Information Security Management

Overview of Information Security Management

Modern organizations today are creating, aggregating, and storing massive amounts of information from their customers, including behavioural analytics, data usage, personal information, credit cards and payment data, and more. There has been an increase in enterprise data collection over the past decade, along with the increasing threat of cyber-attacks and data breaches, this has led to significant developments in the field of Information Security Management for IT organizations.

Information security management describes the set of policies and procedural controls that IT organizations implement to secure their informational assets against threats and new age vulnerabilities. Responsibility for information security may be assigned to a Chief Information Officer, Chief Security Officer, Chief Technical Officer, or an IT Operations manager whose team includes IT operators and security analysts. Organizations have to develop a formal, documented process for managing InfoSec – often called an Information Security Management System or ISMS.

Why there is a need for organizations to develop a comprehensive security strategy?

The security strategy of the organization defines and prioritizes information assurance and security initiatives that the organization must commence enhancing the protection of information and related technology. Ideally, an organization should consolidate previously identified and executed projects (where practical), provide scope and definition for each of the identified efforts, detail the general risks addressed by the initiative, and provide a foundation that can later be refined by senior management. Additionally, to support higher-level evaluation of initiatives that can be undertaken when required, the security strategy planning process needs to identify any significant dependencies associated with the key business initiatives.

The main reasons for having Information Security Management  

Confidentiality: Confidentiality measures are designed to protect against unauthorized disclosure of information. The objective of the confidentiality principle is to ensure that private information remains private and which can only be viewed or accessed by individuals who need that information in order to complete their job duties as set by the organisation.

Integrity: Involves protection from unauthorized modifications (e.g., add, delete, or change) of data. The principle of integrity is designed to ensure that data can be trusted to be accurate and has not been inappropriately modified by unauthorized users.

Availability: this Is protecting the functionality of support systems and ensuring data is fully available at the point in time when it is needed by its users. The objective of availability is to ensure that data is available to be used when it is needed to make decisions and perform required actions as appropriate.

Why it is necessary to adopt Information Security Management by organizations?

For most of the organizations, information is their most imperative asset, so protecting it is fundamentally essential from the business continuity standpoint.

Information security management can help protect the organization’s ability to function, enables the safe operation of various applications implemented within the organization, protects the data which organization collects and uses for day-to-day business operations, and reduces business damage by preventing and minimizing the impact of security incidents/attacks.

Inadequate supervision of staff and lack of proper authorization procedures are frequently highlighted as the main causes of security attacks. Companies vary in their approach to prevent security breaches: some prohibit everything, making mundane access tasks difficult; others are too negligent and permit access to all by all, exposing themselves to a high degree of risk to run the business.

Ultimately, business efficiency relies on the right balance and that is where the standards can help organizations bridge the gaps.

By Rajesh Kapase
Director – Information Technology
Bengaluru, India