An introduction to information security

Data breaches, usually through cyberattacks, are becoming more common. Not only are they damaging to a firm’s reputation, but they can also impact profitability and have other financial impacts. For example, the resulting downtime can lead to lost business, while government regulations like the CCPA can lead to regulatory fines or penalties. Investing in information security (InfoSec) is more important than ever.

IBM’s Cost of a Data Breach report shows the global average cost of a data breach in 2024 is USD 4.88m, up 10% from last year’s high of USD 4.45m. It also states that organizations using security, AI and automation extensively in prevention saved an average of USD 2.22m compared to those that didn’t.

Recently, there’s been a lot in the press about the risks of poor cyber security, which we highlighted in our blog about minimizing supply chain cyber threats. However, this blog focuses on information security, which is just as challenging due to ever-changing markets, technology and legal restrictions that open new vulnerabilities.

Let’s start with some definitions.

What is information security?

Information security (InfoSec) is an overarching term that protects confidential, private, and sensitive information and data in all formats – digital or hard-copy – across networks and infrastructures, as well as testing and auditing to maintain business continuity. To manage information securely, it covers all processes, tools and policy settings used to protect from unauthorized access to information that could lead to modification, disruption, disclosure, misuse or destruction.  

InfoSec aims to ensure the safety and privacy of critical data like customer account details, financial data or intellectual property.

What is cyber security?

Cyber security is a subset of information security that protects digital or electronic data, devices, networks and systems from technology-related threats, not printed or hard-copy data.  

The benefits of InfoSec

A robust InfoSec security program can bring organization-wide benefits, including compliance with data privacy and protection regulations such as HIPAA and PCI-DSS, cost savings by having appropriate measures for different levels of data, greater efficiency in information handling, reputation protection from security breaches, reducing the risk of security incidents and ensuring business continuity.

The fundamentals of InfoSec

Information security programs apply the principles of InfoSec to security policies, protections and plans. These could include risk assessment, identifying system vulnerabilities and threats, and having response plans should an incident occur.

Three elements – the CIA Triad – make up information security: confidentiality, integrity and availability. The CIA Triad should be used as a guiding principle for an InfoSec plan.  

Confidentiality

The confidentiality principle ensures that unauthorized parties cannot access data they aren’t authorized to access, so sensitive data is kept private. Only those who own or need to see it should have access to the data through encryption, multi-factor authentication and data loss prevention.

Integrity

Data integrity ensures data accuracy, completeness, consistency and validity by maintaining accurate and consistent data throughout its entire lifecycle. This involves protecting it from unauthorized additions, deletions and alterations from malicious users and those with good intentions but incorrect implementation.

Organizations can implement file permissions, identity management, and access control to maintain accurate and reliable data to prevent unauthorized access.

Availability

Software and systems should be continuously reviewed and updated where there are vulnerabilities to ensure systems, technology, and infrastructure are available when needed.    

Availability allows authorized users access to the information when needed, so it’s essential to ensure the robustness of all systems to prevent them from failing and avoid unnecessary downtime.  

What are the different types of information security?

InfoSec involves security tools, solutions, and processes to keep data secure and protect against cyberattacks and data breaches.  

There are seven main types of information security:

• Application security
• Cloud security
• Cryptography
• Infrastructure security
• Incident response
• Disaster recovery
• Vulnerability management

Application security

We’ve become an app-dependent society. Whatever you’re doing, the chances are you’ll find an app that will make the action easier. While apps bring many benefits and efficiencies, they also create more entry points for InfoSec breaches. Application security focuses on finding and blocking vulnerabilities, such as authentication or authorization, code and configuration integrity and configurations, and mature policies and procedures in apps and application programming interfaces (APIs).

It also covers policies, procedures, tools and best practices to protect applications and their data.

Cloud security

Gone are the days of buying software and waiting for boxes of CD-ROMs to arrive before you can start to use them. Thanks to technological advances like software as a service (SaaS), more data is being held in the cloud. When a third party hosts your data in the cloud, you must ensure they adhere to your security standards. When using shared environments, it’s essential to have adequate isolation between different processes to maintain secure processes. Ask your software provider if they use an information security management system (ISMS) to keep your data safe.

An ISMS includes guidelines and processes that help organizations protect their sensitive data and respond to data breaches. Having guidelines also helps with continuity if there is significant staff turnover.

ISO/IEC is the world’s best-known standard for information security management systems and their requirements. More than a dozen ISO/IEC 27000 standards cover additional best practices in data protection and cyber resilience.

As an accredited certification body, ISO/IEC 27001 provides the international standard for companies of all sizes and industries with guidance for establishing, implementing, maintaining and continually improving an information security management system. 

ISO and SOC 2 set out criteria for managing customer data based on the information security CIA Triad – confidentiality, integrity and availability. SOC 2 adds security, processing, and privacy to cover all bases.

When a company has ISO/IEC 27001 accreditation, you can be sure they have systems to manage data security risks. By protecting sensitive data, you’ll comply with relevant legislation, improving your reputation and boosting stakeholder confidence.

