English
Nederlands
Your information security and privacy protection in order
Information security and privacy
The Internet is more present than ever. Almost every organization uses an e-mail client, website and other online tools such as a CRM system. This means that a large amount of information is stored and exchanged digitally and online. This (sensitive) information needs to be stored securely. This can only be done through strict information security.
Implementing strict information security properly involves applying a large number of measures to reduce the amount of risks and external threats.
It is insufficient for companies just to know that they need to do information security, they need to have tools available to help them execute business processes, internal operations and make strategic decisions.
The three basic principles of information security
Over time, more and more reliability requirements around information security have emerged. These include three basic principles of information security and legislations (such as the AVG).
To determine the intended level of your information security, the reliability requirements that must be met will be identified. Generally, this classification is done according to the BIV classification, which looks at the following three aspects:
- Availability. Authorized users have access to information and/or systems at appropriate times.
- Integrity. Ensuring the accuracy, timeliness (timeliness) and completeness of information and its processing.
- Confidentiality. Ensuring accessibility of information to only those authorized to do so.
Why does information security matter?
For many organizations, information security is a burden rather than a blessing. Employees feel restricted in the flexibility of performing their jobs. In addition, the media also pays a lot of attention to privacy protection and information security, even creating aversion to the subject in some situations.
Yet strict information security is desperately needed. In recent years, more than four in 10 companies have experienced cybercrime. The actual number of organizations affected is probably much higher, as nearly 10 percent of organizations have no idea whether a data breach has occurred within the organization at all.
What exactly is information security?
In simple terms, information security is the mapping and assessment of all processes surrounding information within an organization. This is often done through an Information Security Management System (ISMS). With this, among other things, processes are identified and regularly monitored for potential risks or threats.
What is the purpose of information security?
The goal of information security is to ensure that sensitive data does not end up in the wrong hands. Through adequate information security, threats and risks are usually recognized in time and therefore prevented. This prevents adverse consequences for you and your customers.
Consequences of poor information security
Poor information security can have major consequences for organizations. Not only financially, but also when it comes to customer data, customer trust in the organization and sometimes a company can even temporarily shut down. As awareness of the potential consequences increases, information security is beginning to play an increasingly important role within organizations.
- Information security and ISO27001
As an organization, there are several ways to do information security. Some organizations are expected to meet a certain standard. ISO 27001 was created for this purpose. This standard provides guidelines around information security within the organization. If this is met, the organization will receive a certificate.
- Information security and NEN7510
Different rules apply to organizations within healthcare. These organizations are required to maintain strict information security. They demonstrate this with a NEN 7510 certification.
Threats in perspective
In as many as 70% of all information security incidents, the actions of in-house personnel appear to be part of the cause. Examples include the loss of a laptop or phone, clicking on a link from a spam email, or sending sensitive information to the wrong person.
Of course, there is also significant risk at the technical level where today's measures may be insufficient for tomorrow's threats.
Especially for smaller organizations, it is difficult to have an appropriate response in this dynamic. The challenge scares and makes one uncertain about what is needed and how to achieve it. The knowledge for this is often insufficient and time and costs are also a significant barrier.
The obvious choice is then to do little or nothing and to accept the risk of damage as a result of such incidents. After all, business is about taking risks.
Yet the costs and time involved in providing an adequate level of security need not be great and can even be a saving. If you plot the potential damage against the cost of prevention, there is a clear optimum.
As a business owner, you are accustomed to weighing the level of measures and the costs you incur against the benefits: savings from potential incidents. That potential damage is different for each organization and so is the level of measures to be taken. As an indication: for SME companies, the average loss per digital burglary is almost €79,000.
Our solution: Base27
Axxemble aims to support organizations in small and medium-sized businesses in a smart and practical way with adequate information security. We do this by making the aforementioned questions central to our solution, Base27.
Our online software tooling provides a framework (ISMS) for policy and organization around information security, risk management, description of processes and procedures and support for conducting the various registrations.
Using Base27, you are able to quickly set up information security around the desired standard, including support for the new privacy legislation.