We've probably all heard the expression in the past with its nobody's job,
nobody does it.
That's why this segment is so important.
In order to have a good information security program,
we need to have governance. That allows us to apply the concepts of
information security in a good and reliable manner.
We can say the governance starts with understanding the laws,
making sure that our organization is aware of and compliant with those laws,
and that those derive the strategy, the mission,
the goals of the organization.
From that strategy, we develop a policy, how we are going to do business,
and of course,
from the policy the procedures of the steps that we will actually follow.
Governance creates accountability.
So someone is held personally accountable or we
could say responsible for something.
That brings in the idea of oversight, and of course,
when a manager is committed and accountable,
hopefully they also provide leadership so that he or she can make
sure that there is direction provided support,
of course, for the security program.
This means that we must communicate.
We communicate and support the ideas of policies and procedures.
The purpose of policies and procedures is to make the theory of things
like our strategy and our mission real and practical.
A lot of this comes down to the idea of information assurance.
What is the confidence we have?
Well that comes from doing good things.
In other words, when we achieve good practice,
we have assurance that we're doing the right things including
providing adequate security for our systems and data.
We're protecting our customers data, our employees,
and we're protecting the future of the organization by
protecting the confidential information that should be kept
from other people's knowledge.
We can say that data and information are two of the most
valuable assets of most organizations.
Their customer lists, for example, their research,
these are all of the things that, in many ways,
will determine whether or not the organization can be profitable and successful.
We need to protect data and the data, of course,
represents anything which is just like numbers,
letters.
Information is data with meaning.
We must protect data all the way through what we call the data lifecycle.
The data lifecycle starts when we first receive that data,
then we store, process it, share it, archive it,
delete it.
All the way through,
we must protect the data in all forms that it's in,
whether or not it's written or electronic,
whether or not it's spoken or video, we protect it in all forms and at all times,
so we make sure it's not that it's protected sometimes,
but other times as unprotected.
And of course, that means we protect it in all places as well.
Data can often end up on several different systems in different departments.
Is it protected consistently in all of those places?
Why do we care about information assurance or why do
we care about information security?
Because we need to comply with laws and regulations.
Many organizations are bound by different types of laws and regulations
depending on the industry sector they work in, but almost all businesses
are covered then by some type of privacy law.
Privacy law says we have to keep private or confidential information
about individuals a little different from secrecy,
which is more about protecting information from military
governments and the organization itself.
Privacy laws often deal with what we call personally identifiable information,
information that could be used to identify an individual,
or in some cases, that individual's location.
We also have PHI, protected health information,
which is health information about individuals as well.
We've seen many different privacy laws.
In Europe, we have the General Data Protection Requirements,
GDPR. We've seen a number of cases in healthcare where we've got
acts such as HIPAA. And in the financial sector,
we have laws dealing with the protection and the
rights to use people's financial data, the Gramm‑Leach‑Bliley Act,
the Sarbanes‑Oxley Act, for example.
In all of this,
we want to develop an information program that supports the business
goals so that we have assurance that we really are working towards
the long‑term good of the organization.
So what makes up security?
The elements of security are people, technology,
and of course, physical and environmental concerns as well.
We can say that the end goal of our security program is that we have the
right people doing the right things in the right way.
We have people that use technology in a secure manner and
that technology is installed and implemented in a
physically secure environment as well.
A key points review.
The idea is that security is here to support business.
It is not to constrain or restrain the business,
but rather support what the business needs so it has reliable functions.
In this way,
we provide assurance or confidence to management that security is
helping the business to succeed and meet its mission.
We see that security is more than just technology,
it's not just about putting in equipment,
but having people trained in how to use that equipment,
and of course, also having physical and environmental security as well.