WHAT IS INFORMATION SECURITY?
Information is data that can be intercepted to provide specific meaning on the specific topic. Information can be related to data that enables you to make decisions. Data when processed gives information. And the characteristics of information is that it is readily available, it is accurate and it is confidential.
Security of information is the practice of protecting information from unauthorized usage. We are living in an era where electronic devices such as laptops and mobile phones have become a part of our basic needs. We store enormous amounts of information on our computers , smartphones, recording devices , tablets and on paper and often view it as ordinary data that don’t matter.But if this detail gets into the wrong hands it may cause trouble.
Monetary losses, and organizational reputation problems. Therefore, you need to make sure all your important documents are password-protected, and you should avoid using the same passwords for all.
ISO 27001: INFORMATION SECURITY MANAGEMENT SYSTEM:
This international standard sets out requirements for the establishment , implementation , maintenance and continuous improvement of an information security management system. An ISMS is a comprehensive approach to the handling of confidential business information to keep it secure.Adopting an ISMS is a strategic decision since it includes people, processes, and IT systems. It can help small , medium and large businesses keep their assets secure in any sector.
If your organization is new to ISO 27001 and you are familiar with other standards then you know that these ISO Standards only provide a guideline as the main function of the majority of the ISO standards are “ write what you do and do what you write” same is the case with ISO 27001. ISO 27001 is not prescriptive. It doesn’t inform you what kind of technology to use to protect your network for example how often you need to perform backups. These are the decisions that need to be made by the organization itself. Each organization has its own needs and its own amount of data which is unique.
The three main pillars of Information Security Management systems are:
- Confidentiality
- Integrity
- Availability
CONFIDENTIALITY
Confidentiality applies to shielding information from unwanted access by unauthorized parties. In your organization you have physical assets, information of your clients and employees must be kept confidential from your competitors or any other persons.You can enforce secrecy by encrypting and saving the data files onto a disk.
INTEGRITY
Integrity refers to the consistency, accuracy and confidentiality of data throughout its lifecycle. If you want to transfer $1000 to your supplier and you obviously don’t want that $1050 to be transferred to your supplier so ISMS ensures that you data is not manipulated.
AVAILABILITY
Every organization wants that the information and data stored should be readily available to authorized users. If the data is secured but not available when it’s needed, this can also be a big risk to the company.ISMS guides you to the methods which can ensure protection against denial of services (DoS) attacks.
WHY IS IT IMPORTANT TO SAFEGUARD INFORMATION?
Information protection is essential to guard yourself and your organization against malicious or misguided attacks. The examples below will help you to understand what could happen if your data is not protected.
Marriott International
Marriott International revealed in November 2018 that the data of 500 million consumers had been hacked by cyber criminals. This was not found until September 2018. Credit card numbers and expiry dates of 100 million consumers were compromised in this attack. Marriott confirmed that they thought the hackers could not decode the credit card numbers.
Uber
In late 2016, Uber discovered that a hacker had stolen the names, email addresses, and mobile phone numbers of 57 million users of their app. The driver license numbers of 600,000 Uber drivers were also stolen. Uber had to pay the hackers $100,000 to destroy the data. It cost Uber in terms of reputation and money
NHS Cyber Attack
WannaCry disabled 200,000 computers with a message demanding cryptocurrencies. This attack resulted in about $112 million in losses.The attackers blackmailed the healthcare systems without any assurance that access would be granted after the payment was done.
Note : The source of this security breach was published on the csonline blog at www.csoonline.com/article/2130877/the-biggest-data-breaches-of-the-21st-century.html.
Once you have been through these real-life examples, you will see where protection of information can extend to your organization. You will learn that the risks associated with unauthorized disclosure, modification and deletion of critical information must be reduced or eliminated
The impact of having your organizational information stolen could be devastating so to save it is as important as having it in the first place.
The first step when planning to implement ISO 27001 is to assess the needs and scope of the organization. To start an implementation of ISO 27001 you must first consider the organization’s business context. Why is your organization getting certification for the Information Security Management system? What will be your organisation’s Information Security Policy?
Contact Aegis Services today and our experienced consultant will guide you to protect the data.
Information Security Policy:
The purpose of the security policy is to provide full security at all ends and to ensure protection against any attacks, whether internal or external, intended or unintended, of the information assets of the organization. The policy on information security should cover all software and equipment, physical parameters and human resources.
ISO 27001 PROCESS IN QATAR
To get a simpler, faster and affordable Information Security Management system in Qatar Contact Aegis Services today. Aegis Services will ensure that your company has effectively implemented ISMS. Your data is secured and your employees are well trained about the process of ISO 27001. Our Training, guidance in Documentation, expertise of our experienced consultants will make sure that your organization get all the required training in the most simplest and effective way.
Any questions?
© COPYRIGHT 2022 AEGIS SERVICES L.L.C.
COMPANY
CONNECT WITH US
- Address: Office no. 10, Level 15, Commercial Bank Plaza, Majlis Al Taawon St, West Bay, 27111, Doha, Qatar
VERIFY CERTIFICATE
