INFORMATION SECURITY - Towards A Safer Tomorrow
Concepts, frameworks and the real-world incidents that show why they matter.
By Basishtha Banerjee, SHRM Skill And Innovation Foundation
The central idea. Information security is not simply an IT function. It is the discipline of protecting information, systems, operations and trust through the coordinated action of people, processes and technology
Information Security Is Everyone’s Business
In May 2021, one leaked password for an old VPN account — with no second factor behind it — helped shut down a pipeline that carries almost half of the fuel on the US East Coast. In February 2024, a single remote-access portal without multi-factor authentication opened the door to an attack that disrupted pharmacies and clinics across the United States and exposed the data of roughly 190 million people. In 2016, forged payment messages moved $81 million out of a central bank’s account. None of these began with cinematic hacking. They began with small, ordinary gaps — and ended as business, safety and trust crises.
Information security (InfoSec) is the practice of protecting information, and the systems that create, store, process and transmit it, from unauthorised access, use, disclosure, disruption, modification or destruction. Its foundation is the CIA triad — confidentiality, integrity and availability — but modern practice reaches much further: cloud platforms, mobile endpoints, third-party vendors, operational technology and increasingly automated workflows. Every connection creates value, and potentially another path to compromise.
This blog distils the main ideas of the SHRM Skill and Innovation Foundation’s Information Security special edition — core concepts, threat actors, risk management, controls, NIST CSF and ISO/IEC 27001 — and anchors each one in documented incidents from healthcare, banking, retail, hospitality, energy and government, so the lessons are concrete and usable.
$4.44M global average cost of a data breach (IBM, 2025) | 241 days average time to identify and contain a breach (IBM, 2025) | 60% of breaches involve a human element (Verizon DBIR, 2025) | $7.42M average healthcare breach cost — highest of any sector (IBM, 2025) |
TL;DR. (1) Security is people + process + technology, not a product. (2) Most major breaches began with ordinary gaps — stolen credentials, unpatched systems, social engineering, flat networks. (3) The controls that keep paying off are MFA, fast patching, segmentation, tested recovery and a rehearsed incident response
What Is Information Security?
A useful way to understand InfoSec is to ask three questions. Who should be able to access this information? Can we trust that it is accurate? And will it be available when legitimate users need it? Those questions map directly to the CIA triad.
Beyond the triad. Practitioners also work with authenticity (is this user or message genuinely who it claims to be?), accountability (can actions be traced to an identity?) and privacy (is personal data handled lawfully and fairly?). The related terms differ in scope: information security protects information in any form — files, paper records, even a conversation; cybersecurity concentrates on the digital realm; IT security on technology assets. In practice they overlap, and the strongest programmes treat them as one.
InfoSec in everyday use: five use cases
InfoSec is easiest to appreciate where it is invisible. Each everyday service below depends on a different part of the triad — and a different set of controls — to be trustworthy enough to use.
Three myths worth retiring
“Security is the IT team’s job.” Verizon’s 2025 report found a human element in about 60% of breaches — everyone is part of the control system.
“We are too small to be a target.” Opportunistic attackers scan for weak passwords and unpatched systems regardless of an organisation’s size or sector.
“Compliance equals security.” A checklist proves controls exist, not that they work: Equifax had a patching process on paper, yet a known flaw stayed open for two months.
A practical test. A security control is valuable when it protects what matters to the organisation — not simply because it appears on a checklist. |
Threat Actors & Attack Vectors
Attackers differ in motive, skill and patience, but defenders must plan around methods and pathways, not just named adversaries. The same stolen password works equally well for a criminal gang, a state-backed team or a lone opportunist
Common attack vectors
Anatomy of an attack: how one small decision becomes a big incident
Incidents rarely begin dramatically. A finance employee gets an urgent message from a “known vendor”; a help-desk agent is asked for a “quick” password reset. Under time pressure someone decides — and the attacker turns that small opening into privilege, lateral movement, data theft or disruption. Defenders get several chances to break the chain:
Four-step story: it starts small, attackers act, impact is real — and solutions exist.
