How do You Avoid Information Security Breaches?

27 Jul

Table of Contents

With the news often including stories regarding high-profile information security breaches, many of us find ourselves asking how we can we avoid hitting the headlines for all the wrong reasons.  Let’s look at where we can start.  

Avoiding security breaches is not the responsibility of a single individual, irrespective of technical ability, knowledge or title. It is a collective responsibility, where each and every employee within an organisation is accountable to some degree for protecting information and avoiding a security breach. In simple terms, each employee should be asking themselves three questions:

  • What are we protecting?
  • From whom are we protecting it?
  • How are we going to protect it?

If you’re one of those employees who don’t know or are unclear about the answers, then the first port of call for internal advice and guidance should be your line manager.  If you’re the line manager and are not certain, then seek out your information security manager or, if that role doesn’t exist, the individual who has responsibility for information security.

What are we protecting?

Whilst the answer to the ‘What are we protecting?’ question would appear to be blindingly obvious, it is surprising how often the answer is unclear.  And if you don’t know what information you are managing/responsible for, how can you identify how to protect it?  Having a clear understanding of the information the organisation has is essential to identifying the measures needed to protect it.

Employees throughout an organisation will deal with a variety of information types, often with differing access control requirements.  However, it’s essential that all employees are clear on what that information is and how it should be managed and handled.  Information security professionals refer to this as an asset list and generally, ‘information classification and handling’.

From whom are we protecting our information?

So, once we know what we are protecting, we can look at who or what we are trying to protect against.  These are known as the threat vectors.  The threat vectors can be distinguished as internal or external and divided into human and technical.  These categories can have many different subcategories and typically depend on the geographical, political, economic situation in which the organisation is operating.  Whatever or whoever they are, it is important to identify them and to be realistic.

How are we going to protect it?

Having established the ‘what’ and ‘who’, we now turn to ‘how’.  Alas, there is no silver bullet or simple answer.  The first step is to ensure there is (or to introduce) a structure within the organisation and achieve a transparent and holistic approach to information security management.  The structure will define roles and responsibilities and will identify the means by which we will protect the information.

There are different information security frameworks that can support this; the International Organisation for Standardisation (ISO), the National Institute for Standards and Technology (NIST) and Control Objectives for Information and Related Technology (COBIT), to name but a few.  An information security risk assessment will identify where time, effort and investment are needed.  The most important point, however, is to encourage everyone (irrespective of their role) to take responsibility for information security and make them aware that all employees have a part to play.  Equally important is to ensure an open culture.  A reported near-miss could ensure the next security breach is avoided!

Do you need any help with ISO 27001 certificate?

URM can help you achieve ISO 27001 certification
Thumbnail of the Blog Illustration
Information Security
Published on
Key Things You Should Know About ISO 27001

ISO 27001 is a standard for Information Security Management that provides any organisation with a framework to protect most valuable assets.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
Developing an ISO 27001-Conformant Integrated Internal Control Framework

URM’s blog provides detailed guidance on aligning an existing control framework with ISO 27001, allowing you to certify and capitalise on previous work.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
What are the Primary Objectives of the Controls Detailed in Annex A of ISO 27001:2013?  

Annex A of ISO 27001 comprises 114 controls which are grouped into the following 14 control categories.

Read more
Great presentation - looking forward to your future events.
Webinar 'ISO 27001 Internal Auditing, the 6 Pillars of Success'
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.