Information Security in the corporation

In this material we will tell you how information security is ensured in the corporation in the digital age.

Let ‘s consider the basic definitions.

Corporation — is the totality of persons or companies authorised to act as a single entity and legally recognised as such for a purpose of achieving common purposes. It is based on shared ownership and separation of functions of owner and manager. As a rule, corporations have a complex structure and may have a large number of branches or entire groups of subsidiaries.

Corporate information security is the protection of data in the corporation from unauthorised access, use, disclosure, sabotage, alteration or destruction. Covers methods, tools and operations, which organisations put in the place to protect their own information assets

Why is it necessary to ensure information security in the corporation?

In a broad sense, corporate security is measures taken inside the corporation to protect physical, financial, intellectual and other assets from internal and external threats. Such threats may relate to embezzlement, fraud, cyberattacks, insider trading, confidential data leaks, natural disasters, terrorist attacks, and others.

Unfortunately, there are many situations that can lead to internal and external threats being realised, and it is for this reason that protecting corporate information should be a top priority for organisations of all sizes.

The realisation of some threats in especially large production facilities, as well in critical information infrastructure (CII) objects, can lead to catastrophic consequences: harm to the health and lives of citizens, damage to environment, etc.

Next, we'll consider the reasons to deploy an effective Information Security system inside the corporation.

Protection of physical and intellectual assets

Typically, a corporate Information Security system is designed to protect physical and intellectual assets, including equipment, facilities, trade secrets, patents, copyrights and trademarks. By implementing robust security measures, enterprises may be able to minimise risks of theft, industrial espionage and unauthorised use of intellectual property. Such protection significantly reduces risks of realisation of Information Security threats. This helps to maintain a competitive advantage and a stable position in the market.

Prevention of personal data leaks

Without effective security measures, leaks can easily happen and go undetected.

At the same time, cybercriminals are becoming increasingly successful and skilled at stealing personal data (hereinafter referred to as "PD"), bypassing networks with weak security systems. According to some commercial sources, the number of data breaches is expected to increase by 7.76% in 2024, despite a serious tightening of legislation on PD. 

If personal data processed by the corporation becomes available to third parties, it may be result of financial and reputational damage, as well as potential litigation and fines from regulators. 

Protection of sensitive data

In an era, where data is a precious resource, maintaining confidentiality of sensitive information is of paramount importance. Information Security measures can prevent unauthorised access to corporate data, customer information and financial records. 

In addition, customers and clients trust companies to protect their data — and any breach of that trust may lead to damaged reputations, loss of market position and legal consequences. Implementing robust Information Security measures helps maintain trust and protect sensitive information for the corporation, its customers and other stakeholders.

Reduction of financial losses

Corporate security helps companies mitigate financial losses, which may arise from the realisation of various Information Security risks. For example, effective physical security measures can deter intruders and, of course, reduce the likelihood of theft, damage and destruction of products, equipment or inventory. Similarly, reliable methods of cyber security minimise the risks of data exfiltration, which may lead to significant monetary losses, legal costs and erosion of customer confidence. Thus, investing in corporate security can save companies significant amounts of money in the long run.

Ensuring continuity of processes

Unforeseen events, such as natural disasters, cyber-attacks or outages, can disrupt business operations or halt production. Implementing business continuity plans as part of corporate security ensures that companies can effectively respond to any incidents, minimise downtime and resume full operations as soon as possible. By maintaining process continuity, companies may protect their revenue stream, maintain customer satisfaction and avoid potential financial and reputational damage.

Information security threats in corporations

Popular models of IS-threats propose to categorise them as follows.

External threats

They come from the outside: from fraudsters, cybercriminal groups, viruses, robots. A common example of an external threat is a DDoS attack. This is a virtual attack on a company's information resources, which prevents their availability and slows down or completely stops the operation of resources or the entire Information System (hereinafter referred — IS).

According to principle of action, a DDoS attack looks as if thousands of users are trying to access an information resource at the same time. The server, on which resource is located, does not have time to process such a large number of requests — and is switched off. However, requests are not made by real people, but by robots. Cybercriminal groups can attack servers as well as communication channels, which are used inside an organisation's security loop.

The goals of DDoS attacks may vary depending on attackers' objectives: competitors launch them to disable Internet resources; fraudsters launch them to blackmail corporate owners for ransom or just for fun.

