As technology advances at a rapid rate, information has become a hot commodity. Information is how businesses determine how to get you to buy their products, how to market their products, how to get you to subscribe to their way of thinking. Information is traded for other information, which is how apps on your phone work together even when they aren’t made by the same company. And while information is now being used for commerce, it is not protected or secured like money or intelligence. Information is just there, ripe for the taking, if someone knows how to get it.
Enter Information Security, a sector of the tech world that is underutilized and misunderstood. Info sec isn’t a dark art, it isn’t voodoo and it isn’t magic. Info sec is how information is protected, or at least supposed to be. The problem is the culture around it is lagging so far behind that it is an afterthought for most businesses. It’s not viewed as a priority until a problem arises.
There’s a lack of education around what info sec is, why it’s important and how to do business while protecting the information that’s being used. Businesses tend to focus more on numbers, making sure key growth metrics are met and accounting is done properly. Numbers are viewed as more important than protecting the information that is used to run the business. The reality is that information should be treated as if it is money, because the ramifications of not protecting it are just as dire as what could happen if your company fails a tax audit or misses a sales target.
Info sec isn’t just about protecting your customer’s information, it’s about protecting your company’s proprietary information and reputation. You don’t want a hacker attacking your firewalls and gaining access to your patent-protected formulas or designs, just like you don’t want someone breaching your firewalls and gaining access to your customers credit card information to sell on the dark web. If someone can gain access to one part of your system, they can get to the rest from there. Any internal emails lying around that you wouldn’t want made public?
It’s not just about pen testing or creating and completing tickets. It’s about making sure there’s a lock on the front door. And when you fix a vulnerability that was found, ensuring that you’re not opening a window when you lock the door. For example, an issue is raised with users remaining logged in when they should be logged out. That problem is solved with a quick code patch, but the next time users log in, they are logged in as an admin. Whoops! Now you have fixed one problem but created another. You locked the door but opened a window.
Information security isn’t an ambiguous, magical thing. It’s a very real necessity that should be implemented from the birth of a business. Businesses which have been around longer than the internet have to make adjustments. Securing a business’ information has its cost, but the up-front cost will be far less than the cost of a breach. Consider it risk management. Being prepared is being protected.