Remember good information security

Information security is one of the most important concepts in the GDPR - if a company does not have adequate information security, it means that they are not handling and processing information correctly. This applies to personal data as well as business information. This is why it is important to know information security and how to have the best information security. Soon, companies will be compared on how well their data is secured - you want to be at the top, don't you?

Information security you need to know

When you process personal data, you need to be aware of both the GDPR and your company's information security.

The GDPR is about knowing what security there is around the personal data that your company process. Basically, it is about the company and its employees becoming better at taking care of personal data.

With the GDPR comes the expectation that we have control of our information security. This means that the information that a company holds is secured from unauthorized persons.

Some of the things that information security must prevent are:

• Unauthorized access to data
• Misuse of data
• Disclosure of data
• Deletion of data
• Corruption of data

Another thing to remember is that personal data can be in an electronic format as well as in a physical format. In other words, personal data is stored both in software on the computer and in paper form - so information security applies to the computer and the physical environment in which the data is stored.

CIA = optimal information security

Information security is designed to protect the confidentiality, integrity and availability (CIA) of computer systems as well as physical systems. The CIA must prevent malicious actors from gaining access to the information in your possession.

CIA should help you focus on optimal information security. Therefore, some of the best practices in information security are:

• Information security policies
• Strong passwords
• Multi-factor authentication
• Anti-virus programs and firewalls
• Cryptography
• Enhanced security

The best way to achieve information security is to have structured and organized risk management. **In short, risk management is an overview of the risks that can be found in the company's systems.

Some of the things you can achieve through risk management are:

• Identify information and what relevant threats, vulnerabilities and unauthorized influences may be there.
• Evaluate risks.
• Decide how to handle risks, e.g. by communicating and sharing the different threat pictures between employees, so you know what the threat picture looks like.
• Information security must communicate, select, design and implement security controls.
• Monitor activity and manage problems and improvements.

Who is responsible for information security?

All employees in a company are responsible for ensuring that information and personal data is stored and handled correctly. However, there are many different factors that can affect information security.

You may experience power failures that compromise the security of digital personal data; you may experience servers not responding; there may be theft and break-ins in the company or there may be unpatched endpoints in the systems.

Although information security covers physical and digital information, there is an exponential increase of digital information being stored in company databases. Therefore, cyber security is another important and crucial implementation in good information security.

As you know with cybersecurity, it is the employees who are the main defense against hackers and cybercriminals. It is human error that causes information to be corrupted or compromised.

So, because information security covers digital security, it is IT managers who have the extra responsibility for a company's information. By securing networks, systems and software, a company is well on its way to enhanced information security.

Awareness training is the way forward

With an increased focus on digital security, there will be an even greater focus on the individual employee, as it is through employees that hackers see their way into systems and install malware on computers.

Once a hacker has installed malware, they can:

• Monitor the device.
• Access documents.
• Use the files as hostage for ransomware attacks.
• Sell the files on the dark web.
• Share the files in data leaks.

Therefore, it is essential that all staff are aware of the risks of poor information security - good cybersecurity is good information security.

In the past, the two concepts were not very closely related, but because everything is digital now, they have become interwoven.

Risks and threats of poor information security

There are different types of threats and risks associated with poor information security - both digital and physical.

The first and biggest threat that can be found in poor information security is software attacks. This includes viruses, malware, worms, ransomware and any malicious coding that compromises files and documents.

Once a cybercriminal gets into a company's software and network, they can do immeasurable damage. They can encrypt files so employees can't read or view the documents, or hackers share documents without the consent of the people the information concern.

There is also the threat that physical documents and information can be stolen. This is true both in paper form, but many thieves will steal the devices on which the documents are stored - in this case, the company will not only lose information and documents, but also computers, tablets and phones. This is because digital security applies to all devices you use in the course of your work.

Finally, you could face heavy fines for not complying with the GDPR - if you lose personal data when unauthorized persons get hold of it, or if it is stored improperly, you could end up with heavy GDPR fines.

What is the best way to respond to the threat?

Once you have identified an information security threat, you can do the following:

• Reduce the risk by implementing security measures and preparing to respond to the threat - When you are prepared for a potential threat, you can respond quickly and effectively.
• Contact the company's data controller and IT department if it is an IT incident - they can react quickly and possibly recover the lost documents.

With GDPR, all companies in the EU are required to comply with the GDPR law - this involves increased information security and proper processing of personal data.

GDPR will inevitably affect your company's reputation. Soon, companies will be compared on their information security, and customers and partners will choose the company with the best information security. No one wants to work with a company that has poor information security.