External links
| Authority control databases: National |
|---|
Information security management (ISM) defines and manages controls that an organization needs to implement to ensure that it is sensibly protecting the confidentiality, availability, and integrity of assets from threats and vulnerabilities. The core of ISM includes information risk management, a process that involves the assessment of the risks an organization must deal with in the management and protection of assets, as well as the dissemination of the risks to all appropriate stakeholders. [1] This requires proper asset identification and valuation steps, including evaluating the value of confidentiality, integrity, availability, and replacement of assets. [2] As part of information security management, an organization may implement an information security management system and other best practices found in the ISO/IEC 27001, ISO/IEC 27002, and ISO/IEC 27035 standards on information security. [3] [4]
Information security management has become an increasingly important part of modern organizations as it helps secure large databases often found within large organizations. [5] These databases often store sensitive information, such as personal identifiers and financial records. [5] A breach in these databases can ruin a company's reputation or put millions of people's information at risk. [6] For this reason, information security management is often discussed alongside cybersecurity practices, many of which are directly correlated or directly used in Information Security Management Systems (ISMS). [7]
Managing information security in essence means managing and mitigating the various threats and vulnerabilities to assets, while at the same time balancing the management effort expended on potential threats and vulnerabilities by gauging the probability of them actually occurring. [1] [8] [9] These ideas can be summarized into the Protection Motivation Theory, or PMT. The PMT "seeks to explain why individuals adopt or engage in protective behavior." [10] There are two main mechanisms of the PMT: threat appraisals and coping appraisals. [10] Threat appraisals refer to how people perceive the severity of a threat and their vulnerability to a threat. [10] A meteorite crashing into a server room is certainly a threat, for example, but an information security officer will likely put little effort into preparing for such a threat. Just as people don't have to start preparing for the end of the world just because of the existence of a global seed bank. [11]
The second half of the PMT is coping appraisals. This refers to self-efficacy and response efficacy. Self-efficacy is someone's perceived confidence in their ability to complete a task. [10] Response efficacy refers to someone's belief in a protective action's effectiveness. [10] Coping appraisals also include response costs, or any possible expenditures potentially required of someone to follow through with a protective action, such as money, time, or effort. [10] In order for the PMT to be successful, a person must have a strong sense of self-efficacy and response efficacy with the task at hand, along with a low perception of reward costs (which can also be influenced by self-efficacy). [10]
After appropriate asset identification and valuation have occurred, [2] risk management and mitigation of risks to those assets involves the analysis of the following issues: [8] [9] [10] [12]
Once a threat and/or vulnerability has been identified and assessed as having a high threat appraisal on information assets, a mitigation plan can be enacted. The mitigation method is chosen largely depends on which of the seven information technology (IT) domains the threat and/or vulnerability resides in. The threat of user apathy toward security policies (the user domain) will require a much different mitigation plan than the one used to limit the threat of unauthorized probing and scanning of a network (the LAN-to-WAN domain). [12]
Some of the most common reasons organizations may struggle implementing risk management protocol are: [6] [7] [13]
In order for a mitigation strategy to be effective, both the technological and user side of the strategy must be functioning with minimal errors. [13]
An information security management system (ISMS) represents the collation of all the interrelated/interacting information security elements of an organization so as to ensure policies, procedures, and objectives can be created, implemented, communicated, and evaluated to better guarantee the organization's overall information security. This combines technological and human collaboration to be successful. [13] This system is typically influenced by an organization's needs, objectives, security requirements, size, and processes. [14] An ISMS includes and lends to risk management and mitigation strategies, and often addresses many if not all of the factors discussed in the PMT. [10] Additionally, an organization's adoption of an ISMS indicates that it is systematically identifying, assessing, and managing information security risks and "will be capable of successfully addressing information confidentiality, integrity, and availability requirements." [15] However, the human factors associated with ISMS development, implementation, and practice (the user domain [12] ) must also be considered to best ensure the ISMS' ultimate success. [16]
Failures is ISMS can often be traced back to poor risk management or evaluation, a lack of depth in understanding, or misaligned goals with leadership. [17] This is why some companies choose to hire and/or implement a Chief Information Security Officer (CISO). [17] The CISO is often responsible for guiding policy, aligning security with business goals, handling risk and compliance, and communicating between management and technical terms. [17] The main purpose of implementing a CISO is to streamline security integration and provide a source of leadership to help guide the organization's information security management. [17]
As society transitions to becoming more digitally interconnected, cybersecurity practices have become a focus of scholars and business leaders alike. [5] Although technology can be attacked, cybercrime has been shown to be more effective when it targets humans, with a strong focus on social engineering. [10] These tactics can include: [5] [10]
It is important for all aspects of cybersecurity to be addressed when implementing an ISMS. [18] The main reason these tactics are successful on humans is due to people's lack of awareness. [5] This is where employee training and education become major factors in successfully implementing an ISMS. [19]
While IT departments or CISOs in many businesses are typically the ones handling Information Security Management, everyone in a business or organization must practice awareness and vigilance for information security management systems to be successful. [17] [18] Success rates for scams such as phishing and other social engineering tactics are shown to be directly correlated to someone's lack of internet safety awareness. [5] Because of this, many organizations are requiring some form of information security or cybersecurity onboarding. [5] These forms of training include: [5] [6]
These training typically don't end after onboarding, and are often required to be completed anywhere from every year to every month. [5]
Implementing an effective information security management (including risk management and mitigation) requires a management strategy that takes note of the following: [20]
Oftentimes, technology is not enough to keep organizations and businesses safe from information security threats. [13] Without sufficient budgetary considerations for all the above—in addition to the money allotted to standard regulatory, IT, privacy, and security issues—an information security management plan/system can not fully succeed.
Standards that are available to assist organizations with implementing the appropriate programs and controls to mitigate threats and vulnerabilities include the ISO/IEC 27000 family of standards, the ITIL framework, the COBIT framework, and O-ISM3 2.0. The ISO/IEC 27000 family represents some of the most well-known standards governing information security management and their ISMS is based on global expert opinion. Over the past two decades, it has become globally used across multiple industries. [7] They lay out the requirements for best "establishing, implementing, deploying, monitoring, reviewing, maintaining, updating, and improving information security management systems." [3] [4] Gaining an ISO 27000 certification indicates an organization is dedicated to a strong ISMS, as gaining this certificate requires frequent security checks, updates, and a strong leadership at the forefront of implementation. [18] ITIL acts as a collection of concepts, policies, and best practices for the effective management of information technology infrastructure, service, and security, differing from ISO/IEC 27001 in only a few ways. [21] [22] COBIT, developed by ISACA, is a framework for helping information security personnel develop and implement strategies for information management and governance while minimizing negative impacts and controlling information security and risk management, [4] [21] [23] and O-ISM3 2.0 is The Open Group's technology-neutral information security model for enterprise. [24] Some other notable mentions, although less prevalent, as t6he GDPR, EU NIS directive, and NIST Cybersecurity Framework. [19]
{{cite book}}: |journal= ignored (help)| Authority control databases: National |
|---|
