Multi-Layered Defense Systems and Data Protection

.
             According to Strab (2008), information security risks are circumstances through which potential negative impact to an organization's information assets may occur. Risks are generally the result of an external or internal threat taking advantage of an existing vulnerability within the organization's governance, people, process or technology infrastructure (p. 24). Strab further describes threats as anything which can negatively affect the confidentiality, integrity, or availability of systems and/or data. The two most common threat types are physical threats, and electronic threats Physical threats can include fire, politically motivated attacks and floods. In contrast, electronic attacks include viruses, denial of service attacks, hackers (p. 24). In today's technology driven environments, the use of computerized databases is commonplace, making it even more important for an organization to identify the risk of losing such valuable information. Strab's (2008) research defines the objective of risk identification as an effort to cover the breadth of possible issues which may impact the business and develop a distinct list of significant scenarios. .
             When identifying risks, a comprehensive identification process using a well-structured systematic process is critical. Where risks are not effectively identified during this stage, they may be excluded from further analysis (p. 26). Strab (2008) found the use of key questions important in addressing some of those issues. Questions such as: "What can happen, where and when?" as well as "Why and how can it happen?" He further stated that checklists, flowcharts and other tools can be used to identify both assets and events that might be impacted as well as the potential causes of these events (p.26). .
             In Castellanos' (2008) research he described the increasing convergence of once-isolated industrial control systems as having helped many organizations simplify and manage their complex environments by connecting networks and introducing information technology components into the industrial control system domain.