Information Security: Personal, Business, and Global Perspectives

Introduction to Information Security

Information security, often referred to as IS or InfoSec, is defined as the practice of defending or securing information from unauthorized users who may access, disclose, use, modify, disrupt, inspect, record, or destroy it. Overall, information security is the task of information security specialists who determine the nature and value of data to the business and create critical policies to manage the internal information system. Information security also involves information assurance, which is the act of ensuring that data is kept safe and not lost in situations involving critical issues such as malfunction, physical theft, and natural disasters (Vladimirov, Gavrilenko, & Michajlowski, 2010).

This paper discusses information security in its holistic nature as it relates to personal, business, and global information security.

Interconnectivity of Information Systems

Interconnectivity of information systems is important to allow full interaction and collaboration among users of the system in a secure manner. System interconnectivity does not limit the transfer of data; rather, it makes data transfer simpler while ensuring the security of information is maintained (Smedinghoff, 2008).

Whenever data is shared in an interconnected environment, there is risk. It is important to assess new risks in the environment regularly to ensure that mitigating efforts are undertaken as quickly as possible. The interconnectivity of the system depends on the corresponding controls and configurations and on how sensitive the data is (Watkins, 2013a).

In order to maintain the necessary security levels when there is an interconnection between information systems, the risks involved should be assessed together with the level of security protections in place. Both systems should undertake this assessment to ensure that the risks involved are limited and that necessary protections are provided. Once the connection between systems is established, the risks are shared and new protections may be required. The groups involved should also maintain a high level of knowledge sharing and transparency to ensure that the security levels across different systems are consistent.

Depending on the information security environment, the security requirements of systems will differ. However, common requirements include the use of virus scanning and detection tools, intrusion detection, secure identification and authentication, auditing controls, incident reporting and handling, and assessment and authorization (Vladimirov et al., 2010).

Security process areas include configuration management, incident response, awareness creation, training, data ownership, maintaining data backups, and responding appropriately to incidents.

Several information security organizations, such as the National Institute of Standards and Technology (NIST), have published draft guidelines on information sharing to prevent cyber threats. These guidelines provide recommendations to prevent cyber-attacks and to adopt defensive mechanisms.

The first recommendation is to maintain inventory lists of all hardware and equipment that the company owns. This helps keep records in case hardware, equipment, or media is stolen. The second recommendation is to maintain an inventory list of all information the organization uses and is capable of producing. This ensures the company has a record of all information it owns and produces in order to gauge its sensitivity and ensure that appropriate security policies and procedures are applied.

Organizations are also encouraged to exchange information about threats, tools, and techniques used to avert those threats in a formal way. The purpose of this recommendation is to inform decision-making for each organization and to mitigate risks early. In the same way that organizations consider their competitive landscape when making investments, they should also apply logical factors when deciding on their IT operations (Kouns & Kouns, 2011).

The company must consider risks associated with information sharing. The best sources of threat intelligence are partners, since companies within an industry share unique industry data that, when exchanged, can highlight risks and allow smooth continuity of operations.

Companies should also use open standard formats for their data and transfer protocols. When interchanging information electronically, the system should format data in an open data format with high standards to transmit information from one system to another without human intervention.

The fifth recommendation is for companies to augment data collection, management, and analysis using information collected from external sources. This links to the sharing of threat intelligence with partners to ensure the company can analyze its data appropriately and determine when it is under attack in a timely manner. Companies should use adaptive methods to proactively share information with partners to ensure awareness of information security threats and vulnerabilities.

Lastly, companies should establish clear responsibilities and roles for responding to a cyberattack. This means each company should have a cyberattack response plan that is updated regularly and that ensures company information remains protected at all times. Companies should regularly evaluate the efficiency and effectiveness of the control measures they implement.

Balancing Security Across Personal, Business, and Global Areas

Collaboration within an organization and with other organizations is important. However, maintaining information security becomes increasingly difficult when an organization is involved in collaborative activities. Corporations struggle to keep up with industry regulatory requirements, risk management, and economic conditions. A major issue raised by industry experts is that employees tend to view information security as the sole responsibility of information security personnel, without appreciating that it is a mutual task (Calder, 2010).

There is a need for collaborative effort in order to achieve information security in any organization.

Many corporations have also become global, expanding their e-commerce capability while increasing interactivity with consumers and customers around the world. These companies are increasingly dependent on third parties for business operations, since those third parties must maintain customer data as confidential. Third parties often handle activities such as compliance, audit, human resources, IT, information security, and risk management (Watkins, 2013b). While third parties often have better threat intelligence and response capabilities due to their specialization, they create risk because they have access to the company's confidential information.

Global organizations must therefore foster an information security culture that is upheld by the third parties they engage. To create this culture, the organization must run information security awareness campaigns regularly. This means conducting awareness sessions and activities targeted at specific audiences (Watkins, 2013a). These campaigns are essential to inform various departments of their security responsibilities and to make information security a mutual task across every department.