The defensive lesson. The best time to stop an attack is often before the first compromise: verify unexpected requests, use MFA, patch, monitor unusual activity and make reporting easy and blame-free. |
Risk Management & Security Controls
Security begins with understanding risk. A risk exists when a threat can exploit a vulnerability to cause an impact on an asset, process, person or organisation. Good programmes therefore start with four questions: what matters most, what can go wrong, how likely is it, and what would it cost?
The five-step risk cycle
Risk can be mitigated (add controls), transferred (insurance, contracts), avoided (retire the activity) or accepted (consciously, with sign-off). Prioritisation matters because resources are finite — and the incidents in this post show that attackers rarely need exotic techniques. They exploit the gaps that were known but not yet closed
Layered security controls
Principles that cut across every layer: least privilege (only the access needed), defence in depth (no single control is a single point of failure), zero trust (verify every user and device; assume breach), separation of duties (high-value actions need two people), and recoverability (the 3-2-1 backup rule, with at least one copy offline or immutable).
Prioritising risk: a simple heat map
Plotting likelihood against impact turns a long list of worries into an ordered to-do list. The placements below are illustrative; every organisation should draw its own
NIST CSF and ISO/IEC 27001: Two Complementary Lenses
The NIST Cybersecurity Framework (CSF) and ISO/IEC 27001 are often treated as rivals; they are better understood as partners. NIST CSF provides a practical cybersecurity lifecycle; ISO/IEC 27001 establishes a management-system approach for governing information security.
How they work together
An organisation can use NIST CSF to structure daily cybersecurity activity — understanding assets and risks, implementing safeguards, detecting threats, responding to incidents and recovering operations — while ISO/IEC 27001 supplies the governance structure, documented processes, accountability and continual-improvement discipline that keep those practices sustainable. Other resources fit alongside: the CIS Critical Security Controls (prioritised practical actions), MITRE ATT&CK (a catalogue of real attacker behaviours) and OWASP (application security).
The India lens. CERT-In’s 2022 directions require specified cyber incidents to be reported within six hours, and the Digital Personal Data Protection Act, 2023 sets duties for handling personal data. For Indian organisations, incident readiness is a compliance matter as well as a security one. |
What is next: AI and identity
Two forces are reshaping the picture. AI helps attackers write convincing phishing and clone voices — in early 2024 a finance employee at engineering firm Arup was deceived by a deepfake video call into transferring about $25 million — while defenders use it to speed up detection; IBM found organisations using security AI and automation extensively saved about $1.9 million per breach, whereas unsanctioned “shadow AI” added roughly $670,000. And identity has become the new perimeter: as systems move to the cloud, the login is the front door, which is why stolen credentials and help-desk impersonation feature in so many incidents.
Quick glossary
When InfoSec Becomes a Business, Safety and Trust Issue
Impact is not measured only in stolen files. An incident can interrupt patient care, move money fraudulently, close hotel operations, disrupt fuel supply, damage reputation and trigger regulatory action.
The ten incident files below span 2013–2024 and six sectors. Each follows the same pattern — what happened, then the lesson to carry into your own organisation. Read them against the CIA triad: Equifax and Marriott were confidentiality failures, Bangladesh Bank an integrity failure, and Colonial, WannaCry and the hospital attacks availability failures. Several were all three.
Figures come from regulator findings, company disclosures and public reporting, and may be revised as investigations continue.
