IT-security
What distinguishes IT-security from information security?
IT (information technology) is a tool for managing information. Security in IT-systems and IT-infrastructure is called IT-security and is part of the overall concept of information security, which deals with all types of information, including such as handwritten and spoken information.
Information security: Bevarande av konfidentialitet, riktighet och tillgänglighet hos information.
IT-security: Bevarande av konfidentialitet, riktighet och tillgänglighet hos information i digitala system.
The concept of cybersecurity also occurs and is in principle the same as IT-security.
IT-system
IT-systems are digital tools that support different processes. It can be anything from less proprietary applications in standard programs to large overall business systems.
Administrative processes can for example, be supported by financial systems, case management systems, diary systems and personnel management systems. These can often be standard systems that are adapted to the own organisation’s activities.
Why Standardize?
A standard is a common way of solving a common problem. It is a way to achieve transparency and avoid misunderstandings. You save energy by not having to think of everything yourself. Instead, you can lean on something that has been proven. Standards developed and verified by leading experts around the world. For an organization, there are several advantages to using established standards as a basis for selecting and implementing security measures:
It utilizes accumulated knowledge.
A generelly known quality stamp.
Benefits of collaborating with others.
Facilitates procurements and requirements for external partners.
Some important things to keep an eye on
Computers and mobile devices
Almost all computers are connected to the internet. This also often applies to workplace mobiles and tablets.
Secure software and apps
Only download software and apps from known sources. Update them continuously.
Protect networks
The company's firewalls must be secure and passwords strong. Important information should be encrypted.
Secure external IT services
Establish legal agreements with external providers of IT services.
Check permissions
There must be clear routines for which IT systems employees have access to.
Train staff
The human factor accounts for most IT-related incidents. Everyone in an organisation must have the knowledge and understanding required to reduce the risk of mistakes.
The safety requirements must govern
Because IT-systems can look so different and be used in a variety of environments and for different purposes, of course the security requirements for the system also vary. It is the person who is the responsible owner of the system and the information in the system who must make demands on the system's security. The security requirements shall be based on the protection value of the information and the risks to which the system is deemed to be exposed. The safety requirements shall govern which safety measures are to be included in the system in, for example, the following areas:
User instructions - Rules for login and password management.
Authentication - Simple authentication or multi-factor authentication.
Permissions - Who should have access to different parts of the system.
Incident management - Detection, reporting, investigation and measures in the event of incidents.
Encryption - Requirements for encrypting sensitive information.
Education - Related to different roles such as users, administrators, technicians.
Traceability - Special routines for logging (recording) activities.
Backup - Requirements for backup procedures.
Do you need help with your cyber security? Contact Us!