Secondly, the organization should establish cross-functional teams. This requires the creation of risk councils and information security committees to improve the functional areas of the company and strengthen the organization's overall security posture. The human resources function must be involved in entrance and exit policies and procedures relating to information security to ensure employees do not leave the organization with confidential information. Cross-functional teams also enhance communication and collaboration while reducing departmental isolation and duplicated efforts, which in turn reduces costs and improves profitability (Smedinghoff, 2008).

The organization's management must commit to fostering the right organizational culture. Culture guides the thinking behind how things are done in the organization. If the management team does not support the information security program, policies, and procedures, other employees also become discouraged from following the program (Maddock, 2010). It is therefore essential for all senior personnel — the management team, executives, board of directors, and others — to own the information security policies and procedures.

The company should cultivate a strong culture oriented toward information security, aligned with its business objectives. A clear relationship between information security and business objectives should be established so that system end-users understand the realities of risk reduction (Krausz, 2010).

The company should also adopt a risk-based approach to information security. This means implementing controls even when there is little or no apparent risk. This proactive method of risk management optimizes organizational flexibility, reduces the impact of risks and threats when they arise, and improves regulatory compliance (Krausz, 2010).

Companies should also maintain balance among people, process, technology, and organization. Effective risk management requires the organization to support its employees through efficient processes and appropriate tools and equipment, achieving a balance among people, organization, process, and technology. These elements should be properly aligned to support each other and prevent waste.

Conclusion

Companies should review their information security systems regularly to ensure they remain aware of threats and countermeasures, adopt new technologies and updates when they become available, use specific assets such as employees and firewalls to mitigate risks, and prioritize their risk management processes.

In most organizations, information security is perceived as a technical discipline, largely because it is closely associated with IT. However, information security is fundamentally concerned with establishing, enforcing, and following policies and procedures that set the direction for information security programs. These policies define how information is used, shared, destroyed, and transmitted — because in today's organizations, information sharing is essential to success.

Every member of an organization has a part to play in ensuring the security of company information. This means the information security system must be embedded in the company culture and followed by all members of the organization, including the board of directors and executive leadership. Organizations can also implement host-level and application-level countermeasures, which should be regularly updated and evaluated to ensure they effectively mitigate threats and risks. For further reference, the Cybersecurity and Infrastructure Security Agency (CISA) provides up-to-date guidance and resources for organizations seeking to strengthen their information security posture.

References

Bs, T. (2008). Disaster Recovery and Business Continuity: A Quick Guide for Small Organizations and Busy Executives (2nd ed.). IT Governance Ltd.

Calder, A. (2010). Selling Information Security to the Board: A Primer. IT Governance Ltd.

D'Arcy, J., & Hovav, A. (2009). Does one size fit all? Examining the differential effects of IS security countermeasures. Journal of Business Ethics, 89, 59–71. doi:10.2307/40295078

D'Arcy, J., Hovav, A., & Galletta, D. (2009). User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach. Information Systems Research, 20(1), 79–98. doi:10.2307/23015462

Guo, K. H., Yuan, Y., Archer, N. P., & Connelly, C. E. (2011). Understanding nonmalicious security violations in the workplace: A composite behavior model. Journal of Management Information Systems, 28(2), 203–236. doi:10.2307/41304625

Honan, B. (2010). ISO27001 in a Windows Environment: The Best Practice Handbook for a Microsoft Windows Environment (2nd ed.). IT Governance Ltd.

Hui, K.-L., Hui, W., & Yue, W. T. (2012). Information security outsourcing with system interdependency and mandatory security requirement. Journal of Management Information Systems, 29(3), 117–155. doi:10.2307/23392478

Kouns, B. L., & Kouns, J. (2011). The Chief Information Security Officer: Insights, Tools and Survival Skills. IT Governance Ltd.

Krausz, M. (2010). Managing Information Security Breaches: Studies from Real Life. IT Governance Ltd.

Kumar, R. L., Park, S., & Subramaniam, C. (2008). Understanding the value of countermeasure portfolios in information systems security. Journal of Management Information Systems, 25(2), 241–279. doi:10.2307/40398723

Maddock, V. (2010). IT Induction and Information Security Awareness: A Pocket Guide. IT Governance Ltd.

Ransbotham, S., & Mitra, S. (2009). Choice and chance: A conceptual model of paths to information security compromise. Information Systems Research, 20(1), 121–139. doi:10.2307/23015464

Smedinghoff, T. J. (2008). Information Security Law: The Emerging Standard for Corporate Compliance. IT Governance Ltd.

Tkacheva, O., Schwartz, L. H., Libicki, M. C., Taylor, J. E., Martini, J., & Baxter, C. (2013). Internet Freedom and Political Space. RAND Corporation.

Vladimirov, A., Gavrilenko, K., & Michajlowski, A. (2010). Assessing Information Security: Strategies, Tactics, Logic and Framework. IT Governance Ltd.

Watkins, S. G. (2013a). An Introduction to Information Security and ISO27001:2013: A Pocket Guide (2nd ed.). IT Governance Ltd.

Watkins, S. G. (2013b). ISO27001:2013 Assessments Without Tears (2nd ed.). IT Governance Ltd.