Information Security

Cybersecurity, network security and info security each serve a specific purpose in your security infrastructure

We are in a time where businesses are more digitally advanced than ever, and as technology improves, organizations’ security postures must be enhanced as well. Failure to do so could result in a costly data breach, as we’ve seen happen with many businesses. The cybercrime landscape has evolved, and threat actors are going after any type of organization, so in order to protect your business’s data, money and reputation, it is critical that you invest in an advanced security system. But before you can start developing a security program for your organization, it’s critical that you understand the different types of security and how they all work together.

What is Information Security?

Information security (also known as InfoSec) ensures that both physical and digital data is protected from unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction. Information security differs from cybersecurity in that InfoSec aims to keep data in any form secure, whereas cybersecurity protects only digital data. If your business is starting to develop a security program, information security is where you should first begin, as it is the foundation for data security.

Governance Framework

When you’re creating your information security program, you’ll want to start with having the proper governance structure in place. Governance is the framework established to ensure that the security strategies align with your business objective and goals. Governance bridges the gap between business and information security, so the teams can efficiently work together. The framework also defines the roles, responsibilities and accountabilities of each person and ensures that you are meeting compliance.

CIA Triad

When MICRON INFOCOM are developing policies and procedures for an effective information security program, we use the CIA (confidentiality, integrity and availability) triad as a guide. The components of the CIA triad are:

• Confidentiality: ensures information is inaccessible to unauthorized people—most commonly enforced through encryption—which is available in many forms
• Integrity: protects information and systems from being modified by unauthorized people; ensures the data is accurate and trustworthy
• Availability: ensures authorized people can access the information when needed and that all hardware and software are maintained properly and updated when necessary

The CIA triad has become the de facto standard model for keeping your organization secure. The three fundamental principles help build a vigorous set of security controls to preserve and protect your data.

What is Cybersecurity?

Cybersecurity, a subset of information security, is the practice of defending your organization’s networks, computers and data from unauthorized digital access, attack or damage by implementing various processes, technologies and practices. With the countless sophisticated threat actors targeting all types of organizations, it is critical that your IT infrastructure is secured at all times to prevent a full-scale attack on your network and risk exposing your company’ data and reputation.

Social Engineering

When cyber-threat actors target your organization, they research not only your business, but your employees as well. They know that employees outside of IT security aren’t as aware of cyber threats, so they execute cyberattacks that exploit human vulnerabilities. Through the process of social engineering, threat actors manipulate people into giving the access to sensitive information. The most common social engineering attacks include:

• Phishing: usually in the form of emails or chats, where the threat actors pose as a real organization to obtain personal information
• Pretexting: when a threat actor impersonates an authority figure or someone that the target would easily trust in order to get their personal information
• Baiting: when threat actors leave a malware-infected device, such as a USB or CD, in a place where it can be easily found by someone, who would then use the infected device on their computer and accidentally install the malware, giving the threat actors access into the target’s system
• Quid pro quo: when a threat actor requests personal information in exchange for some form of reward, i.e. money, free gift or a free service

As a business leader, it is your responsibility to build a culture of security awareness and fill in the gaps in your team’s cybersecurity knowledge and understanding. It’s essential that your workforce be informed of cybersecurity risks, so it will be less likely for an employee to fall victim to an attack. Provide your employees the necessary training and technology to strengthen your organization’s human firewall and mitigate the possibility of a cyberattack.

What is Network Security?

Network security, a subset of cybersecurity, aims to protect any data that is being sent through devices in your network to ensure that the information is not changed or intercepted. The role of network security is to protect the organization’s IT infrastructure from all types of cyber threats including:

• Viruses, worms and Trojan horses
• Zero-day attacks
• Hacker attacks
• Denial of service attacks
• Spyware and adware

Your network security team implements the hardware and software necessary to guard your security architecture. With the proper network security in place, your system can detect emerging threats before they infiltrate your network and compromise your data.

There are many components to a network security system that work together to improve your security posture. The most common network security components include:

• Firewalls
• Anti-virus software
• Intrusion detection and prevention systems (IDS/IPS)
• Virtual private networks (VPN)

When your network security is compromised, your first priority should be to get the attackers out as quickly as possible. The longer they stay in your network, the more time they have to steal your private data.