IT departments are strongly encouraged to extend enterprise-level protection to employees’ devices, but this is only possible if employees themselves seek to place their devices under the care of specialists from the IT department. This is important because it is necessary to consider the influence of the American Civil Liberties Union (ACLU) policies, which involve protecting employees’ privacy. The general purpose of ensuring information security is to protect the subjects of information relations from damage that may be moral or material. Damage can be carried by intentionally or unintentionally gaining access to information resources or interfering with the operation of an automated system (Hwang & Kim, 2021). In a general sense, there are three main directions for achieving this goal:
- stable maintenance of the confidentiality of protected information,
- ensuring the availability of information to authorized users,
- preserving the integrity of the processed information.
The strategic goal of ensuring information security is to promote and strengthen the process of developing an information security system. Ensuring information security should be carried out by taking into account established, general principles since information security is a connecting element of the implementation of information and national policy. The information environment is a system-forming link in the natural functioning of social processes. It provides the processes of consumption, storage, and transformation of information. Information security plays a crucial role in the efficient and reliable operation of an enterprise in any field of activity.
Assessment of possible security threats is carried by formation of an expert group that conducts vulnerability analysis. Due to the qualitative formation of an expert group, it is possible to reduce the level of subjectivity in assessing threats. The composition of the expert group is formed following the questions posed in the field of information security and cannot be less than the number of three people (Hwang & Kim, 2021). During the training process, users should be provided with recommendations to help avoid malicious actions and provide information about possible threats and ways to prevent them. Users should firmly understand the security rules listed below:
- Never respond to email requests for financial or personal information.
- Never report passwords.
- Do not open suspicious email attachments.
- Do not respond to any suspicious or unwanted email messages.
- Do not install unverified applications.
- Lock computers if they are not in use using a password-protected screen saver or the CTRL-ALT-DELETE dialog box.
- Enable the firewall.
- Use strong passwords on remote computers.
It is also necessary to use a network shielding subsystem designed to protect users’ workstations from possible network virus attacks by filtering potentially dangerous data packets. The subsystem should provide filtering capability at the channel, network, transport, and application levels of the TCP/IP stack (Hwang & Kim, 2021). As a rule, this subsystem is implemented based on firewalls and personal network screens. At the same time, the firewall is installed at the point of connection of automated systems to the Internet, and personal screens are placed on user workstations. The subsystem for detecting and preventing attacks is designed to detect unauthorized virus activity by analyzing data packets circulating in automated systems and events registered on users’ servers and workstations (Hwang & Kim, 2021). The subsystem complements the functions of firewalls and personal screens due to the possibility of a more detailed contextual analysis of the contents of transmitted data packets.
Reference
Hwang, S. Y., & Kim, J. N. (2021). A malware distribution simulator for the verification of network threat prevention tools. Sensors, 21(21), 6983. Web.