Information security

Introduction

Businesses operate in an environment within creasingly powerful ways of manipulating and storing information. This is matched by growing threats to that information. Businesses need to manage their information so that they get the best value from it, and minimise the risks of losing it.

Information security is necessary to ensure that your business can continue to operate effectively and profitably. Without it your business is, at worst, in serious risk of failure or, at least, in danger of losing customers.

Basics for information security

To ensure business continuity, minimise business damage and maximise return on investments and business opportunities, it is important for your information to be secure against outside threats.

Information does not mean just computer-stored data. Information can exist in many forms. It can be printed or written on paper, stored electronically, transmitted by post or electronically, or spoken in conversation.
Information security means preserving:

confidentiality - ensuring that information is accessible only to authorised users
integrity - safeguarding the accuracy and completeness of information and processing methods
availability - ensuring that authorised users have access to information and associated assets when required

Information security means that you can rely on being able to use information when you need it. It also brings confidence that it has not been tampered with and that you have control over who can see and use it.

There is no single solution to achieving information security. It is not just about buying computer software to make your business secure.

Information security is achieved by implementing suitable controls on:

policies
procedures
organisational structures
software functions

These controls need to be tailored to suit your business objectives and the nature of your business.

Risk management

Good information security must be based on an understanding of the risks that a particular business actually faces. The process of determining what those risks are and deciding what to do about them is known as risk management.

To manage risks you first need to identify threats. Typical threats include:

fraud, including identity theft
fire, flood and other natural disasters
industrial espionage
computer viruses
data loss
loss of service

You should consider your business' vulnerability to each of these types of threat. You should also consider the likelihood of the risk materialising.

Given your analysis of the risks that are serious for your business, you should consider how you can reduce (or mitigate) those risks. The objective of risk management is to reduce risks to a level that is acceptable to your business at an economically sensible cost.

For example, assume that your business has developed a web site that you run on one of your internal servers. The web site can be used by customers to place orders that are then automatically processed. You must make sure you website is securely designed, other wise hackers might be able to change the prices on your products, resulting in a flood of orders at prices that will cause your business a severe loss. In this case your business is potentially vulnerable to fraud, theft, perhaps data loss and probably loss of service.