The purpose of this paper is to identify three information security threats, potential risks, and the related vulnerabilities to an organization. We will go in depth to identify these harmful threats and describe each potential risk an organization may have to endure. We will also discuss three major information security threats dealing with SunTrust Bank. SunTrust bank headquartered in Atlanta, Ga operates 1,497 branches and over 2, 200 ATMs in the South and some in the North. SunTrust bank has over $175 billion in assets in the US and the money is increasing even more. The major assets that SunTrust has invested needs to be fully protected against potential information security threats from people trying to steal money or do harm to the organization. One of the major threats that SunTrust bank and other banks have to be cautious of is distributed-denial-of-service attacks or DDoS. A DDoS attack is designed for an attack on a single target by a group of compromised system infecting the target with a Trojan. There are two types of attacks associated with DDoS attacks, which are network-centric and application layer attack. There are two types of DDos attacks a network centric attack which overloads a service by using up bandwidth and an application-layer attack which overloads a service or database with application calls (Rouse, 2013). The most well known DDoS attack was committed by the Izz ad-Din al-Zassan Cyber fighters in 2012. These attacks were distributed in two phases: First phase they only attacked top-tier banks and the second phase they attacked credit unions and mid-tier banks. SunTrust was one of these banks and suffered intermittent outages and caused the website to suffer outages and glitches. The DDoS attack caused the servers at SunTrust to over load and this caused the site to be inaccessible in some parts of the country and at different times throughout the day. The cause of attack was in protest of a YouTube movie that was posted on YouTube that the group deemed offensive to their culture. The fighters issued a statement to take down the video immediately and that would be the simplest solution but the United States would still be punished, because of the insult. This caused some people to panic and scramble to try to prevent this attack from happening.
Another threat SunTrust has to worry about is Zeus attacks, also known as Zbot. This malware toolkit gives the user the ability to create its own individual Trojan horse. The unique ability of the Zeus Trojan is that it remains dormant and allows the user to add fields on forms at a browser level. Meaning the end user will be on a legitimate site filling out information that the criminal can see and steal suing the information to drain bank accounts. The Mobile Zeus was created to attack mobile phone, which then can attack mobile banking accounts to steal mTAN codes from bank users. mTAN codes are the mobile Transaction Number used for some banks as a onetime password. Similar to Zeus for PC they steal the information and passwords to gain access, which in this case is the mTAN code. The code would be sent to the Zitmo-infected handset, which immediately forwarded it to the malicious user’s number, who would then use the stolen mTAN to authenticate the transaction (Maslennikov, 2014). This Trojan is becoming increasingly popular and SunTrust should inform its customers of such attacks, so they can better protect themselves. SunTrust and users needs to install software specifically for these mobile Trojans, such as Kapersky Internet Security-Multi-Device and Kapersky PURE. Mobile users can also download this software on their phones to help prevent these attacks.
Another threat SunTrust has to worry about is phishing. Phishing is a way to acquire someone’s information over the internet by deception. There are many techniques that are used for phishing and come in many forms, such as email, SMS phishing, spear phishing, web based delivery, links, key loggers, and Trojan horses are some of the techniques of phishing. Email or spear fishing is a fraudulent email that targets a specific organization is an attempt to gain unauthorized data. The email asks the employee to log into a bogus page that requests the employee’s user name and password or click on a link that will download spyware or other malicious programming (Rouse, 2011). Once an attacker has the information he or she can use the information to steal your money. Web based delivery, also known as man-in-the-middle is more sophisticated than the other techniques involving the original website and the phishing system. When the user puts in their information the attackers gathers the user information without them ever knowing anything.
SMS phishing or smishing is an email scam that comes in a short message service, also known as a text message that directs the user to visit a website or call a phone number, which then the user may provide his or her confidential information, such as passwords or credit card information. When the user provides the information the attacker retrieves it and uses the information. Email phishing is probably the most common phishing scam. This phishing scam involves the attacker sending large quantities of the same email to users, asking them to fill out personal information. The emails depending on the attacker may ask you to verify the account, ask you to update your account information, or send a link for you to click to have access to a new service. A key logger is a type of malware that can be used on computers and mobile phone to identify the user inputs from the keyboard they are using. The attacker then deciphers the information and gains access to the confidential information.
Threats and vulnerability combine to make up of the risk-management process and can cause an organization to lose millions of dollars if not identified and handled properly. An organization should know the value of its asset that it’s protecting. Otherwise the organization may spend more money to protect it then what the asset is worth. Threats and vulnerabilities can occur from computer codes, intentional or unintentional from employees, or natural factors. Creating a table and listing all threat type, the actual threat, vulnerability, and the exposed risk can help show the organization the relationship of threats, vulnerabilities, and the risk associated with them. The legal requirement of protecting data is followed by the Data Protection Act 1988. DPA 1988 is an act created by the United Kingdom Parliament explaining the ways information can be legally used and handled. DPA 1988 is broken into six parts with 16 notes called schedules. The parts explain the ways data can be handled by whoever has the data, the rights of the subject, and all special exemptions. Schedules explain parts in a more detailed fashion and list all legal interpretations and contingencies. Ethical is pertaining to morals and how an individual or group deals with some form of knowledge. The ethical requirement is not to share, exploit, or bribe people of their data that you may have of theirs for money or any other malicious act. Regulatory is to regulate and control how the data is kept.

REFERENCES
Rouse, M. (2013). distributed denial-of-service-attack. Retrieved from http://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attack

Maslennikov, D. (2011). Zeus-in-the-Middle- Facts and Theories. Retrieved from http://www.securelist.com/en/analysis/204792194/ZeuS_in_the_Mobile_Facts_and_Th qeories

Rouse, M. (2011). Spear Fishing. Retrieved from
http://searchsecurity.techtarget.com/definition/spear-phishing