корица 1 парциален лак - SEE Top 100 - SeeNews

www.top100.seenews.com
biggest enthusiasm for information security
comes out of the non-IT sector, believe it
or not. The most significant issue, however,
is who really needs information security.
Q: Which sectors do you think really need
information security?
A: First, all of the organisations required
to implement information security
policies by law. These are all the public
administrations, because they process and
handle a lot of data that generally don’t
belong to them. Secondly, there are the
health organizations that process highly
sensitive data regarding the health of their
patients, as well as data critical for saving
human lives such as personal allergies. This
is also applicable, but to a lesser extent,
to clinical laboratories and pharmacies.
Thirdly, there are the specialized business
services: investment, law and tax consulting,
insurance, payroll, archiving, auditing and
finance. All of these providers of business
services have the necessary goodwill and
ensure the inclusion of confidentiality clauses
in the relevant contracts, but only a few of
them can guarantee information security due
to a lack of systematic approach. Another
sector is banking where the situation is
slightly different, as they deal with money,
which, actually, represents just electronic
data in their information systems. The
emphasis is not on the confidentiality as
many might think, but on the data integrity,
availability and business continuity. There
are parliamentary debates in Hungary, for
instance, about mandatory implementation
of an information security standard at
all banks. I recall the case with Lloyds
Bank in the UK two years ago, when the
pension data of 10 million people was lost
and could not be properly retrieved. In
rare cases, data could be retrieved from
memory, of course. Data processing, billing
and courier companies also deal with
information security issues. The printing
out and delivery of invoices requires access
to the databases of the telecoms and utility
companies, which contain sensitive data
about the end customers. How would
you feel if information about your home
telephone number and calls becomes
public? Information about a household’s
consumption of gas, electricity and water
can be used to determine people’s habits,
i.e. when there is nobody at home, etc.
Would you insist that this information is
safeguarded? Then there are the outsourcing
companies, which work on secret projects for
big corporations. All outsourcing companies
conclude NDA (Non Disclosure Agreement).
All of them have the intention to uphold
the agreement but how many of them can?
You see, if you want to be in this business,
your information security capabilities need
to be proven. Information security is also
an issue for special institutions like police,
defense and the like where data is either
a state secret or is very sensitive. The law
of classified information stipulates what
needs to be done. The information security
management system explains how it should
be done. All these institutions work with a
broad range of suppliers, who also need to
take into consideration their information
security requirements.
Q: Well, it appears that many sectors have
different reasons to implement information security
policies. Isn’t that very expensive?
A: On the contrary! Elimination of risks
is very expensive. Implementation of
information security system does not
eliminate the risks, but reduces them to
an acceptable level. By doing so, data
sets with varying degree of value receive
different level of protection. The level of
protection depends on the identified risks.
There is no business sense to spend money
on information protection if the value of
the information is less than the cost of the
protection. Because of this “business logic”,
the top managers are very accepting of
information security. A lot of companies
have implemented good information security
practices, but haven’t integrated everything
together. It is time that they make a return
on their investment in information security.
The fastest way is to approach the issue
systematically. Then we have a pay-off.
Q: It still appears that the implementation of an
information security system is a task that only
Bureau Veritas Certification
4th Floor, 81A, Bulgaria Blvd., 1404 Sofia, Bulgaria
Tel. +359 (2) 983 60 00; Fax +359 (2) 983 60 65
certification.bulgaria@bg.bureauveritas.com
http://www.bureauveritas.com
SEE TOP 100 Banks
big companies can take on. Is that so?
A: I don’t think so. One well organized
small pharmacy meets about 90% of the
information security standard requirements.
The same applies to the small private medical
laboratories, which I had contacts with.
What is missing is the synchronization of
the security controls, analysis and awareness
of the risks and business continuity plans.
Small firms have a small volume of valuable
information and can protect it easier with
less protection mechanisms. A smaller staff
offers some advantages like easier prevention
of information leaks. The time for training
and awareness is also shorter.
Q: Does it mean that the smaller firms don’t
need to implement all requirements and security
controls?
A: Yes, it does. The information security
standard allows justified exemptions. If
we come back to the small pharmacy
example, all network control requirements
can be excluded. There are very seldom
more than two computers – no need for
network segregation, routing security
or other network controls. We only do
what is needed. This is the essence of the
information security standard. It applies
to small and big companies, to everyone.
Q: Are there many companies in Bulgaria that
have implemented this standard?
A: There is no definitive answer. A lot
of companies have implemented a lot of
requirements and control measures, without
knowing that such a standard exists. If we
talk about the companies that can prove
the implementation there are about 60.
Q: How can the companies prove their information
security level?
I have only one answer to that – accredited
certification. There are about 60 companies
in Bulgaria that hold accredited certificates
for information security. I had the pleasure
to audit most of them. The interest
towards information security certification
is increasing. The excitement is yet to come.
I am confident about the future.
SEE TOP 100 Banks
21
page 21