Publication Date
Information security: 4 key goals
Business information security has a reputation for complexity. People believe, often mistakenly, that only a seasoned pro can truly grasp what it’s all about. The truth is, business strategies always matter more than technology, even when the environments we’re talking about are digital ones. That’s because security is the helmet, kneepads, and gloves—not the bicycle.
No matter what your business strategies, data security processes all have the same goals. It’s their relative importance that varies depending on the criticality of your data, the risks you face, and the potential impact of any problems. Those are the factors that should determine the solutions you need to meet your objectives for data availability, integrity, confidentiality and traceability.
Availability
As a business, you have to make sure the people who require access to your business data can get it when they need it. It may sound obvious, but the level of availability you need will directly affect your approach to security. The impact of a one-hour outage at an international online retailer is far different from the consequences of an HR system outage on a Friday night.
The point is, the things you need to do to ensure system availability are directly proportionate to how much availability you need to successfully run your business.
Integrity
In an IT context, data integrity is about the tools that will ensure data remains intact, with no modifications whatsoever. Data must remain valid, reliable, and accurate throughout its entire lifecycle, but it can become compromised in a number of ways, from hacking to plain-and-simple human error.
Make sure only people with the right permissions and competencies can access your systems. Anomalies must be spotted and corrected right away, and when disaster strikes you must be able to recover your data and restore integrity quickly, with minimal disruption to business continuity.
Confidentiality
This is where your policy on the protection of personal and business information comes into play, because your data must only be accessible to the people authorized to use it. The purpose of your policy is to set out the rules for collecting, using, and disclosing information. The more critical or sensitive the information, the tighter the restrictions.
To apply these rules and maintain absolute confidentiality, your users must be identified and authenticated and your data must be encrypted and monitored as it moves between systems. All anomalies must be detected and immediately corrected.
Traceability
Traceability lets you pinpoint the origin of data and track it at each stage of its journey. It provides a record of the movement and status of your information. When your data is traceable, you can make sure your availability, integrity, and confidentiality criteria are met. Traceability can also be used to detect and repair potential cracks in your system.
But the biggest benefit is being able to analyze the cause and the effect of data modification, two critical factors that shape your governance and compliance strategy.
Be ready for Law 25
When it comes to information security, many businesses are already subject to a variety of existing laws and regulations. The European Union has the General Data Protection Regulation (GDPR), and Canada has the Personal Information Protection and Electronic Documents Act (PIPEDA), to mention just two. Since September 2022, all Quebec companies have to comply with the provisions of Law 25 on the protection of personal information.
The purpose of the Law is to give people more control over their personal information. This is something you need to start thinking about now to be sure your company meets the compliance targets and deadlines set out in the new law. As you can imagine, when it comes into force Law 25 will have a direct impact on your approach to information security management, your processes, and, by extension, your tools.
One of the highest-risk cyber security threats against your organization is the sharing of content across your M365 apps like Outlook, SharePoint, Teams and OneNote. Learn about your shared responsibilities with Microsoft and the solutions available to protect your data, your company and your employees.
The right tools to keep your business secure
You’ve identified the criticality of your data, the risks you face, and the potential impacts if things go wrong. To comply with current legislation, you’ve set targets for data availability, integrity, confidentiality, and traceability. Now it’s time to bring in technology. This is when you finally get to choose the tools best suited to meeting your objectives.
With 60 categories of tools that we can sort into 6 main groups, there are thousands of possible combinations. That’s why it’s so important to think ahead about what you need.
- Identity and access management: Microsoft Active Directory, for example
- Monitoring: Intrusion detection system, network performance
- Detection and remediation technology: firewall, antivirus software, spam catcher, anti-spyware software
- Encryption: Strong authentication, ciphering
- Business continuity: Data backup and recovery
- Application security: Vulnerability detection, code review
When choosing your tools, remember that all that glitters is not gold. Stick to your plan and your goals. The steps you take should be proportionate to your assessment of criticality, risks, and impacts. Always keep that in mind, and your investment will hit the mark.
Your information security strategy and policies are key factors in fulfilling your company’s vision and mission. They not only have a major impact on your competitiveness and team productivity, but they also secure knowledge continuity within your organization.
To learn more about ITI’s lineup of security solutions, see our sections on access and identity management and device managements.
Are you concerned about the security of your data?
