Are you curious about what a strategy for the security of information in your
organization is? In this video i'm going to be explaining
what an information security strategy is, why you'd want one and what your options
are. I have a PhD in information security strategy
and I've helped many organizations set one. Stick around, it's all coming up.
Craig here, welcome to Informational Risk, where i help you secure your
organization's information using best practice and latest research.
In this channel, I talk about all things security and give you tips and ideas in
videos just like this one, so if you're new here
consider subscribing, down below. In today's video,
I'm going to cover the problem that we're trying to solve and the
four strategies that you can choose from to help you solve it.
First let's start with some context. Information security threats for
organizations globally are predicted to rise in number and scale.
Once breached, organizational leaders then
face hefty cleanup costs to restore their organization's data integrity.
For example, the famous Sony Playstation network outage
in 2011 was a result of an "external intrusion"
in which the personal details from 77 million
accounts were stolen. The outage lasted 24 days
and afterwards Sony stated that the cleanup costs
totaled $171 million dollars. Of concern to organizations, cleanup
costs from information security attacks
globally total as much as $500 billion per annum. Other strategic repercussions
from information security breaches include the increased risk of litigation,
falls in share price, public reputation damage, loss of
customer trust, and disclosure of trade secrets. To
explain the problem, information security governance
standards (specifically ISO/IEC 27014) stipulate
that the organization's executive management
should begin by developing an information security strategy,
sending it to the governing body for approval, and then sending it back to the
executive management for implementation.
Further than that, organizations should then track their progress
towards implementing this strategy with an information security strategic plan.
The problem is that no commonly accepted guidance exists
to explain what an information security strategy even is
or how you would select one that best fits an organization
depending on their particular needs. There are no clear guidelines for
example to explain how to open an office in another country
and safeguard against espionage or how an organization should protect
against over-funding or under-funding information security to
within a dollar, or allowing information to pass between
all stakeholders like regulators, customers, suppliers, staff, and directors.
Compounding the problem, only 50% of company directors claim to be cyber-
literate and the number dropped to 15% for
co-directors. There have only been fragmented research
efforts to date into how organizational leaders can
protect their organization's information at the
strategic level.
Now I'm going to explain the four information security strategies. Before I
do that though, I'd like to give you a quick analogy
that might help set the tone and help you understand the strategies when I
explain them. I have two kids and part of my parent's
duties is teaching them how to have a hot shower safely.
Cold on first, cold off last, that sort of thing. Even so, the kids still complain
that the shower's not hot enough when they get in and so what they do is
they turn the hot up. What I've been trying to do is teach
them that they can turn the cold down and that achieves the same effect. That
also preserves enough hot water in the system for me to have a hot shower after
they're finished. What's this got to do with information
strategy I hear you ask? Let's find out. As an overview, an organisation's
information security strategy is an approach to increasing the overall
security of an organization's information
and it assists with coordinating defensive controls.
The strategy then guides the selection of appropriate
informal and formal controls such as security policy and security culture,
and technological controls for the protection of the organization's
information against threats. Now I'm going to describe the four
information security strategies in detail.The first one I'll cover is
fortification. Fortification describes a situation
where an organization's information value cannot be obviated
and so it must remain at confidential or secret levels.
Information may be secret if it forms the basis upon which an
organization achieves its vision and mission,
for example, irreplaceable trade secrets and so this is termed strategic
information. Examples of information that is
confidential or restricted would be the launch of a new product or
service and the emails of executives. The organization must then protect this
information by applying additional security controls
to mitigate the threat of risk from an attack.
The goal is that by applying additional security controls the organization
becomes more secure overall. The higher the value of
information, the greater the need for comprehensive security
controls. The disadvantage of the fortification strategy
is that it comes with an additional expense burden,
both in financial terms and human capital.
The next information security strategy i'm going to describe is the devaluation
strategy and this describes the active decision
by organizations to lower the value of information that they
hold, either by avoiding holding high value information
in the first place, tokenizing information or expunging old
information. Tokenizing refers to the process of
substituting valuable information with a non-sensitive equivalent, referred
to as a token, which has no exploitable value.
The intended goal is that by eliminating valuable information,
the organization becomes more secure against threats
due to the fact that it has no valuable information
on premises. Organizations also get to avoid the expense
associated with protecting valuable information, both in
a financial sense and human capital sense.
The next strategy I'm going to talk about is the outsourcing strategy and
this looks to share the risk of an
information security breach with an external vendor. Benefits include
gaining access to more highly skilled or qualified staff,
an external provider's larger security budget,
and providing latent capacity and scalability.
Outsourcing ICT infrastructure can take the form of secure
and resilient ICT infrastructure, managed by a third party, with scalable
security controls or even cyber insurance. Information
hosted externally is perceived to be held
more securely because the external providers have the advantage
of scale and scope. Outsourcing comes with a loss of control however
and therefore possible increase in risk. There are a lot of factors that may
prevent the outsourcing of information externally such as regulatory compliance
and the external threat environment.
The fourth information security strategy I'm going to talk about
is the minimization strategy. The goal of the minimization strategy
is to provide the minimum viable security for non-valuable information
so that an organization can't be said to have been completely negligent
in the event of a security breach. It provides a plausible defense
for those responsible for information security controls against accusations
from information owners that insufficient protection was provided
for the organisational information. It can take the form of hosting on
external public cloud and takes advantage of the security
controls put in place by vendors with large security budgets and mature
processes.
So, question of the day. What strategy do you think your organization follows
and do you think that's the right one after watching this video?
Let me know in the comments below and remember that as a community, we all
learn more. Thanks for watching. Remember to like (or
dislike) this video and to click subscribe.
And if you'd like to get started on information discovery for your
organization, I have a link to a free template in the
description below to help get you started. As always here
at Informational Risk, I'm here to help you protect your organisation's
information using best practice and the latest research. Stay safe and
I'll see you in the next video where I talk about the process for how
to select the best information security strategy
for your organization.