So in the going down to the actual each one by depth at the moment so in terms
of what we call a security governance face of it so we have a couple of phases
in which we implement an eye SMS we've broken it down to content security have
actually broken it down to three major phases so the first one being security
governance the second one is about risk management and the third one is about
control implementation so the three phases are actually taking through an
organization to all the ten steps that you saw from the slides before so in the
context establishment part of security governance the business aspects of the
organization is really important because we need to understand what the business
goals are so ultimately what we need to do is to understand if the objective of
the organization what is the core businesses why why are they doing what
they're doing so that when we look at information security information
security it's similar with IT we are supposed to be enablers for the
organization so understanding where the organization is going what is the
objective of the organization that will give us an idea of what your information
security objective is so what is an information security objective so often
for an organization information security objective could be brand reputation
damage another information security objective could be a lack of security
implementation in the organization so there are a number of information
security objectives that you could define right up front and all this
information security objective ultimately meets the business goals of
the organization the other thing that we saw them for we always forget is that we
always talk about losses when we talk about when we think
about what our information security objectives are we often think of them in
risk and we always interpret risk as losses to the organization but what we
always forget as well risk has the other element of it where we need to look at
it from an opportunistic perspective so what's the what's the opportunity that
you can get a positive outcome from actually implementing information
security so often that opportunity comes in that if you have an I SMS in place or
if you certify yourself against an ISO 27001 you'll find that you will suddenly
cut upon your organization to a higher level than most of your competitors it
puts you at a competitive edge because at this day and age where information is
really very important and if you are not protected then in from a business
perspective you will find that people will tend to start questioning whether I
should do business with you because a lot of personal information and
sensitive information I actually collected when you are doing business so
when you have an information security system in place then it puts you at a
better competitive advantage than most of your competitors and the other thing
about opportunities is that often when you come to it
implementing controls to manage risk you'll find that part of that process
includes redefining processes or maybe looking at upscaling of people so as a
result of which you will find that the effectiveness of the operations would be
improved
the concerns that we have here this are the information security objectives that
I have mentioned before so some of these are just examples but in in our dealings
with a lot of our clients we find that this are very commonly the main issues
that people face with and obviously information breach is one of them
especially now when the Privacy Commissioner has updated the Privacy Act
to include the new mandatory notification of an information breach so
at the top of every every organizations mind at the moment is that it's not
about if I get rich but when I get breach how do I actually one of the
steps that I actually need to think now bearing in mind that often when we talk
about implementing an information security platform or a framework it is
often about reasonable steps that you undertake to protect your information
it's not absolute because obviously there is no such thing as an absolute
information security but it is about having reasonable measures or reasonable
steps undertaken to protect those information and hence that's why if you
were to have an IMS in place this would provide you with that so called
reasonable measures to protect your information why is it important again to
talk about interested parties the the information that you receive it's
obviously in the past we've always talked about what is the value of
information to the organization but if you will have notice of late with all
the breaches that's been going on around the world often now it is no longer
about what is the value of information to the organization but now it is about
what is the value of information to the person who has an interest in it so it
is always good to start looking at who are the people that are connected to
your organization who are these people that would have an interest in
in my information in the organization's information so it is only by by looking
at the whole range of interested parties are we able to start looking at risk
from a holistic view rather than just that hoc just just keep going
so basically this next slide is a combination of all that we've just
talked about in all the last previous slice so if you look at the first left
side of of this of the slide it's all talking about the the governance as to
how do you set up with governance in many organizations there's a part that
the sister-in committee now many organizations may not have the ability
to have a steering committee but it doesn't also stop an organization to
have at least the forum or a group of people that that brings together the
minds of business and brings it to mind the people of a technical perspective to
talk about what is the risk to the organization to look at if there is that
risk how are we going to manage the risk how are we measuring our risk and we're
ready we still sit what is our maturity posture so in setting up that and then
to the right hand side of the screen you will see that these are the people where
the roles and responsibilities these are the people that are really important in
the setup of the organization so in the roles that you have from those who are
actually having an oversight of security which is on the left side of the screen
to the people who are then responsible for managing for enacting the security
for the organization's so the information security manager will
provide the view of the requirements of security for the organization and
through leadership the thought from leadership will have the tone from the
top of the expectations of information security which is then coming through
the eyes and eye information security manager then establishes that these are
the things that we need to do to meet the expectations of management and then
the process owners are the people who will then be responsible for the risk
that comes through the organization so what does that mean so process owner has
the responsibility to make sure that the measures that they
are putting in place are able to actually mitigate that risk of any
threat to the organization's but where those threats are not mitigated then it
is also the process owners responsibility to make sure that there
are alternate or mitigating controls that could actually manage those risk
and obviously we can't forget about every employee in the organization it is
a responsibility of every employee of the organization to be aware and also to
know what action to take in the event that there is an information security
breach