For example, EazyStock’s inventory optimization software is ISO/IEC 27001 and SOC 2 Type 2 certified, so customers can be assured it provides a safe and secure hosting environment for their data.

Cryptography

Cryptography hides or codes information so only the intended recipient can read it. Encryption is one of the main types of cryptography used to maintain data security, integrity and confidentiality. Encryption converts readable information into unreadable information using a digital key, which people need to access the data.

Infrastructure security

Infrastructure security protects internal and external networks, hardware and software such as data centers, servers, cloud resources, desktops and mobile devices. While these could include physical security systems, such as access control, surveillance systems and security guards, it also includes digital security. This could be through firewalls, penetration testing, network monitoring and virtual private networks (VPNs).

Incident response

Incident response has two elements. The first step is to monitor the business to prevent attacks, and the second step is to contain the disruption to minimize the impact should a data breach occur and manage its effects. Companies should communicate formal and robust incident response plans (IRPs) with clear processes and policies to the entire organization so that everyone takes responsibility for InfoSec.

Effective policies should be amended regularly, especially when there are changes within the company, breaches have occurred or when security systems and tools are updated.

Disaster recovery

Disaster recovery is the method a company uses to reestablish systems due to failures from cyberattacks or natural disasters. Disaster recovery is different from incident response. Disaster response is about restoring systems as quickly as possible after an incident, while incident response aims to detect, contain and manage incidents to minimize their impact.

Vulnerability management

With so many threats and new ones continuously appearing, it’s vital to scan for weak points so that fixing them can be prioritized. With the ease of adding new apps, updating infrastructures and building tech stacks, ensuring they all meet your minimum security standards is essential.

Vulnerability management is how an organization identifies, assesses and fixes vulnerabilities across endpoints, software and systems.

What are the different types of information security threats?

There are many categories of information security threats, so we’ve highlighted some of the key threats to be aware of:

Unsecure or poorly secured systems

If you have unsecure or poorly secured systems, they are more susceptible to unauthorized access, data breaches and other cyberattacks. These could be due to old or not-updated software, weak passwords, limited encryption protocols, inadequate antivirus software or outdated security systems.  

Cyberattacks

Cyberattacks try to compromise an organization’s data in different ways. This could be through advanced persistent threats (APTs), botnets, distributed denial-of-service (DDoS) attacks, drive-by download attacks, exploit kits, man-in-the-middle (MitM) attacks, phishing attacks, ransomware, or viruses and worms.

Social media attacks

Social media is how many people communicate, leading to unintentional sharing of information about themselves. Attackers can use this information to create duplicate accounts or access private information. Attackers spread malware via social media messages or indirectly by using information obtained from social media sites to analyze user and organizational vulnerabilities and use them to design an attack.

Social engineering

Social engineering involves gaining a victim’s trust. Then, it tricks them into doing things that might compromise their security or personal information by sending emails and messages that use psychological triggers like curiosity, urgency or fear.

They could install malware on their device by clicking a link or providing personal information, credentials or financial details.  

Malware on endpoints

There was a time when the only device we had would have been a desktop PC, but now we work with various connected devices, including desktop PCs, laptops, tablets, and mobile phones. Some employees might also connect their personal devices to the organization’s internet.

These devices, or endpoints, are all at risk of malware, which can compromise the device and escalate to other organizational systems.

Security misconfiguration

When installing technological platforms and tools, including web applications, databases, Software as a Service (SaaS) applications or Infrastructure as a Service (IaaS) applications, the organization needs robust security features correctly configured. Misconfigured security due to negligence or human error can result in a security breach. Configuration must also be reviewed regularly to reduce the risk of ‘configuration drift’, where configuration becomes outdated and makes the system vulnerable.

Human error

Unfortunately, humans are not infallible and will make mistakes. It’s easy to lose company or personal devices that might contain sensitive information, click on a link that looks like it’s from a legitimate source or use weak and obvious passwords.

While these are usually unintentional compromises, organizations must be aware of malicious employees or partners who deliberately compromise information and open it up to cyberattacks.

Information security controls

With so many security threats, managing them and having the proper security measures to prevent or reduce the impact of attacks can be overwhelming. Avoiding complacency is a good starting point.

Complacency can occur by not changing any systems, not reviewing or updating them or believing that the responsibility lies with someone else rather than everyone in the organization.

It’s also essential to stay on top of technological developments to continually improve so your systems don’t become out-of-date and vulnerable and you’re aware of the latest threats. Ensure your IT or infosec teams can manage the systems you implement and that they meet global regulations if you have teams, partners, or suppliers in multiple countries.

Other solutions to enhance InfoSec include endpoint detection and response (EDR) solutions, data loss prevention (DLP), firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), security information and event management systems (SIEM), security operations centers (SOC), strong authentication measures like two-factor authentication (2FA) and multifactor authentication (MFA), and user and entity behavior analytics (UEBA).