The more indispensable computers and other digital devices become in business, the more often they become targets for attacks. In order for a company or an individual to be able to confidently use computer equipment, they must make sure that the device is not exposed to the risk of hacking and that all communications that are carried out with its help are safe. This is the basics of information security.
It includes three main concepts:
1. Confidentiality. To ensure information security, access to confidential data must be provided to a dedicated user group; everyone else should be prohibited from learning anything about its content.
2. Integrity. Regardless of the method of protection used, the information must be kept in its original form. If some part of the data is lost or becomes distorted, then such a system for protecting information assets will be deemed unreliable. In addition, it is necessary to protect data from changes that can be made by intruders.
3. Availability. Information assets, regardless of their degree of security, should be available to those users who have the right to use these data.
Without adhering to the listed principles, the protection system cannot be called reliable.
Information security tools
To ensure the confidentiality, integrity, and availability of information, organizations can choose one or more security tools. Each of these tools belongs to the information security subsystem.
Authentication
Authentication tools are used to ensure that the person accessing sensitive data is who they say they are. There are sophisticated forms of authentication such as fingerprint reading. Combined authentication combined with passwords is the most secure.
Access control
After identifying the identity of the user, it is checked for his rights in the data exchange system. Access control is a security element that determines the rights of users to read, edit and delete information from the system.
Encryption
Often an organization needs to transfer information over the Internet or record it on external media (CDs, flash drives). In these cases, even with proper authentication and access control, an unauthorized person can gain access to the data. Encryption is the process of encrypting information during transmission or storage so that only authorized persons can read it.
Passwords
Using a simple user identifier - a password - to obtain information is not considered a secure authentication method. Most passwords are easy to crack. Establishing a proper password policy ensures that passwords are not compromised.
Backups
Another important information security tool is a comprehensive backup plan for the entire organization. It is necessary not only to back up data on corporate servers, but also to back up all information on separate computers in the organization. A good backup plan should have several components.
Firewalls
Another method that an organization should use to improve the security of its internal network is through a firewall. A firewall can exist as a piece of hardware or software. A hardware firewall is a device that is connected to a network and filters packets based on a set of rules. The firewall protects all servers and computers in the company by stopping packets from the outside that do not meet a strict set of criteria.
Intrusion detection systems
Another device that can be placed on the network in order to protect information assets is an IDS or intrusion detection system. IDS provides functionality to determine if a network is under attack. The IDS can be configured to monitor certain types of activity and alert security personnel. IDS can also log various types of traffic on the network for later analysis.
Physical security
An organization can implement the world's best authentication scheme, develop better access control, install firewalls and intrusion prevention tools, but its defense cannot be complete without physical protection. This is the protection of real hardware and network components designed for storing, processing and transmitting information.
Security policy
In addition to the technical controls listed above, organizations also need to introduce administrative controls. In fact, the security policy should be the starting point for developing an overall data protection strategy. A good information security policy sets out the rules for using confidential information for employees and penalties for violation of them.
Mobile security
As the use of smartphones and tablets grows, organizations must be prepared to address the unique challenges associated with the use of these devices. One of the first issues an organization should consider is the use of mobile devices in the workplace. Creating a BYOD ("Bring Your Own Device") policy allows employees to integrate more fully into work and can improve employee satisfaction and productivity. In many cases, it can be nearly impossible to prevent employees from having their own smartphones or iPads in the workplace.
Usability
When looking for ways to protect information, organizations must balance the need for protection with the need for users to effectively access and use these resources. If security measures make it difficult to use, then users will find ways to circumvent such a system and make it even more vulnerable. Take password policy, for example. If the organization uses very long passwords with several special characters, the employee can write it down on a sticker and stick it on the monitor, since it will be impossible to remember.
Computing and networking resources are becoming an integral part of the business, as well as a target for criminals. Organizations must keep a close eye on how they protect their resources.
17.12.2020
