INFORMATION SECURITY WHY IT MATTERS

[vc_row][vc_column][vc_single_image image=”1979″ img_size=”large” alignment=”center”][/vc_column][/vc_row][vc_row][vc_column][vc_column_text]

Globally, the information security market is expected to grow at a five-year CAGR of 8.5% to reach $170.4 billion in 2022. This growth projection is expected to take this trend mainly due to increased regulations and awareness in organizations on the complex threats, according to Gartner Research.

Unfortunately, many organizations have the belief that once they have installed an Endpoint Detection Response system or carried out an audit of their systems at one point, with no foreseeable vulnerabilities they are safe in the long run, right?

Wrong, this is where majority of organizations fail. With the advancement of cyber related crimes such as phishing, malware attacks, vulnerability attacks, offline systems, information security experts need to be more vigilant in ensuring the confidentiality, integrity, and availability of information at all points in time.

[/vc_column_text][/vc_column][/vc_row][vc_row][vc_column][vc_custom_heading text=”What is Information Security?” font_container=”tag:h5|text_align:left|color:%2381d742″ google_fonts=”font_family:Montserrat%3Aregular%2C700|font_style:700%20bold%20regular%3A700%3Anormal”][/vc_column][/vc_row][vc_row][vc_column][vc_column_text]

This is the design and implementation of protocols used to guard against unauthorized access to, modification of, or destruction of confidential data, whether in digital or nondigital format. This cuts across, passwords, employee records, supplier records, contract information, personal information etc.

Think about this, what is your most valuable asset? Is it information or the information asset?

What could be the result if the confidentiality, integrity, and availability of this Information is breached?

What are we as an organization not doing right to protect information (vulnerability)?

[/vc_column_text][/vc_column][/vc_row][vc_row][vc_column][vc_custom_heading text=”Why Information Security?” font_container=”tag:h5|text_align:left|color:%2381d742″ google_fonts=”font_family:Montserrat%3Aregular%2C700|font_style:700%20bold%20regular%3A700%3Anormal”][/vc_column][/vc_row][vc_row][vc_column][vc_column_text]

• Information is valuable to every organization (the value may vary depending on the nature of the organization).
• Organization processes will always have something to do with either data generation, processing, or consumption, right?
• Legal, Regulatory and or contractual requirements, think about GDPR (General Data Protection Regulation) that cuts across all EU members. In Kenya we have the Data Protection Act 2019 that seeks to regulate how data processors acquire, process and protect personally Identified Information.
• Increase in information security treats.

[/vc_column_text][/vc_column][/vc_row][vc_row][vc_column][vc_custom_heading text=”Cost of data breach” font_container=”tag:h5|text_align:left|color:%2381d742″ google_fonts=”font_family:Montserrat%3Aregular%2C700|font_style:700%20bold%20regular%3A700%3Anormal”][/vc_column][/vc_row][vc_row][vc_column][vc_column_text]

According to IBM the average cost of data breach is $3.86 million in 2020.

• Financial implications via fines and forensic investigations.
• Negative organizational reputation or loss of customer trust.
• Legal implications that might even result to closure of business.

[/vc_column_text][/vc_column][/vc_row][vc_row][vc_column][vc_custom_heading text=”Where to start?” font_container=”tag:h5|text_align:left|color:%2381d742″ google_fonts=”font_family:Montserrat%3Aregular%2C700|font_style:700%20bold%20regular%3A700%3Anormal”][/vc_column][/vc_row][vc_row][vc_column][vc_column_text]

Considering a risk-based approach will be of much value to the organization that is, having an Information Security Management System in place.

An Information Security Management System is a systematic approach consisting of processes, technology and people that helps you protect and manage your organisation’s information through effective risk management. 

Every organization should pay attention to Information Security risks around its processes, technologies, and people.

The best way to solve a problem is addressing root cause not forcing the “results”.

[/vc_column_text][/vc_column][/vc_row][vc_row][vc_column][vc_custom_heading text=”Benefits of having an Information Security Management System:” font_container=”tag:h5|text_align:left|color:%2381d742″ google_fonts=”font_family:Montserrat%3Aregular%2C700|font_style:700%20bold%20regular%3A700%3Anormal”][/vc_column][/vc_row][vc_row][vc_column][vc_column_text]

1. General improvement of information security effectiveness

ISMS do not only ensure adequate security controls are in place but also it ensures monitoring , measuring , analyzing and evaluation of this security controls at planned intervals for purposes of adequacy and effectiveness.

2. Awareness and empowerment of personnel regarding information security

ISMS ensures persons doing work under the organization’s control are aware of their contribution to the effectiveness of the management system and benefits of improved information security.

In addition, it ensures that an information security Awareness culture is developed in the organization through continued staff awareness programmes.

3. Increase of top management’s accountability regarding information security.

This is achieved via leadership and commitment requirement that requires Top management to show commitment by;

• Ensuring resources needed for the ISMS are available,
• Ensuring Information security policy and objectives are established and compatible with the organizations strategic direction.
• Ensuring that integration of the ISMS into the organizations processes.
• Communicating the importance of effectiveness of Information Security.

In addition, top management is tasked with the review of the Information Security Management System at regular intervals to ensure its suitability, adequacy and effectiveness.

4. Competitive edge in the market and or Increased business opportunities

Customers/stakeholders require assurance of protection of information and continued availability of services and products.

5. Better Incident and Problem management.

ISMS ensures incident and problem management procedures have been defined, communicated, and implemented.

6. Reduced costs due to security breaches.

Having adequate security controls in place helps reduce the like hood and impact of security breaches in an organization.

7. Organization’s resilience towards Cyber threats.

ISMS considers continual availability of services and products by ensuring adequate controls around information security continuity, redundancies for critical applications and incident response are implemented.

8. Better management of change(s)

ISMS ensures procedures such as change management are documented implement to manager changes affecting information security.

9. Improved management of information and information assets.

ISMS ensures that information assets are identified, documented and ownership assigned. In addition, there are controls governing usage and equipment protection.

10. Building of an information security risk-based culture.

ISMS approaches Information security by identification of risks to information’s Confidentiality, Integrity and Availability.

11. Conformity to national and regional laws

By conforming to the ISMS, an organization directly fulfills some of the security requirements from various legal and regulatory frameworks such as PCI-DSS, NIST, Data Protection Law and Global Data Protection.

[/vc_column_text][/vc_column][/vc_row][vc_row][vc_column][vc_custom_heading text=”John Kamande, Consultant” font_container=”tag:h5|text_align:center|color:%2381d742″ google_fonts=”font_family:Montserrat%3Aregular%2C700|font_style:700%20bold%20regular%3A700%3Anormal”][/vc_column][/vc_row][vc_row][vc_column][vc_btn title=”The Data Protection Act – 2019″ style=”flat” color=”primary” size=”xl” align=”center” button_block=”true” link=”url:https%3A%2F%2Fsentinelafrica.co.ke%2Fwp-content%2Fuploads%2F2021%2F04%2FTheDataProtectionAct__No24of2019.pdf%20|||”][/vc_column][/vc_row]