How do You Avoid Information Security Breaches?

27 Jul

With the news often including stories regarding high-profile information security breaches, many of us find ourselves asking how we can we avoid hitting the headlines for all the wrong reasons.  Let’s look at where we can start.  

Avoiding security breaches is not the responsibility of a single individual, irrespective of technical ability, knowledge or title. It is a collective responsibility, where each and every employee within an organisation is accountable to some degree for protecting information and avoiding a security breach. In simple terms, each employee should be asking themselves three questions:

  • What are we protecting?
  • From whom are we protecting it?
  • How are we going to protect it?

If you’re one of those employees who don’t know or are unclear about the answers, then the first port of call for internal advice and guidance should be your line manager.  If you’re the line manager and are not certain, then seek out your information security manager or, if that role doesn’t exist, the individual who has responsibility for information security.

What are we protecting?

Whilst the answer to the ‘What are we protecting?’ question would appear to be blindingly obvious, it is surprising how often the answer is unclear.  And if you don’t know what information you are managing/responsible for, how can you identify how to protect it?  Having a clear understanding of the information the organisation has is essential to identifying the measures needed to protect it.

Employees throughout an organisation will deal with a variety of information types, often with differing access control requirements.  However, it’s essential that all employees are clear on what that information is and how it should be managed and handled.  Information security professionals refer to this as an asset list and generally, ‘information classification and handling’.

From whom are we protecting our information?

So, once we know what we are protecting, we can look at who or what we are trying to protect against.  These are known as the threat vectors.  The threat vectors can be distinguished as internal or external and divided into human and technical.  These categories can have many different subcategories and typically depend on the geographical, political, economic situation in which the organisation is operating.  Whatever or whoever they are, it is important to identify them and to be realistic.

How are we going to protect it?

Having established the ‘what’ and ‘who’, we now turn to ‘how’.  Alas, there is no silver bullet or simple answer.  The first step is to ensure there is (or to introduce) a structure within the organisation and achieve a transparent and holistic approach to information security management.  The structure will define roles and responsibilities and will identify the means by which we will protect the information.

There are different information security frameworks that can support this; the International Organisation for Standardisation (ISO), the National Institute for Standards and Technology (NIST) and Control Objectives for Information and Related Technology (COBIT), to name but a few.  An information security risk assessment will identify where time, effort and investment are needed.  The most important point, however, is to encourage everyone (irrespective of their role) to take responsibility for information security and make them aware that all employees have a part to play.  Equally important is to ensure an open culture.  A reported near-miss could ensure the next security breach is avoided!

Thumbnail of the Blog Illustration
Information Security
Published on
Information Security Management Systems, ISO 27001 and the Benefits of Implementation

In this blog, we’re going back to basics and looking at some of the fundamentals of information security and ISO 27001.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
What are the Primary Objectives of the Controls Detailed in Annex A of ISO 27001:2013?  

Annex A of ISO 27001 comprises 114 controls which are grouped into the following 14 control categories.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
What is the Difference Between IT and Information Governance?

In this blog, we are going to look at governance. We are regularly asked, ‘is information governance the same as IT governance?’

Read more
Thought the level of content and presentation was excellent and very informative and the information was useful - one of the best webinars I've attended.
Webinar 'ISO 27001:2022 – What’s new?'
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.