Big Data Threats and Countermeasures in IT Risk Management

This report provides an in-depth analysis of IT risk management in the context of big data, focusing on the threats and countermeasures. The report begins by introducing the European Union Agency for Network and Information Security (ENISA) and its role in IT security within the EU. It then explores the concept of big data, its applications, and the associated risks, including data breaches, privacy concerns, and conflicts among stakeholders. The report highlights specific threats such as data leakage through web applications (unsecure APIs) and the vulnerabilities in big data software. It also identifies various threat agents, including corporations, cybercriminals, cyber terrorists, and employees, and the potential impact of their actions. The report further discusses the shortcomings of current countermeasures, emphasizing the need for new approaches. It provides recommendations for future countermeasures, such as defining big data-specific solutions, identifying gaps in current practices, training IT professionals, and developing tools for security and privacy. The report concludes by emphasizing the importance of proactive measures to protect big data and ensure its continued use in the future, including an overview of the ETL process.

Running head: IT RISK MANAGEMENT
IT RISK MANAGEMENT
Name of Student
Name of University
Author’s Note

1IT RISK MANAGEMENT
1. The following assignment is the analysis of the big data threats and the steps which is taken to
prevent the threats of the big data. The given assignment discusses about an organization known
as the European Union Agency for Network and Information Security (ENISA) the center of
network and the expert in the Information technology securities threat which assist the European
nation bodies. The ENISA organization works with the members of the EU in assisting the
securities related to the IT. The ENISA is also responsible for improving network and provide
security to the entire European nations. The Big data is the collection of the huge data which is
not only complex and not useful the purpose of the big data is to derive some pattern or the
algorithm from these data to study the pattern which may include the behavior of the people
related to certain companies (Kimwele, 2014). The source of the data can be from anywhere like
the application of the internet of things or telecommunication and it can be in huge amount. The
application of the big data is increasing every day and a more advanced and matured technique is
getting developed to use the big data to derive the information (Kitchin, 2014). Many companies
have admitted that the application of the big data has been huge and it has increased the
effectiveness and efficiency in making the decision in the business. It is expected that in the
coming days the demand of the big data is going to increase in all the sectors of the company be
it a healthcare, banks, markets specially in for the military purpose and intelligence system.
However despite of all its business there is various risks associated with the big data which is the
prime targets of the hackers to retrieve the information. There are various threats related to the
big data some of them are:
Through the usage of the big data not only the original data but the confidential data are
also at risk as with the high replication of the big data for purpose to store and the outsourcing of

2IT RISK MANAGEMENT
the big data these type of the technology are new ways of the breaching and the leakage of the
data.
The big data are posing threat to the privacy of the individual which has the impact on the
data protection. In the big data at the time of the creation of the link at the collection of the data
is the major cause of the penalization the extra creation of the link is the major cause of the
leakage of the information and data.
Thirdly different stake holders of the big data like the service providers data transformers,
data owners have different opinion about the usage of the data thus their idea of usage of the data
may conflict which makes it’s a difficult environment to opiate upon. Thus in such difficult
envenom t the security of the data may be compromised.
Lastly in many areas of the information and communication technology (ICT) .They are
applying own security and privacy which is the best practice according to them but it would
relatively decrease the all over security and the privacy risk related big data area(Walker 2014).
As still in the early stage of the big data the rising pattern is embracing the Security-by-default
principle which has proved to be both practical as compared to the effort and cost in term of time
and money required to provide ad hoc solutions for the problem later on.
Lastly the assignment analyses how there are huge gap between the problems related to
the big data and the counter measures to tackle the problems of the big data. Therefore the
assignment discuses about the lack of the proper countermeasures of the big data and how
important is to take correct counter measures so that the next generation can also utilize the
application of the big data. Therefore in the particular a valid question rises whether the current
trends of the countermeasures for taking up the existing solutions which is against the data

3IT RISK MANAGEMENT
threats in the Big Data which mainly focuses on the amount of the data. The current
countermeasures are made which is mainly to counter the scalabilities of the big data which does
not fit the big data problems which results in the partial and ineffective approach to the
protection of the big data(Walker 2014). The assignment enlists some of the guidelines and
approaches for the countermeasure of the next generation of the data.
Some of the recommendations enlisted are as remarked by the assignment are:
I) to stop following the current approach to the traditional data and work on defining the Big
Data related solutions
ii) To find and identify the gaps and required needs for the current practices and to work in
planning the specific definition and the specific standardization activities.
iii) To work in training and teaching the IT profession nals about the big data and teach they
correct measures of usage of the big data.
iv) To work in defining the correct tools and measures for security and privacy for the protection
of Big Data and it environments
v) To clearly find and identify the assets to the Big Data and to simplify the selection of
solutions mitigating risks and threats (Walker 2014).

