Introduction to Information Security….(InfoSec)
By: Suchindran Cs
Tags: Gdpr, Information Security, Infosec, Cism

Information Security is not one time activity but fundamentally a practice adopted by organizations to protect information by preventing unauthorized people from using , modifying and removal of information.

Such actions disrupts work activites, damaging company`s reputation having a tangible cost impact. Moreover, it is recommended for Organizations to include Security in their IT Strategy and allocate sufficient funds to detect, respond to and proactively prevent attacks. Notable attacks include Phishing, Malware, Viruses and Ransomware.

Principles of Information Security

The three basic principles of Information Security called CIA Triad are confidentiality, integrity and availability. Organizations must consider designing and incorporating one or two principles.

Confidentiality

Ensures unauthorized disclosure of information. It ensures information is accessible to the owner and visible to those who need it to perform organization functions.

Integrity

Ensures data is accurate and reliable with no modification to data accidentally or maliciously.

Availability

Ensures availability of data whenever an employee needs it by giving protection to systems and software.

Information Security Vs Cyber Security Vs Data Security

Information Security covers diverse areas such as Physical Security, Endpoint Security, Data Encryption and Network Security.

Cyber Security is a sub category of Information Security addressing Digital/Technology related threats, practices and its remediation.

Data Security protects an organization data from accidental deletion or malicious exposure to unauthorized personnel`s.

Information Security Policy

An Information Security Policy is a rule book for every employee upon using Organization Assets. Most of the companies create Information Security Policy and monitor whether their employee`s adhere to it.

Few Suggestions to make the policy effective are to review and update the document in a periodic manner based, lessons learnt from breaches and changes to security systems.

An Employee Handbook on the other hand shall compliment the Information Security Policy by being handy catalogue briefing procedures every employee has to follow for each of rules in the policy.

Common Security Threats

Some of the common Security Threats that are a priority for Security Teams at Modern Enterprises are

Poorly Secured Systems Malware Endpoints Security Misconfigurations Social Engineering

Laws and Regulations

Hereby listing Government Laws and Regulations that might have significant effect on Information Security

UK Data Protection Act GDPR Data Protection Act Health Insurance Portability and Accountability Act Sarbanes — Oxley Act Payment Card Industry Data Security Standard ( PCI DSS)

Information Security Certifications

Handful of Certifications are available focusing on InfoSec and Cyber Security broadly, that includes

CompTIA Security+ Certified Information Systems Auditor (CISA)

Advanced Certifications

Certified Information Systems Manager (CISM) Certified Information Systems Security Professional ( CISSP)

___________________________________________________________________