Moreover, because of today's increasingly nomadic lifestyle, which allows employees to connect to information systems from virtually anywhere, employees are required to carry a part of the information system outside of the company's secure infrastructure.

Introduction to Security

Risk in terms of security is generally characterised by the following equation:

The threat represents the type of action that is likely to be of harm, whereas vulnerability (sometimes called flaws or breaches) represents the level of exposure to threats in a particular context. Finally, the countermeasure is all of the actions implemented to prevent the threat.

The countermeasures to be implemented are not only technical solutions but also include user training and awareness as well as a clearly defined rules.

In order to secure a system, the potential threats must be identified so as to identify and anticipate the enemy's course of action. Therefore, the goal of this report is to provide an overview of possible hacker motivations, categorise them and give an idea of how they work in order to better know how to limit the risk of intrusion.

Goals of IT Security

Information systems are generally defined by all of a company's data and the material and software resources that allow a company to store and circulate this data. Information systems are essential to companies and must be protected.

IT security generally consists in ensuring that an organisation's material and software resources are used only for their intended purposes.

IT security generally is comprised of five main goals:

• Integrity: guaranteeing that the data are those that they are believed to be
• Confidentiality: ensuring that only authorised individuals have access to the resources being exchanged
• Availability: guaranteeing the information system's proper operation
• Non-repudiation: guaranteeing that an operation cannot be denied
• Authentication: ensuring that only authorised individuals have access to the resources

Confidentiality

Confidentiality consists in making information unintelligible to individuals other than those involved in the operation.

Integrity

Verifying data integrity consists in determining if the data were changed during transmission (accidentially or intentionally).

Availability

The goal of availability is to guarantee access to a service or resources.

Non-repudiation

The non-repudiation of information is the guarantee that none of the parties involved can deny an operation at a later date.

Authentication

Authentication consists in confirming a user's identity, i.e. guaranteeing for each party that their partners are truly who they think they are. An access control (e.g. an encrypted password) grants access to resources only to authorised individuals.

Need for a Global Approach

Information system security is often the subject of metaphors. It is often compared to a chain in the example that a system's security level is only as strong as the security level of its weakest link. Likewise, a reinforced door is useless in protecting a building if its windows are left wide open.

All this goes to show that the issue of security must be tackled at a global level and must comprise the following elements:

• Making users aware of security problems
• Logical security, i.e. security at the data level, notably company data, applications and even operating systems
• Telecommunications security: network technologies, company servers, access networks, etc.
• Physical security, or the security of material infrastructures: secure rooms, places open to the public, company comman areas, employee workstations, etc.

Implementing a Security Policy

The IT system security is generally limited to guaranteeing the right to access a system's data and resources by setting up authentication and control mechanisms that ensure that the users of these resources only have the rights that were granted to them.

And yet security mechanisms can create difficulties for users. Instructions and rules often become increasingly complicated as networks grow. Thus, IT security must be studied in such a way that it does not prevent users from developing uses that they need and so that they can use information systems securely.

This is why one of the first steps a company must take is to define a security policy, which is implemented with the four following stages:

• Identify the security needs and the IT risks that the company faces and their possible consequences
• Outline the rules and procedures that must be implemented for the identified risks in the organisation's different departments
• Monitor and detect the information system's vulnerabilities and keep informed of the flaws in the applications and materials being used
• Define the actions to be taken and the individuals to contact in case a threat is detected

The security policy is all of the security rules that an organisation (in the general sense of the word) follows. Therefore, it must be defined by the management of the organisation in question because it affects all the system's users.

In this respect, it is not the job of the IT adminstrators to define user access rights but rather that of their superiors. An IT administrator's role is to ensure that IT resources and the access rights to these resources are in line with the security policy defined by the organisation.

Moreover, given that he or she is the only person who masters the system, he or she must give security information to the management, advise the decision makers on the strategies to be implemented, and be the entry point for communications intended for users about problems and security recommendations.

A company's IT security depends on employees (users) learning the rules through training and awareness-building sessions. However, security must go beyond employee knowledge and cover the following areas:

• A physical and logical security mechanism that is adapted to the needs of the company and to employee use
• A procedure for managing updates
• A properly planned backup strategy
• A post-incident recovery plan
• An up-to-date documented system

The Causes of Insecurity

Insecurities are generally broken down into two categories:

• An active state of insecurity, i.e. user ignorance of the system's functionalities, some of which can be harmful to the system (e.g. not deactivating network services that are not needed by user)
• A passive state of insecurity, i.e. lack of knowledge of the security measures in place (e.g. when the administrator or user of a system does not know what security devices he or she has)