01 Target (2013) Retail • Third-party access |
Attackers stole network credentials from a refrigeration and HVAC contractor, used them to reach Target’s network and spread to point-of-sale systems, where memory-scraping malware captured card data during the holiday season. About 40 million payment-card records and 70 million customer records were exposed. Security tools reportedly raised alerts that were not acted on; Target later agreed an $18.5 million settlement with US state attorneys general. Lesson Vendors are part of your attack surface. Segment partner access from payment systems, and make sure someone owns — and acts on — alerts. |
02 Bangladesh Bank (2016) Banking • Payment fraud |
Attackers compromised the central bank’s systems, obtained SWIFT credentials and sent 35 fraudulent payment requests worth about $951 million against its account at the New York Fed. Most were blocked — a typo in one recipient’s name prompted a query that halted further transfers — but five transfers totalling about $101 million went through. Roughly $81 million reached accounts in the Philippines and was laundered through casinos; only a fraction has been recovered. US prosecutors later charged a North Korean programmer in connection with the campaign. Lesson Never rely on a single control. Isolate payment systems, require independent verification of high-value transfers and monitor for out-of-pattern activity — including at weekends. |
03 WannaCry (2017) Multi-sector • Unpatched vulnerability |
In May 2017 a ransomware worm used the EternalBlue exploit against unpatched Windows systems — a flaw Microsoft had fixed two months earlier. It spread to more than 200,000 computers in about 150 countries within days. In England’s NHS, 80 of 236 hospital trusts were disrupted and about 19,000 appointments cancelled; the Department of Health put the cost at £92 million. A researcher’s discovery of a “kill-switch” domain slowed the spread. Lesson Patch known vulnerabilities fast, retire unsupported systems, segment networks and test backups before you need them. |
04 Equifax (2017) Credit reporting • Unpatched web application |
Attackers exploited a known flaw in Apache Struts, a web-application framework, on a consumer-dispute portal; a fix had been available for two months. They stayed inside for about 76 days, and a lapsed digital certificate had left a traffic-inspection tool blind for roughly 19 months, delaying detection. Personal data of about 147 million people, including Social Security numbers, was exposed. Equifax agreed a settlement of at least $575 million in 2019. Lesson Keep an asset inventory, set patch deadlines for internet-facing systems, and monitor the health of your monitoring tools. |
05 Marriott / Starwood (2014–2018) Hospitality • Inherited risk |
Attackers accessed Starwood’s guest-reservation database in 2014 — two years before Marriott acquired the company — and stayed undetected until 2018. Marriott ultimately reported about 383 million guest records involved, including millions of passport numbers. The UK’s ICO fined Marriott £18.4 million in 2020, and a 2024 US FTC order required a comprehensive security programme. Lesson Security due diligence belongs in every merger. Encrypt sensitive fields, limit retention and never inherit a network you haven’t assessed. |
06 SolarWinds (2020) Government & enterprise • Supply chain |
Intruders — attributed by the US government to Russia’s foreign intelligence service — inserted a backdoor, later named SUNBURST, into the build process for SolarWinds’ Orion software. Roughly 18,000 customers installed the tainted update; a far smaller group, including US federal agencies, was then targeted for espionage. It went unnoticed for months, until FireEye found it while investigating its own breach. Lesson Trusted software can be a delivery mechanism. Secure build pipelines, ask suppliers for transparency and apply zero-trust principles internally. |
07 Colonial Pipeline (2021) Energy • Ransomware |
The DarkSide ransomware group entered through a legacy VPN account protected only by a password. Colonial halted about 5,500 miles of pipeline for roughly six days as a precaution, triggering fuel shortages and panic buying across the US South-East. The company paid about $4.4 million in ransom; US authorities later recovered about $2.3 million. Lesson Enforce MFA on all remote access, remove dormant accounts, separate IT from operational systems and rehearse shutdown and restart. |
08 HSE Ireland (2021) & AIIMS Delhi (2022) Healthcare • Ransomware |
Ireland’s national health service shut down its IT systems after a Conti ransomware attack in May 2021, disrupting outpatient and diagnostic services for weeks; recovery was reported at around €100 million. In November 2022 ransomware forced AIIMS Delhi, one of India’s most prominent hospitals, to run key services manually for about two weeks. Lesson In healthcare, availability is patient safety. Identity controls, segmentation, tested offline backups and downtime procedures for clinicians are clinical safeguards. |
09 MGM Resorts (2023) Hospitality • Social engineering |
Attackers linked to the “Scattered Spider” collective reportedly phoned the IT help desk, impersonating an employee identified on social media, to gain account access, then escalated privileges; ALPHV/BlackCat ransomware followed. Slot machines, digital room keys, reservations and payments were disrupted for days; MGM estimated a roughly $100 million hit to quarterly earnings. Lesson The help desk is an identity perimeter. Verify callers rigorously, use phishing-resistant MFA, tightly control privileged accounts and keep manual fall-backs for guest-facing operations. |
10 Change Healthcare (2024) Healthcare • Third-party concentration |
On 12 February 2024 criminals used stolen credentials to log in to a Citrix remote-access portal that had no MFA; nine days later ALPHV/BlackCat ransomware was deployed. Because Change processes a large share of US healthcare claims, pharmacies struggled to verify coverage, clinics went unpaid, and data on roughly 190 million people was ultimately affected — the largest healthcare data breach in US history. UnitedHealth confirmed a $22 million ransom payment. Lesson One missing control on one portal can cascade through a whole sector. Enforce MFA everywhere, test recovery, and map your dependence on critical third parties. |
Sector Use Cases: Different Risks, Same Fundamentals
Different Industries, Similar Patterns
Across incidents the entry point differs, but the same gaps keep recurring: weak or stolen credentials, social engineering, unpatched flaws, flat networks, slow detection and a gap between technical controls and human behaviour
Seven recurring lessons
Identity is the new perimeter. Put MFA — ideally phishing-resistant — on remote access, administrators and help-desk workflows.