4IT RISK MANAGEMENT
Figure 1: ENISA Big Data security infrastructure
(Source: Created by the author )
2. Various major threats have been listed by the assignment. Some of them are:
 Threat due to Information leakage and sharing because of the human error
 Threat due to Leakage of the data through the Web applications (unsecure APIs)
 Threat due to inadequate planning and design or incorrect adaptation.
 Threat due to inception of the information.

5IT RISK MANAGEMENT
Above all the threats described by the assignment the significant threat can be leaks of the
data via Web applications (unsecure APIs). As all the threat described by the assignment is a
human error and it can be corrected with proper attention but the breaching of the data due to
Web applications (unsecure APIs) is the breach which can take place due to the software which
do not have enough capability to protect the data (Halenar, 2012). According to the assignment
various sources has claimed that the security is of the less concern while building the big data.
The new software components designed for the protection of the big data is usually built with the
authorization of the service level, but there are few utilities which is available to protect the core
features and application interfaces (APIs) (Kayworth & Whitten, 2012). As we know that the big
data are built and designed on the web services models. The application interfaces (APIs)
become a prime target to well-known cyber attacks, like the Open Web Application Security
Project (OWASP). Which is in the top ten lists and there are few countermeasures to tackle them.
The vendor of the security software Computer Associate (CA) and various other related sources
find out via report that the data breaches are due to not a secure application interfaces (APIs), in
various industries such as the photo and video sharing services and especially the social
networks which includes the Face book, Yahoo and Snap chat (Chen & Zhang, 2014). An
example can be demonstrated the threat in the social networks and can be the injection attack to a
company known as the Semantic Web technologies through the injection of the SPARQL code.
The flaws in the security are very common in the newly available big data languages such as the
RDQL and the SPARQL where both are read-only query languages. The utilization of the newly
designed query languages has introduced the vulnerabilities which was already present in the
misuse of the query languages of the old-style. The attacks on the languages like SQL, LDAP
and Path are well known and dangerous for the usage. The libraries of this new language have

6IT RISK MANAGEMENT
been given the tools to check the user input and simultaneously minimizing the risk. There are
other big data software products for an example Monod, Hive and Couched who also suffers
from the traditional threats which includes the execution of the code and the remote SQL
injection. The assets targeted by these threats belong to group “Data” and asset type “Storage
Infrastructure models” (such as “Database management systems (DBS)” and “Semantic Web
tools”).
3. According to the assignment the threat agent is someone who has the clear intention and
decent capability to plant a threat regarding the usage of the big data systems (O’Driscoll,
Daugelaite & Sleator, 2013). It is crucial for the users of the big data to be aware of these threats
and prevent them in their system. The various categories of the threat agents are
Corporations: The category of the cooperation comes under the organizations which are
involved in the tactics. In this category the cooperation are considers as the threat agents whose
motivation and aim is to gain a competitive advantages over their competitors which is their
main target. Depending on the cooperation’s size and its sector these corporations usually
acquire the significant capabilities which range from the technology in the area of their
expertise.
Cyber criminals: Another threat agent is the cyber criminals the main target of these
cyber criminals is to financial gain and they hack and breach the data of the company which is
confidential and has a high demand in the market. These cyber criminals opiates on all levels be
it a local or a global operator.
Cyber terrorist: the main differed between the Cyber criminals and the Cyber terrorist is
that the motive behind the data breaching is not only financial but also political, religious or

7IT RISK MANAGEMENT
social gain over the people (Labrinidis & Jagadish, 2012). They basically operate at the global
level to spread terror in the country and target the critical infrastructure o the country which
includes the health and financial sector of the country which cause severe impact in society and
government.
Script kiddies: they are basically unskilled or incapable hackers who use the programme
and scripts of the hackers to hack the computer system.
Online social hackers (activists): The hackers who target the social media are politically
and socially motivated individuals which use the platform to promote their believing and causes
They mainly targets small children and girls to torture them mentally and promote cyber bullying
in the social media.
Employees: This category of the threat agent involves the people who works for the
particular organization and have access to the data of the company. They mainly are the security
guards or the operational staffs who are bribed by the individuals to steal the data (Zikopoulos &
Eaton, 2011).
Nation states: Nation state is the rising threat which has become prominent in the recent
times. The Threat agent which are due to the deployment of sophisticated attacks which are
considered as cyber weapons with the capability of these malware (Provost & Fawcett, 2013).
The above threat agents identified implies that to avoid these threats people while using
the social media should not post their private details such as the photograph or location as it can
use by the hackers to cyber bully the users. Secondly the company needs to keep tab on their
employees of their activities against and stealing of the data.

