessibility of the information by
overloading the storage and processing capacity of the computer
systems and finally make the computer system to crash.
These malicious people are always referred to as hackers or
crackers. Their main aim is still to steal the information of the
organization and some hardware such as laptops (Rhodes-
Ousley, 2013). They use various techniques and tools to gain
access to the private knowledge of the company. The hackers
can then sell this information to the competitors to use this
information to beat the company in the market.
Attackers are not the only human that can cause damage to
the information and the computer systems of an organization.
The significant threat to the integrity and privacy of
organizational data is the authorized users who are not aware of
the activities they engage in that could be damaging to the firm.
The authenticated users can cause errors and oversights can
make an organization to lose its data, get the computer system
damaged or changed (Siponen, 2014).
The non-malicious threats always come from the employees who
do not know how to use the computers well and are not aware of
the security vulnerabilities and threats. For instance, the users
who use notepad to create documents then save these documents
in Microsoft word can severely damage the information stored
in the report.
Motives, Objectives, and Goals of the Malicious Attackers

5. There is a robust connection between the privacy of data and
physical security (Omar, 2017). The aim of some attackers is
not necessary to physically destroy the computer systems but to
penetrate and remove all the sensitive information of the
organization for personal use and satisfaction. They can then
use this information for their gain.
Methods Used by the Attackers
Deleting and Changing Information
The malicious attackers who modify or delete information have
the motives of taking revenge on the target. The internal
attackers do this because they may be disappointed about
something in the organization (Von Solms, 2013). The external
attackers on the other side do this to prove to the team that they
can manipulate the body.
Information Theft and Fraud
The information technology is progressively used to engage in
fraudulent activities and stealing the resources of organizations.
The computer systems can be subjugated in various ways by
using both the traditional and the modern ways to get access to
the private information of the firm (Jouini, 2014). The financial
organizations are not the only firms that are subject to fraud.
Other objectives are the associations that regulate the
availability of the resources such as attendance systems and
time, school grading systems, inventory system and long
distance systems among others.
Disrupting the Normal Business Processes
The attackers may attempt to interrupt the normal operations of
the businesses. In any circumstance as such, the attackers
always have bigger goals to accomplish (Siponen, 2014). The
attackers employ various techniques to achieve their objectives
and goals and perform their missions.
Tools and Techniques used for Information Security Attack
Viruses
The attackers can establish dangerous codes called viruses.
They can then use the hacking techniques to break into the
computer systems and cultivate the viruses. Viruses are a

6. general threat to any information technology tool (Layton,
2016). There are different forms of viruses and take time before
they start damaging the systems.
Trojan Horses
These are malicious software codes and programs which are
hidden in the regular applications in the computer systems
(Omar, 2017). When the user opens the regular schedule, the
hidden software code runs as well. It then begins to delete
some files and causing other destruction to the computer
system. They are distributed majorly by attachment in the
emails.
Worms
These are malicious programs running freely and traveling
from one computer to another across different computer
networks (Rhodes-Ousley, 2013). Worms can disintegrate and
have different portions running through different machines.
They do not change the existing programs on the computer.
Password Cracking
This is an approach used by the attackers to secretly gain
access to the systems through the accounts of authorized users
(Von Solms, 2013). This is facilitated by the weak passwords
created by the users. The two primary problems with passwords
are that they can easily be manipulated and also vulnerable to
the attacks from the dictionaries found in the computers.
Denial of Service Attacks
This type of attack takes advantage of the urge to have an
available service. There is an increasing trend of this kind of
attack on the internet as the websites promote a secure platform
for abuse (Layton, 2016). The attackers can quickly flood the
internet servers and therefore make it busy. As such, the
companies linked to this website experience a DoS attack that
may allow other attacks to be passive.
E-Mail Hacking
Email is one of the most crucial internet features used by
different companies and individuals as well as businessmen.
There are several threats associated with the use of emails. They

