"Information security management (ISM) defines and manages controls that an organization needs to implement to ensure that it is sensibly protecting the confidentiality, availability, and integrity of assets from threats and vulnerabilities."
Processes, practices, and policies to secure sensitive information.
Risk Management: The practice of identifying, assessing, and prioritizing potential security threats and vulnerabilities that could negatively impact a business or organization.
Security Governance: The process by which organizations establish strategies, policies, and procedures to ensure the confidentiality, availability, and integrity of their information assets.
Compliance and Regulation: Understanding the laws, regulations, and standards that apply to the protection of sensitive information, and ensuring that an organization is in compliance with these.
Auditing and Monitoring: The regular inspection of an organization’s network activity to identify any security breaches, data loss, or malicious incidents.
Incident Response: The processes and procedures for responding to security incidents, including incident investigation, containment, eradication, and recovery.
Access Control: The methods used to grant, limit, and revoke access to an organization’s critical resources based on a user's identity and level of trust.
Cryptography: The practice of encoding and decoding information to ensure that it remains secure and confidential.
Physical Security: The protection of facilities, equipment, and personnel from unauthorized access, natural disasters, and other threats.
Disaster Recovery: Planning and executing procedures for restoring critical systems and services in the event of a catastrophic failure or disaster.
Password Management: The process of securely storing and protecting passwords used by employees and other users within the organization.
Network and Infrastructure Security: Measures taken to protect an organization’s network infrastructure from external threats like malware, phishing, and hacking.
Social Engineering: The use of psychological tricks and tactics to gain unauthorized access to sensitive information or systems, usually by manipulating users or employees.
Cyber Threat Intelligence: The collection, analysis, and interpretation of intelligence about cyber threats, including malware, cyber espionage, and advanced persistent threats.
Ethical Hacking and Penetration Testing: Identifying the weaknesses and vulnerabilities within an organization’s network or systems through active testing, in order to improve security posture.
Security Training and Awareness: Ongoing training to educate employees and users about security best practices and policies, and to ensure that they are aware of potential threats and risks.
Access Control Management: This is the process of ensuring that only authorized individuals have access to specific areas or information. It involves authentication, authorization, and accountability measures to manage employee and customer access to a company’s data storage, network systems, and physical locations.
Application Security Management: This includes the measures used to protect software and applications used by an organization from unauthorized access, alteration, or destruction. It involves identifying and mitigating security vulnerabilities like SQL injection or cross-site scripting to prevent data breaches or leaks.
Business Continuity Management: This type of cybersecurity management prepares organizations for disaster recovery, business continuity, and emergency management by ensuring the uninterrupted operation of systems, data centers, platforms, and applications in the face of threats.
Cloud Security Management: Cloud data storage and access are vulnerable to cyber threats. Cloud Security Management incorporates cloud security practices into an organization's overall cyber hygiene and includes cloud security assessments and encrypting data transmitted between systems.
Identity and Access Management: This is a security practice that focuses on who can access an organization’s digital assets and by what means. It includes administering user accounts, creating advanced workflows, and using multi-factor authentication in combination with employee access controls.
Incident Response Management: This aims to mitigate the impact of cybersecurity incidents with a coordinated incident response team to investigate and solve potential cyber threats. It also involves preparing company security plans that contain responses to security threats and incidents.
Network Security Management: This focuses on the protection of an organization’s systems and infrastructures from network-based cyber threats such as malware, phishing, and network intrusion. It includes firewalls, intrusion detection systems, safe and encrypted data transmission, and other safeguards.
Physical Security Management: This covers the protection of the physical assets of the organization, including buildings, data centers, electronic devices, and other hardware. Physical Security Management systems often involve locking down equipment physically, as well as using access control, surveillance, and biometric systems.
Security Governance Management: This combines risk assessment, assessing and improving compliance, and cybersecurity metrics and reporting. The Security Governance Management team ensures that cybersecurity falls in line with the organization's broader company vision, mission, and goals.
Vulnerability Management: This examines and protects against different sources that could provide a weakness, vulnerability or way into an organization's digital or physical assets. It includes patch management, intrusion detection, vulnerability scanning and penetration testing.
"The core of ISM includes information risk management."
"Information risk management is a process that involves the assessment of the risks an organization must deal with in the management and protection of assets, as well as the dissemination of the risks to all appropriate stakeholders."
"This requires proper asset identification and valuation steps, including evaluating the value of confidentiality, integrity, availability, and replacement of assets."
"An organization may implement an information security management system and other best practices found in the ISO/IEC 27001, ISO/IEC 27002, and ISO/IEC 27035 standards on information security."
"...an organization needs to implement...to ensure that it is sensibly protecting the confidentiality, availability, and integrity of assets from threats and vulnerabilities."
"...the dissemination of the risks to all appropriate stakeholders."
"evaluating the value of confidentiality, integrity, availability, and replacement of assets."
"ISM defines and manages controls that an organization needs to implement..."
"...other best practices found in the ISO/IEC 27001, ISO/IEC 27002, and ISO/IEC 27035 standards on information security."
"...protecting the confidentiality, availability, and integrity of assets."
"...protecting the confidentiality, availability, and integrity of assets from threats and vulnerabilities."
"...protecting the confidentiality, availability, and integrity of assets from threats and vulnerabilities."
"...the assessment of the risks an organization must deal with in the management and protection of assets."
"This requires proper asset identification and valuation steps..."
"The core of ISM includes information risk management..."
"...the dissemination of the risks to all appropriate stakeholders."
"...to ensure that it is sensibly protecting the confidentiality, availability, and integrity of assets."
"An organization may implement an information security management system..."
"...to ensure that it is sensibly protecting the confidentiality, availability, and integrity of assets."