Quilas, Jeveroux George G.

AIS104
Safeguarding Information System Resources

Today, we’ll be discussing the importance of safeguarding information

systems. Information systems are the backbone of most organizations
today, storing and processing critical data. Safeguarding these
systems is essential to protect this data from unauthorized access,
use, disclosure, disruption, modification, or destruction.

Why Safeguard Information Systems?

● Protects sensitive data (financial records, personal information,
intellectual property)
● Ensures system availability (minimizes downtime and disruptions)
● Maintains system integrity (data accuracy and system reliability)
● Improves regulatory compliance (adheres to industry standards and
data protection laws)
There are several reasons why safeguarding information systems is
critical. First and foremost, it protects sensitive data. This
includes financial records, personal information (e.g., Social
Security numbers), and intellectual property. A data breach can have
severe consequences, both financial and reputational. Information
system safeguards also ensure system availability. This means
minimizing downtime and disruptions to operations. Safeguards also
maintain system integrity. This refers to data accuracy and system
reliability. Inaccurate data can lead to poor decision-making.
Finally, robust safeguards can improve your organization’s regulatory
compliance. Many industries have data protection laws, and failing to
comply can result in hefty fines.

Core Safeguarding Principles

● Confidentiality: Ensures data is only accessed by authorized
users.
● Integrity: Maintains the accuracy and completeness of data.
● Availability: Guarantees authorized users have access to data and
systems when needed.
There are three core principles that underpin information security
safeguards: confidentiality, integrity, and availability, often
referred to as the CIA triad. Confidentiality ensures that data is
only accessed by authorized users. This is achieved through access
controls, such as passwords and multi-factor authentication. Data
integrity means maintaining the accuracy and completeness of data.
This involves measures to prevent unauthorized data modification and
ensure data backups are available. Finally, availability guarantees
that authorized users have access to data and systems when needed.
This requires measures to ensure system uptime and prevent denial-of-
service attacks.

Safeguarding Techniques
● Access Controls: Restricts access to data and systems (passwords,
multi-factor authentication)
● Data Encryption: Scrambles data to protect it during storage and
transmission
● Network Security: Firewalls, and intrusion detection systems to
monitor and filter network traffic
● Backups and Disaster Recovery: Regularly backups data and systems
to ensure recovery from incidents

There are various techniques you can use to safeguard information

systems. Access controls restrict access to data and systems. This can
include passwords, multi-factor authentication, and user permission
levels. Data encryption scrambles data to protect it during storage
and transmission. This makes it unreadable to anyone who doesn’t have
the decryption key. Network security measures like firewalls and
intrusion detection systems monitor and filter network traffic to
identify and block suspicious activity. Finally, it’s crucial to have
a backup and disaster recovery plan in place. This involves regularly
backing up data and systems to ensure you can recover them in case of
an incident such as a cyberattack or hardware failure.

Security Awareness and Training

● Educates employees on security risks and best practices
● Teaches employees how to identify phishing attempts and social
engineering tactics
● Encourages employees to report suspicious activity
Security awareness and training are essential components of any
information security program. Educating employees on security risks
and best practices can significantly reduce the risk of human error.
This includes teaching employees how to identify phishing attempts,
which are emails or messages designed to trick them into revealing
sensitive information. Training should also cover social engineering
tactics, where attackers manipulate employees into taking certain
actions. Finally, a culture of security should be fostered where
employees are encouraged to report suspicious activity.