The importance of information security in organizations - CRESCENDO

19627

post-template-default,single,single-post,postid-19627,single-format-standard,qode-quick-links-1.0,ajax_fade,page_not_loaded,,qode-theme-ver-11.1,qode-theme-bridge,wpb-js-composer js-comp-ver-5.1.1,vc_responsive

The importance of information security in organizations

16 Jan The importance of information security in organizations

Posted at 08:17h in APARITII MASS MEDIA, CLUB IT&C by Silvia 0 Comments

0 Likes

Security is becoming increasingly important as a necessary ingredient in any field of activity and has evolved over the past 10 years as a response to the problems of globalization (Via Big Brother). Changes in the paradigm and the subsequent evolution of technologies have brought new concepts such as: borderless security, cloud computing, big data, mobility, etc. Information is perishable, volatile and often uncertified by multiple sources, which is why the processing power for filtering and analyzing large volumes of data is steadily increasing. Any security system must ensure confidentiality, integrity and information availability.

It is estimated that over 80% of relevant information comes from open sources (mass media, the Internet) and more than 80% of incidents come from within the organization.

Today there are two approaches to business security:
• The first linked to the public and / or governmental area (managed by the official/ security structure and regulated by Law 182/2002, GD 585/2002, GD 781/2002, orders, directives and instructions ORNISS as ANS),
• The second linked to the private area (managed by the SMSI responsible and regulated by the criminal code, copyright law, electronic archiving, etc.).

From a formal point of view, these two approaches target the same security requirements and measures and aim to optimize the use of resources (people, processes, technologies). It is worth mentioning that an information security management system (SMSI) targets the information system (information flows). The Information and Communication System (SIC) is only part of the SMSI.

Two basic security strategies are used:
• everything that is not prohibited is allowed;
• anything that is not allowed is forbidden.

In order to protect the special information, two implementation tactics are used:
• discretionary access control;
• legal access control.

Security organization

Organization security culture is a lengthy process that can be developed by imposing security measures and / or mechanisms that minimize the risks that may arise in the business process. Each activity is governed by threats, vulnerabilities and risks. When a risk exceeds a certain acceptable level, we are dealing with a security incident that needs to be resolved (treating the risk until it falls below the accepted level).

Security organization solves at least two basic issues:

Classifies critical information / resources;
Establishes security responsibilities and top management involvement for managing security incidents and business continuity planning in the event of disasters.
Depending on the size, the business processes and the specifics of the activity carried out, the internal organization of the security is a continuous and complex activity.

Risk management

All real-world entities are governed by two states:

the basic state – uncertainty and
transient state – certainty.

From this point of view we can say that risk can be defined as a certainty with a higher ambiguity. In the ISO 27001: 2013 certification process, the first internal security procedure documents the risk management (ISO 31000: 2009) and the resources (human, material) that were analyzed in the implementation of security mechanisms imposed (maximum 114 compared to 133 of ISO 27001: 2006).

Physical security

It is an important security area that can be equipped with dedicated surveillance systems (CATV, access control systems, perimeter systems, burglary, fire, earthquake, etc.) that can be incorporated into an integrated security system (SIS).

Documents security

Aims the documents security in electronic format and in printed format. In most organizations, documents that enter or leave the organization are marked and recorded by the assistant manager at the registry / secretariat. To automate the information classification process in electronic format (documents, messages, archives, etc.), it is recommended to use specific applications (eg Titus).

SIC security

For the SIC / private networks of the organization, you can indicate a variety of professional security solutions: AV / AS / AM solutions, disaster recovery solutions, DLP, SIEM, IAM, forensic. These solutions solve much of the information exchange with the outside (mail, messaging, social networks). An acute problem for network administrators is the secure integration of personal devices into the network, a requirement that was not allowed 5-7 years ago. Telephone calls and environmental discussions are directions where monitoring is insufficient (respecting the right to privacy) and become the main channels of leakage of confidential information.

Staff security

Employees are the most important resource in an organization that can generate over 80% of all security events.
Recruiting, interviewing, testing, hiring, and securing resources in line with job-specific requirements are key issues for any organization. Discontents among employees are often difficult to manage and can cause significant damage. Personnel issues are pursued when hiring, during and after leaving.

