Why risk based approach is a better defence?

By


What is the best approach to address your organisation's information security issues?

There are common as well as your business specific Information security threats and mitigation techniques to handle them. 

For instance, you may already may have  staff  training, anti-malware and other technologies in place.

However, you may not know how effective is your defences until meet a real threat.

This requires every organisation to build their defence according to the potential information security risks they might face.

So, what actually is a risk-based defence?

Your organization does not have an unlimited budget for information security. This requires you to best use available resources carefully to build your defence.

The best approach is to conduct a risk assessment, identify risks and  prioritize your risks. Then you can implement appropriate controls to mitigate your risks.

ISO 27001 ISMS standard provides you a framework to follow a  risk-based approach to meet your specific needs efficiently.

After you have initiated ISMS project based on ISO 27001 framework, identified and documented your information security objectives, policies, a risk assesment should be  carried out with following processes.

  • Identifying information assets
  • Identifying their risks
  • Analysing risks
  • Evaluating risks
  • Selecting risk management options (controls) 

Then create a risk treatment plan. it lists out assets, risks, risk owners, security controls, justification, time target, and status. 

Finally implementing your risk treatment plan, and make organisation wide awareness and training. 

For your ISMS to be effective, it must meet your information security objectives with implemented controls.

The monitoring of your security controls is very important with internal audits to review the security performance to understand what’s working and what could be improved.

Once your ISMS is in place, your organisation can seek ISO 27001 certification from an accredited certification body.

Niranjan Meegammana 


Comments

Post a Comment

Popular posts from this blog

ISO 27001 ISMS in a Nutshell

By
Image
Image : ISO The ISO 27001 certification is the most comprehensive  information security standard recognized globally. It ensures standardizing of your organisation's information security strategies to ensure confidentiality, integrity and availability of your systems and data to conduct your business effectively.  Gaining the certification is a journey with several milestones. It is a carefully planned systematic activity that transforms an organisation to a secure entity,  where everyone becomes a stakeholder in information security. Follow this processes to get to your goal successfully. Step 1. Obtain Management Support . This is the most critical requirement to achieve ISO 27001 status. Your ISMS project will definitely fail if it does not receive to management support. The management should provide, people, money and strategic direction for your ISMS to be a success story. In the sections below you’ll find some tips on how to convince your management, and how much the implemen
Read more

Best Practices for secure Software Development

By
Image
image : OpenSense Labs Are you aware of the  Solarwinds attack in 2020? The hackers exploited software vulnerabilities of Orion IT monitoring and management software used by thousands of enterprises and government agencies. This hack triggered a larger scale supply chain incident which affected thousands of organizations, including the U.S. government. The attackers infliltrated the Solarwinds network, and infected the software used for Network monitoring before it shipped to customers.This insident and many more warn us on the importance of building secure software.  Secure software development is a methodology used for creating robust software by incorporating security practices into every stage of the software development life cycle (SDLC). It begins at planning stage before a single line of code is written, and continue through the life cycle. A bug fixing at implementation stage cost six times than fixing it during design stage. Every new feature added, may carry series of vulnera
Read more

How easily the data breaches occur? 5 ways to be aware of.

By
Image
Data breaches can occur at any unexpected moment. Unless you do not detect it fast, cybercriminals will have more time to exfiltrate information and cause bigger damage. On average it takes up to 30 days and costs $1 million to address a data breach incident stated 2021 Cost of a Data Breach Study. However, it could be more if you wait longer. Unfortunately, some took 6 months to respond.      Better safe than be sorry! Be prepared against data breaches.  There are 5 ways for your organization to avoid data breaches. Here is how. 1. Weak and stolen credentials  The most simplest way hackers use for data breaches is stealing passwords. Many people use predictable passwords like ‘Password1’ and ‘123456’. With them, cybercriminals don't even need to hack into a system to steal your sensitive data.  There are many tools that can help a cybercriminal to crack passwords. They run millions of popular credentials to break into your system. This requires you to have a strong password policy
Read more