When creating, designing, developing, testing, implementing and maintaining your information networks and your systems, security must be incorporated from day 1 and be central part forever. To start, let’s take a look at what are the key elements of information security. These are:
Vulnerability is where a weakness may provide an attacker the “open door” they are looking for to enter a building, access a computer or infiltrate your network and then have unauthorized access to your information assets.
A threat is the possibility that a person or software would identify and exploit that vulnerability.
Then that entity that takes advantage of the vulnerability is the threat agent.
This leads onto risk. Risk is a combination of the likelihood and the severity a threat agent takes advantage of the threat and attacks your vulnerability. This will have a corresponding business impact and there could potentially be losses.
An exposure is the instance you and your systems are open to losses from a threat agent.
The treatments or controls are actions that reduce risk, close down the exposure and reduce the vulnerabilities.
It’s important to know that these elements are all related.
Terminology is important when communicating information security to your company and its employees.
It’s important to remember that your information networks and your systems are always open to threats. People are constantly waiting for you to slip up and you become exposed.
You need to decide on the risk (or likelihood and severity) of that happening and then reduce the risk with treatments or controls. Those treatments and controls need to be strong enough to reduce the risks down to an acceptable level. If you can’t reduce the risk to an acceptable level then you will be more vulnerable to more and more threats.
Security of your information assets is fundamental to achieving ISO 27001. Discuss security regularly. Make it a priority for your business. Make people accountable. Keep security top of mind at all time. Remember security is not just the job of the IT department.