Legal security

It is an area that has to find the legal ways in which security records can be used in the process. In recent years, national legislation has been aligned with the European one for which computer crimes are punished. In the context of the terrorist threat monitoring of cyberspace becomes a necessity. There are discussions about finding mechanisms, techniques and procedures that do not violate the rights of the person.

Industrial security

It refers to how information and documents are managed in the case of national, NATO, EU and / or equivalent contracts. Inspections for completing the security appendix and checks to gain access to classified information are performed by designated Security Authorities (ADS) with the support and coordination of ORNISS as National Security Authority (NSA).

Lessons Learned

there is no total security, it is necessary to establish an acceptable level of security depending on the specific activity developed
over 80% of security events / incidents are generated within the organization
analyzing, designing, selling and configuring a security solution must always be addressed with Top Management
the successful management of an SMSI in an organization is dependent on the involvement and participation of all employees in solving security events / incidents and in ensuring business continuity
the transition to the new ISO 27001: 2013 standard brings the following news:
securitatea informatiilor in managementul de proiecte pe baza obiectivelor bine definite (SMART) ale organiztiei
- software installation restrictions
- development policies in safe conditions
- principles of system-safe engineering
- development environment and safe systems testing
- policies in relation to suppliers, communication with third parties
- evaluating decisions, responding to security incidents
- the availability of information processing facilities

Constantin Caliman,
Product Manager & Chief Security Officer,
IT Infrastructure Solutions Business Unit,
CRESCENDO

Article published in Club IT&C

Tags:

Chief Security Officer, Constantin Caliman, CRESCENDO

No Comments

Testimoniale

Ionel Dinu

Director, Valoris Center

Am optat pentru Cisco IP Contact Center integrat cu Microsoft CRM, aplicatie care la randul ei este integrata cu Microsoft Excange si toate lucreaza pe Active Directory, ceea ce era mai mult decat speram sa gasesc. In alegerea Casei de Solutii CRESCENDO ca partener pentru implementarea proiectu(...)

Axel Hummel

President, Libra Bank

Decizia de implementare a acestei infrastructuri este in concordanta cu strategia de diversificare a serviciilor si produselor Libra Bank si asigura suportul tehnic necesar pentru functionarea optima a unei retele teritoriale extinse, asa cum isi propune Libra Bank sa aiba. Clientii Libra Bank (...)

Adrian Dragan

IT Manager, Elite Romania

Ca sa ai un control complet asupra productiei, a costurilor de fabricatie, a eficientei desfacerii, trebuie sa cunosti, zi de zi si ceas de ceas, tot ceea ce se intampla in firma. Toate informatiile despre intrari, iesiri, cumparari, vanzari etc. trebuie sa le strangi ca intr-un cos, din care s(...)

Calin Ardelean

IS Manager ABB Romania

Pe masura ce nevoile de comunicatii ale ABB Romania au crescut semnificativ, investitia intr-o solutie care sa asigure un flux de informatii continuu intre sediul central si celelalte locatii a devenit obligatorie. Solutia aleasa ne-a oferit beneficii imporante: productivitate sporita, costuri (...)

Ionela Ros

Aplicatia a fost primita foarte bine de utilizatori deoarece activitatea lor a fost imbunatatita odata cu aceasta: activitati efectuate pana atunci manual au fost inlocuite de taskuri automate din CRM, in plus au avut acces rapid la informatii pentru care alta data era necesara cautarea in mai (...)

Alex Manoilescu

Implementation Manager, Valoris Center

CRESCENDO a fost capabila sa ofere o solutie solida, care a satisfacut totodata cerinta pentru o solutie flexibila, usor de gestionat si scalabila. Unul dintre cele mai importante avantaje pentru care am ales CRESCENDO a fost abilitatea sa de a livra intreaga solutie si de a acoperi intregul do(...)

Nicolae Ciurea

Chief Executive Officer, Humanitas Group

Tinta noastra a fost implementarea unei solutii performante, care sa se constituie intr-un real ajutor in activitatea de zi cu zi a managerilor nostri. Calitatile produsului software propus de CRESCENDO, precum si profesionalismul de care a dat dovada echipa implicata in acest proiect ne face s(...)

Diana Dutescu

Administrator, IMDIA Targoviste

Pentru a fi intr-adevar competitivi pe aceasta piata, aveam nevoie de toate uneltele disponibile cu care sa putem obtine in timp real informatiile privind activitatea desfasurata si care sa ne permita cuantificarea si optimizarea productivitatii, obtinerea unor costuri de productie reale, cat s(...)

