4.4.1. Security Risks: Hardware, Software, and Human Threats
💡 First Principle: Security risks come from three sources: hardware failure (unintentional), software vulnerabilities (exploitable flaws), and human behavior (intentional or accidental). A complete security posture addresses all three.
Risk Categories
| Risk | Category | Example |
|---|---|---|
| Hardware failure | Unintentional | Drive failure causes data loss if no RAID/backup |
| Malware | Software/human | Ransomware encrypts all data; viruses replicate and damage |
| Data corruption | Software/hardware | Bit rot, write errors, application bugs |
| Insider threats | Human | Disgruntled employee deletes files; curious employee reads unauthorized data |
| Theft — physical | Human | Server or drive stolen from data center |
| Theft — data | Human/software | Unauthorized copying of sensitive data |
| Backdoors | Software | Hidden access mechanism installed by attacker |
| Social engineering | Human | Phishing, pretexting, vishing to steal credentials |
| Breaches | Combined | Unauthorized access to systems with data exfiltration |
Data Loss Prevention (DLP)
DLP systems monitor and control data movement to prevent unauthorized exfiltration:
- Content inspection: Scans emails, uploads, and file copies for sensitive patterns (SSNs, credit card numbers)
- Endpoint DLP: Prevents copying sensitive data to USB drives, cloud storage, or personal email
- Network DLP: Monitors and blocks sensitive data from leaving the network perimeter
Breach Response
When a breach occurs, two obligations apply:
- Identification: Determine the scope—what data was accessed, by whom, for how long?
- Disclosure: Legal obligations to notify affected parties (individuals, regulators). Timing and content are often legally mandated (GDPR: 72 hours; various US state laws: varying timelines).
⚠️ Exam Trap: Insider threats are statistically more dangerous than external attackers—insiders already have legitimate access and knowledge of where sensitive data lives. Mitigation requires access controls, segregation of duties, and monitoring, not just external perimeter security.
Reflection Question: An employee copies a customer database to a USB drive and takes it home. No malware was involved, no firewall was breached. What type of threat is this, and what control would have prevented it?
