Information security management

Information security management has become an increasingly important part of modern organizations as it helps secure large databases often found within large organizations. These databases often store sensitive information, such as personal identifiers and financial records. A breach in these databases can ruin a company's reputation or put millions of people's information at risk. For this reason, information security management is often discussed alongside cybersecurity practices, many of which are directly correlated or directly used in Information Security Management Systems (ISMS).

Risk management and mitigation

Managing information security in essence means managing and mitigating the various threats and vulnerabilities to assets, while at the same time balancing the management effort expended on potential threats and vulnerabilities by gauging the probability of them actually occurring. These ideas can be summarized into the Protection Motivation Theory, or PMT. The PMT "seeks to explain why individuals adopt or engage in protective behavior." There are two main mechanisms of the PMT: threat appraisals and coping appraisals. Threat appraisals refer to how people perceive the severity of a threat and their vulnerability to a threat. A meteorite crashing into a server room is certainly a threat, for example, but an information security officer will likely put little effort into preparing for such a threat. Just as people don't have to start preparing for the end of the world just because of the existence of a global seed bank.

The second half of the PMT is coping appraisals. This refers to self-efficacy and response efficacy. Self-efficacy is someone's perceived confidence in their ability to complete a task. Response efficacy refers to someone's belief in a protective action's effectiveness. Coping appraisals also include response costs, or any possible expenditures potentially required of someone to follow through with a protective action, such as money, time, or effort. In order for the PMT to be successful, a person must have a strong sense of self-efficacy and response efficacy with the task at hand, along with a low perception of reward costs (which can also be influenced by self-efficacy).

After appropriate asset identification and valuation have occurred, risk management and mitigation of risks to those assets involves the analysis of the following issues:

• Threats: Unwanted events that could cause the deliberate or accidental loss, damage, or misuse of information assets.
• Vulnerabilities: How susceptible information assets and associated controls are to exploitation by one or more threats. This can also be referred to as threat appraisals in the PMT.
• Impact and likelihood: The magnitude of potential damage to information assets from threats and vulnerabilities and how serious of a risk they pose to the assets; cost–benefit analysis may also be part of the impact assessment or separate from it.
• Mitigation: The proposed method(s) for minimizing the impact and likelihood of potential threats and vulnerabilities. This is directly linked to coping appraisal strength when it comes to implementing each method.

Once a threat and/or vulnerability has been identified and assessed as having a high threat appraisal on information assets, a mitigation plan can be enacted. The mitigation method is chosen largely depends on which of the seven information technology (IT) domains the threat and/or vulnerability resides in. The threat of user apathy toward security policies (the user domain) will require a much different mitigation plan than the one used to limit the threat of unauthorized probing and scanning of a network (the LAN-to-WAN domain).

Some of the most common reasons organizations may struggle implementing risk management protocol are:

• Social engineering tactics tricking workers into giving out personal information, especially if they lack important online safety tools
• A lack of understanding in personal role or responsibility in information security management, or a complete disregard for it
• A lack of education in information security management

In order for a mitigation strategy to be effective, both the technological and user side of the strategy must be functioning with minimal errors.

Information security management system

An information security management system (ISMS) represents the collation of all the interrelated/interacting information security elements of an organization so as to ensure policies, procedures, and objectives can be created, implemented, communicated, and evaluated to better guarantee the organization's overall information security. This combines technological and human collaboration to be successful. This system is typically influenced by an organization's needs, objectives, security requirements, size, and processes. An ISMS includes and lends to risk management and mitigation strategies, and often addresses many if not all of the factors discussed in the PMT. Additionally, an organization's adoption of an ISMS indicates that it is systematically identifying, assessing, and managing information security risks and "will be capable of successfully addressing information confidentiality, integrity, and availability requirements." However, the human factors associated with ISMS development, implementation, and practice (the user domain) must also be considered to best ensure the ISMS' ultimate success.

Failures in ISMS can often be traced back to poor risk management or evaluation, a lack of depth in understanding, or misaligned goals with leadership. This is why some companies choose to hire and/or implement a Chief Information Security Officer (CISO). The CISO is often responsible for guiding policy, aligning security with business goals, handling risk and compliance, and communicating between management and technical terms. The main purpose of implementing a CISO is to streamline security integration and provide a source of leadership to help guide the organization's information security management.

Common Aspects of Cybersecurity Applied in ISMS

As society transitions to becoming more digitally interconnected, cybersecurity practices have become a focus of scholars and business leaders alike. Although technology can be attacked, cybercrime has been shown to be more effective when it targets humans, with a strong focus on social engineering. These tactics can include:

• Phishing - deceiving someone into providing personal information through email, text, or phone call to a fraudulent source
• Brand Theft - used to make employees of a certain company believe they are on a trusted company website or email by creating similar URLs with minor typos, most of which go unnoticed
• Impersonation - adopting someone else's identity to deceive another person into giving them sensitive information. In some cases, this can also be classified as identity theft depending on the depth of the impersonation.
• Scareware - urgent and often frightening pop-ups that appear on a user's computer, typically asking for immediate action. Used to make the user believe there will be negative consequences if they do not act immediately.

It is important for all aspects of cybersecurity to be addressed when implementing an ISMS. The main reason these tactics are successful on humans is due to people's lack of awareness. This is where employee training and education become major factors in successfully implementing an ISMS.