Are you interested in working with technology? Do you enjoy solving complex problems and searching for clues? If this sounds like you, consider a career as a security risk assessor or security analyst. Individuals interested in either career can begin by completing the Bachelor of Science Information Technology degree at Florida National University. So, what is the difference between a security risk assessor and a security analyst?
What Does a Security Risk Assessor Do?
A security risk assessor identifies the risks to a company’s technology and how to safeguard it from security threats. The security risk assessor focuses on computer infrastructure, network, information security, servers, applications, and IT policies.
Every IT system possesses some risk, but it is up to the security risk assessor to ensure that the risk level is not greater than the expected risk. The security risk assessor must mitigate the risk to a company-acceptable level. The most common ways a system can be vulnerable include:
Loss of Confidentiality – losing control of information can violate governmental policies. For example, if a Ransomware attack hits a hospital, confidential medical information may be at risk of exposure. Violating HIPAA guidelines can introduce fines and loss of employment.
Loss of Integrity – companies must ensure viruses, worms, and trojans cannot inappropriately manipulate their data. These security threats can compromise the integrity of data. A large corporation that gathers customer information, like an insurance company or credit card provider, may be susceptible to this security threat.
Loss of Availability – it is essential for companies to keep their system up and running. Being vulnerable to outages is only the first type of threat that a company can incur. A DDoS attack is a vulnerability that can render a system powerless. This attack may be the most critical risk for a company in e-commerce, as server downtime can cause a loss of millions of dollars in sales (and erode customer loyalty).
Computer Threats
The security risk assessor must complete their assessment to identify the possible threats to a company. These threats include:
A Power Outage – an attacker may target a server system to turn off power and cause a website to crash. This attack can be done manually or through cyber threats like hacking an electrical grid to turn a company’s power out. Companies can combat a power outage with a generator and data backups to restore information once the website is back online.
Ransomware – a ransom attack occurs when a victim must pay a ransom to regain access to their servers and data. In extreme cases, an attacker may target a hospital to compromise the medical equipment connected to the hospital’s server or threaten to leak confidential information about patients on the dark web.
Virus – is a type of malicious software that spreads between computers and causes damage to data and software. The virus spreads between computers by replicating and spreading itself through a network.
Worm – malware that self-replicates and infects other computers in the network. The difference between a virus and a worm is that a worm does not need to be passed with an infected attachment to affect a computer on the network. It can move from computer to computer on its own.
Trojan – is a type of malware disguised as a software program or program update that infects a computer. Computer users unknowingly download these trojans, thinking they are updating actual software on their computers.
DDoS Attack – a distributed denial-of-service attack occurs when several computers, typically part of the Internet of Things (IoT), bring down a server through a flood of traffic that disrupts the company’s bandwidth. Most DDoS attacks use malware-infected computers controlled by the attacker.
Malware – can infect a computer to change functions, destroy data, spy on a user, or spread across a network to attack other computers. The malware is usually in an email attachment disguised as a legitimate email to infect a user’s computer.
Phishing – when a cyber-criminal sends an email to capture passwords and confidential information from unsuspecting computer users. Phishing can also happen in the real world through third-party contact disguised as legitimate companies.
SQL Injection – structured query language injection is a threat to a website that relies on a database. Attackers will access the database with a command rather than a password, allowing the cybercriminal to manipulate the information in the database. If breached, sensitive data can be released, modified, or deleted.
DNS Attack – a domain name system attack can change the DNS record to send traffic to a phony website similar to the company’s legitimate website. Once the user has landed on the spoofed website, the site asks for essential and confidential information like credit card information or passwords.
Keylogger – Programs like this record a user’s keystrokes to access passwords, credit cards, and other confidential information.
What Does a Security Analyst Do?
While the security risk assessor identifies potential cyber threats, the Security Analyst monitors an organization’s network to identify security breaches, investigate how they happened, and rectify them. The security analyst uses software to protect the server by adding firewalls and encrypting data. They also create security standards and password protocols to ensure the company is not a cybersecurity victim.
Some of the security enhancements that a security analyst uses to safeguard a company’s computer infrastructure include:
Firewall – network security monitors traffic to and from a company’s network. It will allow or block traffic based on a set of security rules.
Anti-Virus Software – can identify and block viruses before they infect a computer. Anti-virus software is constantly updated when new viruses are detected. This software can automatically identify incoming files to identify possible viruses and quarantine them from the rest of the computer to stop them from infecting it. Anti-virus software also allows users to run manual scans at specific intervals to identify suspicious files already loaded on a computer.
Anti-Malware/Spyware Software – identifies malware and spyware before they infect a computer. This software can scan a computer to prevent, detect, and remove malware and spyware.
Email Attachment Protocols – A security analyst will create an email attachment protocol that states computer users must not open any attachments that they are not familiar with. They can alert IT to malicious attachments, and the security analyst can block emails from those IP addresses.
Password Protocols – many security analysts train users to create passwords that are hard to crack. Using numbers, symbols, and lower- and upper-case letters is a great way to construct a secure password. They may instruct users not to keep passwords on sticky notes near their computers. Plus, security analysts may implement 2FA to protect computer access further.
2FA – two-factor authentication is a second layer of defense to protect an application from malicious actors gaining access to a company’s network or application. Google Authenticator is one such app that can offer two-factor authentication. It uses a QR code to create a unique app for a specific user and changes the string of numbers every few seconds so that the authentication constantly changes and only the person with the app can access the code.
How Do You Become a Security Risk Assessor or Security Analyst?
A great way to become a security risk assessor or security analyst is by completing the Bachelor of Science degree in Information Technology offered by Florida National University. This Bachelor’s degree prepares you to pursue various IT positions such as database and system administrators, web and application developers, network analysts, security analysts, security risk assessors, and IT implementation specialists.
Along with the initial information technology core courses, the program includes cybersecurity and computer forensics concentrations to prepare students to work as security risk assessors or analysts. This program also prepares you for many of the industry’s top certifications, including CompTIA A+.
Eager to Learn More?
Information Technology encompasses all aspects of computing technology. A bachelor’s degree applies modern technologies to programming for traditional, web, and mobile applications and covers networking, information security, and databases. The courses also prepare the student for many of the industry’s top certifications.
If you are interested in information technology, let Florida National University answer any questions. Contact us today to learn more about our Information Technology program.