7. include impersonation, packet replay, eavesdropping, packet
modification, intrusion attacks and social engineering.
In impersonation, the address of the sender cannot be reliable as
the sender can make a false return address. The main aim of
imitation in emails is to get to manipulate information from the
target person or organization. In eavesdropping, the email
content and headers are conveyed in a clear text that uses
encryption. As such, the information in the email can be
changed in transit. The header, on the other hand, can be used to
redirect the data to the internet attackers.
Packet replay means the recording and retransmission of the
information packets in the network (Jouini, 2014). This is a
substantial threat to the computer programs that call for
authentication sequence as an imposter could echo specific
authentication sequence information to gain access to the
computer system. Packet modification encompasses one system
that interrupts and changes the information packets that are
destined for other systems. The data can not only be changed
but also destroyed.
Social engineering in emails is the most common type of
cracking the internet and getting the most crucial and private
information of an organization. It can be applied by both the
external attackers as well as the insiders (Siponen, 2014). It
involves tricking people into revealing their passwords and
other information that can be used to gain access to the
computer systems of a targeted organization. Finally, intrusion
attacks involve a hacker who uses certain hacking trappings to
get access to the computer system of a targeted firm. These
tools include hacking protocol tools, password hacking tools,
and manipulation tools. These tools can assist the attackers to
determine the modifications that occur within the networks and
the systems of the target institution.
Security Vulnerabilities
As seen before, the malicious attacker applies various
techniques to take advantage of the weaknesses of the computer
system to accomplish their malicious objectives (Rhodes-

8. Ousley, 2013). Vulnerabilities are the weak facts or ambiguities
in information security that the attacker uses to get access to the
computer system. Some of the weak points of the information
security include:
Passwords
The selection of passwords can be a weak point provided
the users have to create one. The problems come about when the
user has to remember a password from the several others that he
or she already has (Omar, 2017). As such, the user may choose
a simple password that the attackers can easily guess. They end
up creating simple passwords so that they cannot quickly forget
them. As a result, the attackers can easily guess their passwords
and get access to the system and then accomplish their missions.
It is therefore considered a vulnerability as it offers the
attackers the opportunity to guess the passwords.
Protocol Design
The protocols for communication my at times have weak
points. Attackers can easily sue these weak points to access the
private information and ultimately get access to the computer
systems and perform their missions (Layton, 2016). The most
common computer protocols which are very vulnerable to
security attack include telnet protocol and file transfer protocol.
Commands That Reveal the Private Information of the User
It is challenging to find interoperability between various
versions of UNIX and Microsoft products (Von Solms,2013).
The commands that display the information of the users pose a
significant threat to information security breach because the
attackers can use this information to break into the computer
system of the users and organizations.
Prevention of Information Security Threats
Implement Security Policies
The security policies should encompass all the processes
that help in the prevention and detection of misuse and the
strategies applicable for investigating the malicious insiders
(Rhodes-Ousley, 2013). These policies should also spell out the
potential outcome of misuse of organizational information.

9. Protect the Physical Security of the Computers
It is essential to keep people away from the critical
infrastructure that may be vulnerable to the security threats. The
organizations can apply tight access control to these systems.
They can also use the key cards that are less expensive and
flexible to prevent the attackers from manipulating their selves
into the system.
Screen New Employees
It is essential to conduct a background check on the new
employees to ensure that they are not malicious people
sugarcoating themselves as employees.
Strong Authentication
The hackers have advanced technologies for cracking the
passwords. As such, it is essential to have strong passwords that
include numbers, symbols, punctuation marks and letters and
that cannot be easily cracked (Jouini, 2014). Similarly,
companies can use fingerprint scanners and sensitive
application systems that only allow the authenticated users to
access the systems.
Secure the Desktops
The users cannot be trusted to be responsible for all their
arrangements. It is therefore essential for administrations to
secure their desktops to prevent the potential threats. This can
be achieved by plugging information leaks in the desktops and
the computer systems.
Conclusion
There is an increasing concern for the information security
threats as various organizations are exposed to the risks of
information security. The computer systems can be susceptible
to the natural disasters that can happen anytime. Similarly,
malicious attackers use different tools, methods, and techniques
to exploit the vulnerabilities of the computer systems and gain
access to the private information of the organizations. As such,
it is imperative for an organization to implement the strategic
risk management and contingency plans to protect their
confidential information and organizational assets.

10. References
Jouini, M., Rabai, L. B. A., & Aissa, A. B. (2014).
Classification of security threats in information systems.
Procedia Computer Science, 32, 489-496.
Layton, T. P. (2016). Information Security: Design,
implementation, measurement, and compliance. CRC Press.
Omar, S. (2017). Information system security threats and
vulnerabilities: evaluating the human factor in data protection
(Doctoral dissertation).
Rhodes-Ousley, M. (2013). Information security: the complete
reference. McGraw Hill Education.
Siponen, M., Mahmood, M. A., & Pahnila, S. (2014).
Employees’ adherence to information security policies: An
exploratory field study. Information & management, 51(2), 217-
224.
Von Solms, R., & Van Niekerk, J. (2013). From information
security to cyber security. computers & security, 38, 97-102.