Foundations, Standards, and Principles of Information Security
In today’s information-centric environment, the concept of information security is paramount and is now on par with other business functions. Irrespective of their market share, private or public status, or geographical location, businesses are being pushed to move online in order to stay relevant.
In the 21st century, we have all experienced the information revolution. Data is stimulating the information revolution in the same way that oil catalyzed the industrial revolution. In today’s environment, data is the raw resource that must be studied, interpreted, and retrieved with care in order to provide significant insights to its users.
The difference between oil and data is that the volume of oil is reducing across the world, whereas the amount of data is growing day by day. Data has become a valuable commodity and fuel source in today’s world.
On the other hand, data-related cybercrime such as data theft is expanding exponentially. A data breach occurs when a company unwittingly exposes critical information that might cause damage to a company’s reputation, brand value, and customer trust, or even result in regulatory penalties.
The average cost of a data breach was $4.35 million in the year 2022, according to IBM’s Cost of a Data Breach Report 2022. While the average cost per record was $164 in 2022, the cost per record has climbed considerably since 2020. Hackers are primarily interested in a company’s customer information because they can use it to blackmail the company or sell the information to competitors. Data has become, on average, more valuable than any other asset. Information security principles guide the entire concept of data security.
This chapter will explain the fundamentals of Information Security, including why it’s important and how security frameworks can help reduce risk and develop a mechanism to manage information security across an enterprise. The key topics covered are the following:
- The CIA triad
- Information security standards
- Using an information security management system
- The ISO 27000 series
