Information security systems management

Homepage > Consulting > Information security, Cyber security and business continuity > Information security systems management

Information security systems management

What is management of information security systems?

Today, as well as time, information is the most important resource of any business system, and often its key assets whose loss can lead to business ceases. They appear in various forms: written documents, IT databases, images, diagrams, business rules, etc.

Information assets are not always clearly identifiable and may consist of information and data on:

vision, mission, strategy, longer–term business orientation and strategic objectives;

business policies, finances, business processes;

markets, customers, suppliers, contractual obligations;

staff and their competences;

procedures for the discharge of legal, regulatory or contractual obligations;

installed computer equipment, electronic media, peripheral equipment, system software;

user applications, telecommunications networks, IT employees;

the transactions of the beneficiary;

reports and obligations towards the regulator, as well as a number of other valuable information.

As with other forms of business assets, there are numerous sources of threats from attacks on this information asset, which, if they happen and there is not sufficient information security in place, can cause undesirable consequences and cause some material damage or some other form of damage. Groups of such threats shall be:

technical errors;

unauthorised access to IT equipment or data;

interruptions in the provision of IT support to business processes;

natural disasters;

physical damage;

compromising data and information, etc.

But the biggest threats come from people — hackers, computer criminals, terrorists, industrial espionage, their own employees. Whether the negative consequences of an attack on information assets will occur depends on whether adequate security measures are in place and whether they are implemented in the overall security system. If their level is insufficient, the business system is vulnerable and there is a risk that information assets will be compromised.

According to ISO 27001, the information security management system consists of policies, procedures, guidelines, associated resources and activities managed by the company in order to protect its information assets. ISMS is a systematic approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving the information security of an organization in order to achieve business objectives.

What are the benefits of setting up processes and activities for the management of information security systems?

Information security in a system is a reality and a need. Building a manageable system of security and individual information security is a necessity in the business world, but increasingly in other organizations. This part of the process has often been neglected and assessed as less important. Even when measures and controls are implemented, they are mostly partial solutions related to the security of a prominent aspect of the system (e.g. implementation of antivirus, firewalls, installation of alarms, burglary sensors, etc.) while other elements are neglected. It is certain, however, that the security of the overall system is always proportionate to the safety of the weakest point.

The introduction of a safety system according to the requirements of standards from the ISO 27K series should be seen as a project with its objectives, deadlines, teams and their engagement, costs. Such a project has some features, such as the requirement for certain participants to have experience and appropriate knowledge for specific areas. (e.g., when assessing risk, it is necessary to know the existing security controls and when analysing the impact on business it is important to assess the importance of the asset and the magnitude of the loss due to its unavailability).

The benefit after the completion of one such project and the establishment of the information security system management process is certainly increased information asset security in the form of protection of integrity, availability and confidentiality. The company itself assesses whether and how important these characteristics are for its operations based on the conducted business impact analysis and risk assessment to which the information assets are exposed.

A well–implemented risk assessment process enables management structures to look at the actual state of information asset security and makes it easier for them to make decisions on how to manage the security of information systems and the impact analysis provides a loss report for cases of unavailability of an information asset or information and communication technology system.

The above significantly increases the overall business safety of the company itself, ensures its good reputation among users and partners and reduces the risk of non–compliance with regulatory and legal regulations, if such exist for the industry in which the company operates.

How can ZIH help you?

For each user ZIH has an individualised approach depending on their needs taking into account the size of the company and the context of the business. An important part of our approach are workshops with management teams in which we educate users about the benefits and ways in which it security management processes are established. With the expert guidance of our consultants and the application of world reference recommendations, we help users successfully implement and manage information security systems. The services we can provide cover all processes and activities of THE PIPD (PLAN–Do–Check–Act) cycle and may be but are not limited to:

an assessment of the current information security situation;

preparation of the ISMS project;

the development of information security policies;

preparation of security procedures (mandatory documentation);

asset management;

assessment and processing of safety risks;

the design of the organisation of information and human resources security;

the design of access controls;

management of physical and environmental security;

defining the security of IT operations;

the design of the security incident management;

preparing an analysis of the impact on business;

establishing business continuity management;

checks on compliance with legislation, regulations and administrative provisions.

Education in the following field:

You may also be interested in these services and trainings:

Education

Certified ISO 27005 Risk Manager (PECB)

Education

Internal audit of corporate information security

Service

Information security systems management

Service

Corporate information security

Why ZIH?

ZIH has more than 20 years of extensive experience in shaping the modern organization of business risk management systems, in particular information security and information security system management risks, and closely monitors the development and implementation of standards related to this topic (like ISO 31000, ISO 27005, ISO 27001). It has also successfully carried out a number of risk assessments on the use of information technologies, information security risks, the establishment of information security management systems.