8IT RISK MANAGEMENT
4. The ETL is full form is extraction, transformation, and loading. ETL is the process in which
the data is extracted from the source system and brought into the data warehouse. The first step is
the extraction where the data is extracted from the various sources and is assembled in the certain
place the second step is the transformation phase where the data is transformed according to the
target requirement and last phase is the loading phase it is the phase in which the data is loaded
into its warehouse and ready for the delivery (Boyd & Crawford, 2012).
For the better performance of the ETL various steps are enlisted:
Loading the data incrementally: For the proper management of the data it should be arrange in
certain matter which can be increasing or decreasing or any order according to the user need it
will help in better management of the data and it will to find the record afterward as the user will
remember the pattern (Tankard, 2012).
The partition of the large tables: Using the relational database its use can be improved by
the partition of the large tables when the large table data are segmented into the smaller part it
will help in quicker and efficient access of the data (Singh & Khaira, 2013). It will allow easier
switching of the data and quick insertion, deletion and updating of the table.
Cutting out the extra data: sometimes the table of data can become complex due to
presence of the unwanted data. Therefore the table should be properly analyzes and the not
required data should be eliminated to make the table more simple and easily accessible.
Usage of the software: various software like hardtop and the map reduce which is
designed for the distributed processing of large data over a cluster of machines (Al-Aqrabi et al
2012). It uses the HDFS application which segments data into the small part and make them into

9IT RISK MANAGEMENT
simple cluster. The data which is duplicated through which the system maintains the integrity
automatically.
5. According to the case study European Union Agency for Network and Information Security
(ENISA) which is center of the network and the expert in the Information technology securities
threat which assist the European nation bodies is currently not satisfied with the IT securities that
is followed in the world it has enlists the various securities which includes the usage of the big
data which is not only the original data but the confidential data which are at risk as with the
high replication of the big data for the purpose of storage and the outsourcing of the big data
these type of the technology are new ways of the breaching and the leakage of the data. Secondly
the big data are posing threat to the privacy of the individual which has the impact on the data
protection (Ackermann, 2012). The assignment also enlists 5 major threats related to the data
mining. The assignment also enlists threat agent such as cooperation, people, cybercrime which
spreads the online hacking. The assignment finally enlists countermeasures made mainly to
counter the scalabilities of the big data which does not fit the big data problems which results in
the partial and ineffective approach to the protection of the big data (Ackermann et al 2012).
Thus the assignment clearly explains the current counter measures for the big data is not enough
and should implement better strategies to avoid the misuse of the big data.

10IT RISK MANAGEMENT
References
Ackermann, T. (2012). IT security risk management: perceived IT security risks in the context of
Cloud Computing. Springer Science & Business Media.
Ackermann, T., Widjaja, T., Benlian, A., & Buxmann, P. (2012). Perceived IT security risks of
cloud computing: Conceptualization and scale development.
Al-Aqrabi, H., Liu, L., Xu, J., Hill, R., Antonopoulos, N., & Zhan, Y. (2012, April).
Investigation of IT security and compliance challenges in Security-as-a-Service for Cloud
Computing. In Object/Component/Service-Oriented Real-Time Distributed Computing
Workshops (ISORCW), 2012 15th IEEE International Symposium on (pp. 124-129).
IEEE.
Amanpartap Singh, P. A. L. L., & Khaira, J. S. (2013). A comparative review of extraction,
transformation and loading tools. Database Systems Journal BOARD, 42.
Boyd, D., & Crawford, K. (2012). Critical questions for big data: Provocations for a cultural,
technological, and scholarly phenomenon. Information, communication & society, 15(5),
662-679.
Chen, C. P., & Zhang, C. Y. (2014). Data-intensive applications, challenges, techniques and
technologies: A survey on Big Data. Information Sciences, 275, 314-347.
Crossler, R. E., Johnston, A. C., Lowry, P. B., Hu, Q., Warkentin, M., & Baskerville, R. (2013).
Future directions for behavioral information security research. computers & security, 32,
90-101.

11IT RISK MANAGEMENT
Halenar, R. (2012). Real Time ETL Improvement. International Journal of Computer Theory
and Engineering, 4(3), 405
John Walker, S. (2014). Big data: A revolution that will transform how we live, work, and think.
Kayworth, T., & Whitten, D. (2012). Effective information security requires a balance of social
and technology factors.
Kimwele, M. W. (2014). Information technology (IT) security in small and medium enterprises
(SMEs). In Information Systems for Small and Medium-sized Enterprises (pp. 47-64).
Springer Berlin Heidelberg.
Kitchin, R. (2014). The data revolution: Big data, open data, data infrastructures and their
consequences. Sage.
Labrinidis, A., & Jagadish, H. V. (2012). Challenges and opportunities with big
data. Proceedings of the VLDB Endowment, 5(12), 2032-2033.
Loske, A., Widjaja, T., & Buxmann, P. (2013). Cloud Computing Providers’ Unrealistic
Optimism regarding IT Security Risks: A Threat to Users?.
McAfee, A., Brynjolfsson, E., & Davenport, T. H. (2012). Big data: the management
revolution. Harvard business review, 90(10), 60-68.
O’Driscoll, A., Daugelaite, J., & Sleator, R. D. (2013). ‘Big data’, Hadoop and cloud computing
in genomics. Journal of biomedical informatics, 46(5), 774-781.
Provost, F., & Fawcett, T. (2013). Data science and its relationship to big data and data-driven
decision making. Big Data, 1(1), 51-59.