Information Security 

What is Information Security?

Information security is about keeping data and information safe. It protects information from being accessed, used, changed, or destroyed without permission. Think of it as putting a lock on your digital and physical files to keep them private and correct.

Examples

• Protecting your password: When you create a strong password and don’t share it, you’re practicing information security. This prevents others from getting into your accounts.
• Shredding old documents: Tearing up or shredding papers with personal info, like bank statements, stops people from stealing your identity.
• Using antivirus software: Antivirus programs on your computer help keep viruses away. This is a form of information security that protects your data from being harmed.

Context

In a world full of computers and the internet, keeping information safe is super important. Businesses and people alike need to protect their personal details, financial records, and other private data. This is why things like secure websites (the ones with “https://” at the start), firewalls, and encryption exist. They are all tools used for information security.

How to implement Information Security 

Implementing a robust information security framework is a mandatory requirement for achieving ISO 27001 certification, ensuring the confidentiality, integrity, and availability of your organisation’s data. As a Lead Auditor, I look for technical evidence that security is not just a policy, but a living ecosystem of overlapping controls. Following this 10-step technical roadmap results in a hardened security posture that satisfies rigorous audit requirements and protects against modern cyber threats.

1. Provision a Comprehensive Information Asset Register

• Provision an exhaustive inventory of all hardware, software, and data assets: Identify 100 per cent of your digital and physical footprint, resulting in a defined technical boundary for control application.

2. Formalise the Information Security Management System (ISMS) Scope

• Formalise the physical, organisational, and technical boundaries of your ISMS: Document internal and external issues, resulting in a precise scope that dictates where security resources are allocated.

3. Document Technical Rules of Engagement (ROE)

• Document the Rules of Engagement for all system administrators and users: Establish granular protocols for system access and data handling, resulting in authorised technical conduct across the environment.

4. Provision Granular Identity and Access Management (IAM) Roles

• Provision RBAC and IAM roles based on the principle of least privilege: Map permissions directly to job functions, resulting in the technical prevention of lateral movement during a security event.

5. Enforce Multi-Factor Authentication (MFA) Standards

• Enforce MFA for 100 per cent of remote and administrative access points: Mandate strong authentication at every system boundary, resulting in a primary technical barrier against credential theft.

6. Formalise a Risk Assessment and Treatment Methodology

• Formalise a tiered risk assessment process to identify threats to data: Evaluate the impact on the CIA triad, resulting in a prioritised Risk Treatment Plan (RTP) that addresses high-priority vulnerabilities.

7. Audit Cryptographic Controls and Encryption Standards

• Audit the implementation of AES-256 encryption for data at rest and in transit: Verify the integrity of key management processes, resulting in the technical protection of sensitive information if perimeter defences fail.

8. Provision Network Segmentation and Firewall Configurations

• Provision VLANs and next-generation firewalls to separate production data: Isolate critical systems from general office traffic, resulting in a technical layer that contains potential malware infections.

9. Revoke Legacy Permissions and Sunset Redundant Access

• Revoke legacy access rights and securely sunset end-of-life accounts: Execute regular access reviews, resulting in a reduced attack surface and maintained integrity of the identity lifecycle.

10. Audit Information Security Effectiveness via Internal Testing

• Audit the entire security framework through vulnerability scans and independent tests: Execute regular internal assessments, resulting in a documented corrective action plan that ensures continuous improvement.

Information Security FAQ

Relevant ISO 27001 Controls

The ISO 27001 standard is a set of rules for managing information security.

• ISO27001:2022 Reference Guide
• ISO 27001:2022 Annex A Controls Reference Guide

Related ISO 27001 Control	Relationship Description
Glossary: CIA Triad	Core Definition: Information security is defined by the preservation of Confidentiality, Integrity, and Availability—the three pillars of the CIA Triad.
Glossary: ISMS	Management Framework: The Information Security Management System (ISMS) is the systematic approach and set of policies used to manage an organization’s Information Security.
ISO 27001 Clause Guides	Main Standard Requirements: These guides outline the mandatory requirements for establishing, implementing, and maintaining an Information Security framework within an organization.
ISO 27001 Annex A Controls	Operational Safeguards: Provides a comprehensive list of specific security controls (technical, organizational, legal, and physical) used to achieve Information Security.
Glossary: Confidentiality	Pillar of Security: A key aspect of Information Security that ensures data is only accessible to those with authorized permission.
Glossary: Integrity	Pillar of Security: A key aspect of Information Security focused on maintaining the accuracy and completeness of data and preventing unauthorized changes.
Glossary: Availability	Pillar of Security: A key aspect of Information Security that ensures systems and data are accessible and usable when needed by authorized users.
Glossary: Breach	Security Failure: An event where Information Security is compromised, leading to unauthorized access, disclosure, or destruction of data.
ISO 27001 Glossary of Terms (Main Index)	Parent Directory: The central index where “Information Security” serves as the overarching topic for all other listed terms.