Welcome to IT Systems Security and Control!

Hi there! Welcome to one of the most practical and important chapters in your SBL journey. You might think, "Isn't IT security for the tech experts?" Well, as a future strategic leader, you need to ensure the business stays safe from digital threats. If the IT systems fail or get hacked, the whole strategy fails! In this chapter, we will learn how to protect data and keep the business running smoothly, no matter what happens.

Don't worry if you aren't a "tech person." We will break everything down into simple concepts with plenty of real-world analogies.

1. The Three Pillars of IT Security: The CIA Triad

Before we look at how to secure a system, we need to know what we are trying to achieve. Every security strategy aims for three things, known as the CIA Triad.

  • Confidentiality: Ensuring that sensitive data is only accessible to those authorized to see it. (Think of it like a sealed envelope addressed only to you.)
  • Integrity: Ensuring that data is accurate, complete, and hasn't been tampered with. (Like a bank statement that shows exactly what you spent, no more and no less.)
  • Availability: Ensuring that systems and data are ready to use whenever the business needs them. (Like an ATM being open when you need cash at 2 AM.)

Quick Tip: If an exam question asks about the impact of a data breach, ask yourself: Was the data stolen (Confidentiality)? Was it changed (Integrity)? Or was the system shut down (Availability)?

Summary: The CIA Triad is the "gold standard" for security. If any of these three are broken, the business is at risk.

2. Identifying Threats to IT Systems

A threat is anything that can disrupt your IT systems. We can group these into three main buckets:

A. Human Threats (Intentional)

These are "the bad guys." This includes hackers, disgruntled employees who want revenge, or industrial spies trying to steal trade secrets.

B. Human Threats (Unintentional)

Believe it or not, this is often the biggest risk! This includes accidental deletion of files, poor password management, or an employee clicking a phishing link in an email. Mistakes happen, but they can be costly!

C. Environmental and Technical Threats

These are non-human issues like fires, floods, power outages, or hardware failure (e.g., a server crashing).

Did you know? Most major security breaches start with a simple human error, like someone leaving their laptop on a train or using "Password123."

3. General vs. Application Controls

To stop these threats, we use controls. In SBL, we divide these into two categories. Understanding the difference is vital!

General IT Controls (GITC)

These are controls that apply to all systems across the entire organization. They create a safe environment for everything to run. Think of this as the "Security Guard at the front gate" of a factory.

  • Physical access controls: Locked doors, CCTV, and ID badges for the server room.
  • Logical access controls: Requiring strong passwords and Multi-Factor Authentication (MFA) to log into the network.
  • Backup and recovery: Regularly saving copies of data in a different location.
  • System development controls: Ensuring new software is tested properly before being used.

Application Controls

These are specific to a particular task or program (like your payroll software or sales system). They ensure that the data entered is correct. Think of this as a "Quality Check on the assembly line" inside the factory.

  • Edit checks: The system blocks you if you try to enter a text name in a "Phone Number" box.
  • Range checks: The system flags an error if a manager tries to pay an employee $1,000,000 for one week's work.
  • Batch totals: Checking that the total of 50 invoices entered matches the total calculated by the computer.

Key Takeaway: General controls protect the whole building; Application controls make sure the specific jobs done inside the building are accurate.

4. Cyber Security Strategies

Cyber security is about protecting your "digital perimeter." As a leader, you should advocate for a "Defense in Depth" approach—which means having multiple layers of protection.

Common Cyber Attacks to Watch For:

  • Phishing: Fake emails designed to trick users into giving away passwords.
  • Ransomware: Software that locks your files and demands money to unlock them.
  • Malware: General "bad software" (viruses/worms) that damages systems.

How to Build a Strong Defense:

  1. Firewalls: A digital wall that filters traffic coming in and out of your network.
  2. Encryption: Scrambling data so that even if it's stolen, it's unreadable without a "key."
  3. Patch Management: Regularly updating software to fix security "holes."
  4. Staff Training: Teaching employees not to click on suspicious links. (This is often the most effective control!)

Memory Aid: Think of P.E.T.S. to remember security layers: Passwords, Encryption, Training, and Software updates.

5. Business Continuity and Disaster Recovery (BCP & DRP)

Even with the best security, things can still go wrong. Business Continuity Planning (BCP) is the "Plan B" for the whole business. It asks: "How do we keep trading if our office burns down or our IT is wiped out?"

Key Components of a Recovery Plan:

  • Disaster Recovery Plan (DRP): This is the technical part—how IT experts restore the servers and data.
  • Alternative Sites:
    • Cold Site: An empty building with power but no equipment. (Cheap, but takes a long time to set up).
    • Warm Site: A building with some hardware but no live data.
    • Hot Site: A fully equipped facility with a "live" mirror of your data. (Expensive, but you can be back in business in minutes!)

Common Mistake: Don't confuse BCP and DRP. BCP is the broad strategy for the business to survive. DRP is the specific IT technical process of getting the computers back online.

Summary: Resilience is about being "ready for the worst" so that a disaster doesn't become the end of the company.

Quick Review Box

1. What is the CIA Triad? Confidentiality, Integrity, and Availability.
2. General vs. Application? General = The whole system environment; Application = Specific data entry/processing.
3. Best Cyber Defense? A mix of technical tools (Firewalls/Encryption) and people tools (Training).
4. What is a "Hot Site"? A fully functional backup office ready for immediate use.

You've got this! IT security is just about being sensible, organized, and proactive. Keep these concepts in mind, and you'll be able to tackle any IT-related scenario in your SBL exam!