Cybersecurity is a must for all firms

Ensuring the security of people, devices, networks, and buildings is a must, and it should be done with the utmost attention and focus. Cybersecurity in my country Nigeria is still not top-notch when compared to other countries. However, the news and the importance of cybersecurity are spreading like wildfire in my country. Both individuals and corporation are investing time and resources to ensure that they are cybersecurity skilled. As the world keeps advancing technologically, Most people live their world on the internet i.e online, and that has, in a way, opened doors to new kinds of attacks resulting from the usage of the internet. This operational risk that comes with using the internet connected devices or having access to information that is secret

Source

The projected job for people in the cybersecurity field has been projected to increase by 25 percent as hackers continue to look for ways to exploit the vulnerabilities around the system. Also, as more people are on board and embrace the internet, the need to ensure that their data is secured and their privacy is ensured becomes the goal. Even a country's government and regulatory bodies continue to look for ways to ensure that organisations ensure the security of customers' data and their own internal systems, applications and networks.

In Nigeria, the government passed a policy through its Central bank that all Banks and financial institutions handling money or having a payment gateway or issuing cards or processing people's private information should ensure that they are certified in lost of standards such as Internation Standard Organisation (ISO) 27001, ISO 27017, ISO 22300, ISO 20000, PCI DISS, Nigeria Data Protection Regulation (NDPR) among others. Some of these standards are to ensure Information security. At the same time, some speak to enduring Data privacy, while some are for ensuring that the tools and systems a firm uses work optimally. Some focus on the ability of the firm to continue business in case of an attack or incident that will affect the firm's business operation.

Each standard focus on different aspects of a firm operation. However, they all work towards ensuring a firm's efficient and effective governance while managing the risk it is exposed to. With that said, the contribution of CEO top management is essential in ensuring that these standards are implemented will cost lots of resources and people to execute them. Also, the involvement of top management will ensure that all staff of such an organisation takes this process seriously, and they could be sanctioned for non-compliance. To ensure compliance to cybersecurity, cloud security, information security and Data protection, Firms implement ISO 27001 (Information, cybersecurity and data protection), ISO 27017 (Cloud computing security) and NDPR (NITDA ensures compliance for this) and also ensure that a compliance audit is conducted.

Source

ISO 27001 essentially focuses on information and Cybersecurity, which are centred around Access control, Identity management, Physical security, Network security, software/slash code development life cycle, People management, Incidence management, and ensuring the continuity of a business in an event that a data breach occurred. All these areas are touched on in the standard, like Backup, change management, capacity management, configuration management and compliance. We must pay close attention to these branches to ensure that data and information are not breached.

Going into details, Access control is how the Organisation gives people access to information and application while also restricting unauthorised personnel. Access control's key objective is ensuring the Confidentiality, integrity and availability of data created, used, processed and stored in an organisation. Access control spreads even to access firm premises or a place where highly classified information is processed; an example is the Data centre. The concepts of access control could be role-based access control (RBAC) or least privilege (i.e. giving staff access to information needed to carry out their day-to-day activities, nothing more or nothing less). The access control mechanism includes groups, MFA, access cards and biometrics.

Identity Management and access control kind of work hand in hand. A firm must have an identity-trust-framework. Identity management helps authenticate the person who he or she says he or she is, while access control is used for authorization, i.e., what the said person can do or have access to on the system. Identity management is key in the Organisation, and the best tool used for this is the Active Directory which aids centralization. The best way to manage all identities in a firm is to do it from a central location. That’s why it is properly managed and will avoid creating two accounts for one person. Various Organisation manages the identity through user Id and email address.

Source

Physical security ensures the firm’s assets and the people are secure. It is to ensure the safety of life and property in short. Very sensitive places such as data centres, meeting rooms, workstations, printers, delivery areas, secure working areas and offices are meant to be protected. Also, ensuring that tools like generators, chairs, Air conditioners, UPS, cabinets, smoke detectors, sprinklers, fire extinguishers, fence wires, CCTV, and security guards are in place to ensure Confidentiality, Integrity and Availability of information while also security of the physical parameter where the people use and process this information. Asset management and maintenance are also attached to ensuring physical security.

Network security is key in any Organisation, as cybersecurity extensively discusses it. To ensure security over a Network , the need for information encryption in transit, in use or stored arises. Also, the need to use intrusion detection systems, intrusion prevention systems and Anti-virus becomes necessary to keep intruders out. Firms must block all unused ports so bad actors will not enter the firm network through that venue. Firewalls and security groups are important to avoid and fight DDOS attack. The need for monitoring and logging activities is also key on the network hence the importance of SIEM. This SIEM can also be used to track issues and sets alerts to people who are supposed to fix these issues or events over a network. The likes of file integrity management come into place as it helps track changes over the network for files and data.

People management instils cybersecurity and information security culture and habits in people who handle and process data. People management is divided into internal and external people. The internal people are the organisation's staff and management. Enrolling staff on information and cybersecurity training is best practice, ensuring cybersecurity awareness is done occasionally. Firms having documented information security policies, procedures and manuals and ensuring the communication and distribution of this policy is essential. For the external people, we have government and third-party suppliers. We must ensure that we adhere to government policy and keep their contact. For third-party suppliers, we need to conduct due diligence on them. Ensure that we have a signed SLA, and NDA with them while also ensuring a performance evaluation. It is important to have a third-party information security policy to which the third party must also have access. This third-party information security should help an organisation govern their affairs with all third parties processing the firm information.

Incident management and business continuity operate on the same line. Incidence focuses on ensuring that an incident is treated and corrected, while Business continuity ensures that this incident does not affect the firm's business operation. There is a need to create incidence management procedures and processes and appoint an incidence manager. There is also a need to get the right tools and technology. For business continuity, they are a need for the creation of a business continuity plan and also testing these plans out. The need for the creation of a business continuity team could be essential to ensuring that disasters and crises are managed efficiently. Creating an extensive plan covering various things like fire, flood, breaches, Riot, network down, virus attack, ransomware, etc. is great.

For the software/slash code development life cycle, you must ensure that codes and software developed in the organisation is securely done. Doing this ensures that hackers cannot hack and steal your codes. Developers must ensure that their codes are secure and tested before being transferred to the live environment. Some firms do some audit checks to ensure that all security measures and all vulnerabilities are being done.