Aurelian Lungu

IT Manager Impact

Aveam nevoie de o solutie care sa eficientizeze lucrul in echipa, o solutie de comunicatii care sa faciliteze audio si video conferintele. Dupa implementarea realizata de echipa CRESCENDO, am obtinut o reducere de 50% a costurilor de calatorie si de comunicare si am unificat comunicatiile.

Doru Badiu

IT Manager, Tuborg Romania

Nu s-a dorit sa se implementeze cea mai buna aplicatie de vanzare sau de analiza de marketing sau cea mai buna aplicatie de contabilitate, ci aplicatia care realiza o buna integrare a functiunilor din intreprindere. Un alt criteriu a fost posibilitatea sistemului de a lucra in timp real si de a(...)

Ilinca Rosetti

Executive Director, Banking Services Department, ProCredit Bank's

ProCredit Bank avea nevoie de o infrastructura sigura si viabila, de o solutie de Contact Center pentru gestiunea apelurilor, integrata cu o aplicatie software care sa asigure managementul relatiilor cu clientii. Casa de Solutii CRESCENDO a fost cea care ne-a oferit o solutie performanta si fle(...)

Daniel Oana

CIO Volksbank

Implementarea in cateva sedii a solutiei Cisco IP Telephony a reprezentat inceputul rezolvarii, cu succes, a problemei costurilor de telefonie ale bancii. Pentru aceste sedii, mutarea catre telefonia IP a permis o reducere cu aproximativ 40% a costurilor opertionale aferente comunicatiilor. Pen(...)

Narcis Mircea

IT Manager, Generali Romania

Generali Romania a decis sa modifice solutia de e-mail IBM Lotus cu versiunea standard Microsoft License 2007 pentru a simplifica administrarea si utilizarea, dar si sa reduca costurile administrative. Ofertele primite au aratat ca la discount-uri similare, costurile de licentiere si implementa(...)

Askar Zhakenov

Group IT Director, Rompetrol

Existenta unui mediu IT eterogen genera dificultati si costuri mari de administare. Practic, in lipsa unui management centralizat, intretinerea implica numeroase deplasari in centrele de date si interventii manuale pe o infrastructura al carei inventar corect era dificil de realizat. Mai mult,(...)

Ionut Savu

IT Manager Agricover

Am analizat piata si ofertele mai multor jucatori, iar Azure ne-a convins cel mai mult. Decizia a fost argumentata de investitiile facute de Microsoft in cloud si de utilizarea in companie a numeroase alte produse Microsoft. A contat insa, la fel de mult, si oferta foarte competitiva facuta de (...)

Laura Afrasine

General Manager, MediHelp

Intreruperile in functionare, atat pentru email cat şi pentru CRM, ne-au determinat sa mutam serverele la un furnizor extern, insa ne-am lovit de probleme cu securitatea, iar furnizorul nu ne-a putut oferi suportul necesar. Este foarte dificil cand nu ai competente tehnice sa intelegi situatia (...)

Johnson Jacob

IT Director, American International School of Bucharest

Am avut o relatie pozitiva si solida cu Crescendo de-a lungul timpului. Am apreciat intotdeauna disponibilitatea lor de a ne sprijini prin profesionalism si expertiza. Solutia de retea initiala a fost implementata in 2004 de Crescendo, iar revenirea la ei, dupa 10 ani, pentru implementarea unei(...)

Nicoleta Dradiciu

Client Operations Manager, Aegon Life Insurance

Ne-am orientat catre Dynamics CRM pe considerente legate de calitatea solutiei si de existenta unei alternative la nivel de suport, constand intr-un canal extins de parteneri cu resurse disponibile, atat la nivel tehnic, cat si de business. De asemenea, am verificat o referinta relevanta, un pr(...)

Marius Dumitrescu

IT Manager, Centrofarm

Ne trebuia un instrument familiar utilizatorilor, iar solutia Microsoft s-a potrivit acestor cerinte – cerintele noastre. Cand rapoartele si filtrarea datelor se fac intr-un program ca Excel 2013 este clar ca utilizarea va fi facila. Complementar am apreciat si PowerView care permite vizualizar(...)