AKIBIA'S PRACTICAL GUIDE TO ENTERPRISE TECHNOLOGY
Monday, May 18, 2009
The Checklist Approach to IT Security is Failing You
In the past few weeks I have spoken to a number of companies about IT security, and a familiar theme has emerged – too many companies lack a sound framework for overall IT security. Instead many companies are overly focused on completing a check list – firewall, encryption, PCI compliance.
This checklist approach to security is not only dangerous; it can also be expensive and difficult to effectively manage. Companies should move quickly to adopt an IT security framework. ISO 27001 is a good one.
What is ISO 27001?
It is a standard outlining the requirements for an Information Security Management System (ISMS). It helps identify, manage and quantify the range of threats to critical corporate-controlled information.
Compliance with this standard shows customers, partners, employees and other constituents that information security is being taken seriously and that effective steps are in place to manage security at every level – not with a piecemeal approach.
Information Security affects the very core of any business. Personal information, customer records, financial information and intellectual property must be protected from loss, theft and damage. The ISO 27001 provides the controls and processes necessary to protect core business needs.
As well as delivering security improvements, auditing your processes has additional, valuable benefits:
- Cost Savings - the cost of a single information security breach can be significant.
- Commitment - registration helps to ensure and demonstrate commitment at all levels of the organization.
- Credibility, trust and confidence - customers can feel confident of your commitment to keeping their information safe.
- Compliance - registration helps to show the authorities that you comply with the relevant laws and regulations.
Is it relevant to you? It's relevant to every business.
This standard can become the foundation of any company's IT security strategy. The framework and processes deployed can be tuned to reflect different business needs. The value of information is different for every company large or small. For example large organizations such as financial and government institutions will often hold detailed information on millions of customers, individuals or businesses. Keeping that information both secure from theft but accessible for day-to-day use can be conflicting requirements. A smaller organization may value a single customer record very highly. Whatever the size of the company or the sensitivity of the date, effective processes can ensure more responsible use of data.
Have you been able to find a balanced approach to managing information security risk via ISO27001?
