First of all, we need to understand a commonly misinterpreted phenomenon, though simple yet very complex for beginners to grasp; commonly using Information and Cyber Security as synonyms of each other as both are associated with the security of information and computer systems. While the definition and understanding of both the terms differs a lot and should not be interchanged. In nutshell, Cyber Security deals with the defending of digital data in cyberspace, whereas, Information Security means protecting the data in cyberspace and beyond (all kinds) in general including its physical security, therefore, we will frequently be using the two different terms separately as “Information Security” and “Cyber Security”.

Information and Cyber Security is rapidly shaping itself into a fast-growing industry being among the most in-demand skill sets but with a huge skills gap. This field broadly addresses following three principles; commonly known as CIA Triad: -

1. Risk Assessment and Treatment

Risk assessment and Treatment is a process of identifying, prioritizing and managing the security risk for the organization. Risks can be treated with different ways like applying controls, transfer risk, avoid risk and accepting the risk which cannot be avoided, reduced, transferred.

2. Incident Management

Incident is a violation, or threat of a violation which can cause potential damage to confidentiality, integrity and availability of an information system or the data being processed, stored or transmitted. Incident Management is a process to ensure CIA triad through identifying incidents, protecting assets, responding and if require, restoring services.

3. Application Security

The software applications are the critical digital assets which need to be protected against attacks. Application security consists of measures taken to improve the security posture of an application by finding, fixing and preventing security vulnerabilities.

4. Information Security Management System (ISMS)

ISMS is a framework which ensures confidentiality, integrity and availability of organizational assets (people, electronics, software and privacy etc.) from threats and vulnerabilities. This is ensured using a systematic risk approach to establish, implement, monitor, review, maintain and improve the information security at organizational level.

5. Data Privacy

Data can be anything like personal health information, personal identifiable information, financial data etc. Data Privacy pertains to respecting the choice of individuals related to sharing their own information. It is very important to exercise extreme care while collecting, accessing, storing, processing or sharing such information. Major challenge is maintaining the data privacy when data is in use and needs continuous reassessment and compliance assurance with data privacy and security regulations.

6. Business Continuity

Business Continuity is defined as the processes and procedures an organization puts in place to ensure that business critical functions can continue during and after a disaster (unpredictable events such as natural disasters, fires, disease outbreaks, cyber attacks, other external threats )and re-establish full functionality of the organization as quickly and smoothly as possible.