How do You Avoid Information Security Breaches?

Avoiding security breaches is not the responsibility of a single individual, irrespective of technical ability, knowledge or title. It is a collective responsibility, where each and every employee within an organisation is accountable to some degree for protecting information and avoiding a security breach. In simple terms, each employee should be asking themselves three questions:

• What are we protecting?
• From whom are we protecting it?
• How are we going to protect it?

If you’re one of those employees who don’t know or are unclear about the answers, then the first port of call for internal advice and guidance should be your line manager.  If you’re the line manager and are not certain, then seek out your information security manager or, if that role doesn’t exist, the individual who has responsibility for information security.

What are we protecting?

Whilst the answer to the ‘What are we protecting?’ question would appear to be blindingly obvious, it is surprising how often the answer is unclear.  And if you don’t know what information you are managing/responsible for, how can you identify how to protect it?  Having a clear understanding of the information the organisation has is essential to identifying the measures needed to protect it.

Employees throughout an organisation will deal with a variety of information types, often with differing access control requirements.  However, it’s essential that all employees are clear on what that information is and how it should be managed and handled.  Information security professionals refer to this as an asset list and generally, ‘information classification and handling’.

‍

From whom are we protecting our information?

So, once we know what we are protecting, we can look at who or what we are trying to protect against.  These are known as the threat vectors.  The threat vectors can be distinguished as internal or external and divided into human and technical.  These categories can have many different subcategories and typically depend on the geographical, political, economic situation in which the organisation is operating.  Whatever or whoever they are, it is important to identify them and to be realistic.

How are we going to protect it?

Having established the ‘what’ and ‘who’, we now turn to ‘how’.  Alas, there is no silver bullet or simple answer.  The first step is to ensure there is (or to introduce) a structure within the organisation and achieve a transparent and holistic approach to information security management.  The structure will define roles and responsibilities and will identify the means by which we will protect the information.

There are different information security frameworks that can support this; the International Organisation for Standardisation (ISO), the National Institute for Standards and Technology (NIST) and Control Objectives for Information and Related Technology (COBIT), to name but a few.  An information security risk assessment will identify where time, effort and investment are needed.  The most important point, however, is to encourage everyone (irrespective of their role) to take responsibility for information security and make them aware that all employees have a part to play.  Equally important is to ensure an open culture.  A reported near-miss could ensure the next security breach is avoided!

‍