Information Security: What It Is and Where to Start

Many companies think they have security because they have an antivirus and an IT person. It is like saying you take care of your health because you own a first aid kit. Good to have, but far from the whole thing.

Information security is really the care you take of the important information in the company: contracts, customer data, prices, recipes, plans. Whether it sits on a server, a laptop, on paper, or in the head of an employee talking on the phone on a train.

The three things you protect

Everything information security does revolves around three simple ideas. You will find them everywhere, under the names confidentiality, integrity and availability.

• Confidentiality. The information is seen only by those allowed to. The salary list does not reach the whole company, one customer's data does not reach another.
• Integrity. The information is correct and nobody changes it secretly. A bank account on an invoice stays the real one, not one swapped in by an attacker.
• Availability. The information is there when you need it. If an attack locks your system and you cannot work for a week, you have an availability problem, even if nothing leaked.

Any incident damages one or more of these three things. If you remember these, you already understand half of the subject.

Not just IT: people, processes, technology

This is the trap most companies fall into. They buy expensive technology and think they are done. But security rests on three legs, and technology is only one.

• People. An employee who recognises a fake email stops an attack no program would have caught in time. It is also a person who keeps a password on a sticky note on the monitor.
• Processes. Simple, written rules: who has access to what, how to send a file safely, what to do when a colleague leaves. Without them, everyone improvises.
• Technology. Good passwords, encryption, backups, updates. Necessary, but useless without people and processes behind it.

We wrote more about the people side in the article on security culture and in the human factor.

ISO 27001: a ready-made recipe

You do not have to invent everything from scratch. There is an international standard, ISO 27001, that describes how a company sets up its information security and keeps it alive over time. In practice, it is a checked list of things to think about, from rules and roles to people and technology.

You are not required to get certified to make use of it. You can take its structure as a map: it helps you not to miss whole areas and not to jump into technology before you know what you are protecting. We wrote separately about how the standard handles the people side, in human resource security in ISO 27001.

Where you start, concretely

Not with shopping. With an honest look at what you have.

• Make a list of the information you have and where it sits. You cannot protect something you do not even know exists.
• Ask yourself what hurts the most. Which information, if lost or leaked, stops your business or loses your customers. That is where you put the effort first.
• Put the basic measures in place. Good passwords and two-step authentication, tested backups, role-based access, updates on time.
• Train your people. A few simple rules, repeated, change more than any new product.
• Write a plan for when something happens. Who calls whom, what you shut down first. Better on paper now than improvised in a crisis.

At INFOSHARE we walk exactly this path together with companies, step by step and in plain terms. See our information security service, audits and testing, and for a practical guide, the article on business resilience.

Frequently asked questions