Almost every enterprise has a security service, but few people understand what tasks should be set for it. A developed defense strategy and proactive work help to more effectively repel external and internal threats.
Threats
The tasks set by the company's management in the field of security relate to the objects of protection, and not to a general understanding of the risks inherent in a superficial approach to strategy development. At the same time, any new organizational measures aimed at increasing the level of protection are met with rejection by employees and management, who regard them as unnecessary restrictions and obstacles in the course of business processes.
Large companies have long built a comprehensive security system at all levels - from information to economic.
Small ones are limited to a minimum of effort, while incurring significant losses. The general system of risks looks like this:
1. Business risks. This is a threat to reputation, black PR in terms of external interactions or investments, new developments that can be unsuccessful in terms of internal tasks.
2. Informational risks. These are information leaks, a threat to its integrity, substitution, difficult access to data, services and applications.
3. Personnel risks. These are staff turnover, enticement of valuable employees by competitors, the task of labor protection, reduction of injuries and illnesses in workplaces with difficult and harmful working conditions.
4. Infrastructure risks. This is a breakdown or failure of equipment, accidents, problems at hazardous production facilities, pollution of the environment with emissions from the enterprise.
5. Financial risks. These are thefts, damages, damages, fines, and court losses.
Every company faces these challenges. Based on their understanding, a diagram of corporate security components is developed:
- Information security.
- Economic security, the task of which is to prevent leakage of funds from the company.
- Legal security. Within its framework, the company protects against illegal actions of employees and competitors, prevents forgeries and fraud, interacts with inspectors and law enforcement agencies.
- Personnel safety. Here, the tasks of protecting the life and health of the employee, preventing the "brain drain" are being solved.
- Property security, within the framework of which the premises, infrastructure facilities, equipment belonging to the company are subject to protection.
- Risk management. Here it is necessary to protect oneself from ineffective investments and unreliable suppliers.
- Reputational safety.
It is obvious that the Security Council alone cannot cope with all these tasks.
How to build a corporate security system
In addition to the security service, complex tasks of protecting the enterprise from internal and external threats are solved by top and middle management, financial management, internal control service, KRU, legal department, personnel and IT services. There is a need to build their effective interaction.
It is required to develop a mechanism to combat threats, consisting of the following stages:
1. Discovery. Employees of the enterprise should develop a mechanism for detecting threats in such a way that there are no false positives. So, for an IT specialist, the solution to the problem will be to set up an IT infrastructure monitoring system that notifies about intrusions, for internal audit - a deviation in the results of financial and economic activities, which differs from the usual values of seasonal or other fluctuations. For example, when the peak of agricultural fuel sales falls not at the beginning of the sowing campaign, but in the middle of it, a situation arises in which the deviation looks unnatural.
2. Analysis. The employee must anticipate the possibility of a threat, assess the scale, find sources and response measures on their own or with the involvement of involved units.
3. Confrontation. For each type of threat, its own policy or instruction should be developed, allowing you to quickly take action on your own, choose the appropriate one from the decision tree.
4. Regulation. All stages of dealing with threats to the internal security of an enterprise should be regulated in clear instructions adopted at the level of the company's management.
All these tasks should not become an end in itself. Identifying threats and responding to them cannot be the main tasks of departments whose activities are related to other business processes.
Main problems
When building an internal security system, it is necessary to understand the difficulties that prevent making it effective:
- Lack of understanding of the reality of the threat. The company is not aware of the danger, even when its assets are already interested in hackers, competitors or raiders.
- Low level of training of specialists. A professional in the field of corporate security cannot be trained in courses; he needs a long practical school. But the more seniority a specialist has, the less affordable his services are for small companies.
- Striving for savings. If it manifests itself in the area of security, the losses can be significantly greater than the possible costs.
- Corporate culture. Organizations with a free and informal style of communication, a project type of work are often afraid of losing valuable personnel by introducing additional restrictions.
It is impossible to find an effective solution in every situation, it all depends on the type of threats and the leadership on whose shoulders the burden of decision-making falls.
Security Council tasks and principles of its work
The type of enterprise determines the functions of the security service, created from professionals who previously worked in this area, but its main tasks do not change depending on the structure of the organization:
- ensuring information security at all levels, establishing and maintaining a commercial secret regime;
- protecting the company in competition;
- ensuring the sustainability of the company and the stability of business processes;
- work with personnel;
- checking the conscientiousness of customers and partners;
- interaction with government agencies;
- ensuring the safety of finances.
The solution to these tasks is based on adherence to the general principles of working with risks of departments that not only solve security problems, but also deal exclusively with business issues. It is necessary:
- organize work with information flows in such a way that the Security Service always understands where the information is located and with what degree of confidentiality each employee can work with;
- regulate actions. All actions of employees related to risks and threats should be described in methods and policies. Their violation makes it possible to bring employees to disciplinary or civil liability, provided that they were properly familiar with the regulatory documents;
- provide analysis of each incident and preparation of conclusions based on its results. It is desirable for the company to have a common knowledge base on risk situations. Even if only authorized employees have access to it, it will make it possible not to solve the problem again every time, but to ensure the continuity of the methods. Analysis and recommendations developed will help to cope with risks even when the participants in the previous incident have already been fired;
- achieve consistency in ensuring security at all levels. To do this, it is necessary to automate all management processes as much as possible, implement CRM systems with settings that provide not only manual, but also programmatic control of deviations, notifying about incidents. This will help solve the problem of bringing the management of all security processes in one place;
- ensure the continuity of control and monitoring processes. The study of the current situation should be carried out continuously, and not only when faced with the next incident. Also, there should be a continuous study of the external and internal environment, forecasting risks, developing possible moves to neutralize them;
- achieve the best results with the least investment. The cost-effectiveness of the solution does not exclude its effectiveness. Technical measures, such as security cameras and tracking the actions of program employees, are effective, but organizational and explanatory measures of a preventive nature are not less effective;
- ensure the coordination of all employees and divisions of the enterprise, solving security issues. Regulations and job descriptions with a detailed description of functions will remove the risk of a conflict of interest;
- achieve full transparency of decisions in the field of security, explaining their need to all those involved. This will raise overall motivation.
Professional work with risks, built on a single strategy, consistency, the use of modern software tools, will help protect a company from most of them and increase its competitiveness.
16.12.2020