Patch by exposure, not convenience. Internet-facing systems come first, and the clock is measured in days.
Segment so a breach stays local. Flat networks turned single compromises into enterprise-wide crises.
Detect — and act. Alerts nobody reads (Target) and tools that quietly stop working (Equifax) are not controls.
Manage third parties and inherited risk. Vendors, acquisitions and software suppliers share your fate.
Plan for recovery. Offline or immutable backups, tested restores, manual fall-backs and rehearsed communications.
Treat people as part of the control system. Combine training with easy, blame-free reporting.
Which control gaps mattered most?
When an Incident Hits: The First 24 Hours
Most organisations will eventually face an incident; what separates a contained event from a crisis is how well the response was prepared. The lifecycle below follows the widely used detect–contain–eradicate–recover–learn sequence, with an echo from the case files for each stage.
Practical Information Security Checklist
Security culture is built through repeatable habits. This checklist turns the special edition’s guidance into everyday actions — for individuals, and as a baseline for teams
From Knowledge to Action: A 30-60-90 Day Plan
Frameworks and case studies only matter when they change what happens on Monday morning. This plan suits a small organisation or a single department; larger teams can run it per business unit.
Build your skills: a learning pathway
Final takeaway
Information security is a continuous practice, not a one-time project. Threats evolve, technologies change, employees change roles, vendors change and new vulnerabilities emerge. Resilient organisations build security into everyday decisions: how identities
Want to become an AI ready cyber security professional? Explore our flagship program.
REFERENCES & FURTHER READING
1. NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, 2024.
2. ISO/IEC 27001:2022, Information security management systems — Requirements.
3. IBM and Ponemon Institute, Cost of a Data Breach Report 2025; Verizon, 2025 Data Breach Investigations Report.
4. US Senate Committee on Commerce, A “Kill Chain” Analysis of the 2013 Target Data Breach, 2014.
5. US DOJ, indictment of Park Jin Hyok (2018) — Bangladesh Bank heist and WannaCry attribution.
6. UK National Audit Office, Investigation: WannaCry cyber attack and the NHS, 2018.
7. US GAO, Data Protection: Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach, GAO-18-559; FTC Equifax settlement materials.
8. UK ICO monetary penalty notice, Marriott International (2020); US FTC order, Marriott/Starwood (2024).
9. CISA, Alert AA20-352A — Advanced Persistent Threat Compromise… (SolarWinds); CISA, AA21-131A — DarkSide Ransomware (Colonial Pipeline).
10. PwC, Conti cyber attack on the HSE: Independent Post Incident Review, 2021; MGM Resorts SEC Form 8-K (October 2023).
11. Statement of Andrew Witty, US House Energy & Commerce Committee, 2024 (Change Healthcare).
12. CERT-In Directions of 28 April 2022; Digital Personal Data Protection Act, 2023 (India).
Editorial note: illustrations in the special edition are educational reconstructions inspired by public information, not authenticated photographs. Incident figures reflect public sources as of October 2026; consult the latest editions of the sources above for formal research
Comments