Another type of threat is viruses. They infiltrate workstations, automated control systems, and then:

• spying, feeding data from corporate systems to interested parties;

• destroy, disable equipment;

• alter or destroy data;

• encrypt the information, and then the cybercriminals demand a ransom.

Internal threats

As a rule, these are threats related to activities of personnel inside the corporation. Such threats are divided into accidental and intentional.

Incidental threats. Typically associated with low awareness of information security and cyber hygiene among corporate employees. 

Among others, the following accidental Information Security threats are highlighted.

• Data entry errors. Employees may accidentally enter incorrect data, resulting in misleading information or system errors.

• Unintentional disclosure of information. Employees can inadvertently disclose confidential information to others, or accidentally or negligently publish it in the public domain.

• Failure to comply with corporate security policies. Employees may not follow security rules when handling data, for example, using unsafe transmission methods or leaving work devices freely accessible to unauthorised persons.

• Use of unsafe applications and devices, visiting unsafe websites, services. Employees can use untrusted applications or connect untested devices to work with corporate data, which may lead to data exfiltration.

• Violation of information access policies. Employees may violate information access policies by granting access to unauthorised users or using other people's accounts.

Deliberate threats

Employees may deliberately breach Information Security rules inside the corporation. The motives may be different: it often happens during conflicts between colleagues or during termination of employment relationships, when staff take a part of the client base with them or sell it to competitors. The similarity of such threats is one thing — initiators are aware of consequences of incidents.

Possible authors of such threats include competitors, disgruntled shareholders, executives and management, and employees disloyal to the corporation.

It is important to recognise that a deliberate threat may come from a trusted employee, who does not give the impression of being an insider or potential perpetrator. 

Among others, the following intentional threats to Information Security are recognised.

• Theft, damage or destruction of equipment — data storage devices, servers, etc.

• Misuse of corporate resources, abuse of authorities: irrational use of corporate resources (internet, printers, computers) — for personal purposes.

• Theft of confidential information and personal databases based on malicious intent or with the purpose of selling or transferring it to third parties.

• Unauthorised copying, alteration and destruction of information owned by the corporation. 

• Corruption, kickbacks from suppliers and contractors. 

• Industrial espionage.

Examples of corporate Information Security incidents

Below we will look at examples of Information Security incidents that the Anexet DLP system was able to detect and prevent. 

Information leakage when an employee is dismissed 

A specialist from a client company, where the Anexet DLP system was installed, decided to terminate his employment. Before leaving, he started downloading a customer database for further use in the new company. The system alerted a timely notification of the security officer about the operation (copying files to a flash drive) and thereby prevented the leakage of very sensitive information from the database.

Possible damage may amount to millions, and reputational risks are inestimable.

Irrational allocation of working time in the organisation

The Anexet system was deployed in the client company. Thus, based on observations made from monitor screens, it was found that managers spend 30% of their working time on performing irrational actions in the 1C programme. In this regard, it was decided to hold training courses on the programme. Employees were trained and were able to spend more time on sales, which contributed to a 15% increase in company's profits. Spent funds and time on training contributed to more efficient use of the 1C programme. The company's profit in 1 month is greater than the cost of implementing the system.

Absence of sufficiently effective mechanisms for timely identification of disloyal and extremist employees

With the help of an implemented DLP system among the employees of a major aviation manufacturing company was identified an extremist staff member during the recruitment phase of a proscribed terrorist organisation. The consequences for the enterprise could have been catastrophic.

Peculiarities of Information Security provision in corporations

Typically, corporations have a complex structure and have divisions spread across different branches and sometimes legal entities. This creates special security challenges, as many local networks need to be integrated into a single control loop.

It is important to realise that an IS inside the corporation  almost always will be complex and multi-tiered: with multiple computer networks, divisions, equipment and remote workstations.

Features of corporate IS in the context of Information Security:

• structural complexity of the IS, necessity for high-precision adjustment of its components;

• at least three levels of data exchange: between subdivisions and head office, between subdivisions, between structural units and end users of data (clients, employees, partners, counterparties, etc.);

• the large amount of data to be processed, resulting from communications between departments.

Corporations are required to deploy and maintain high levels of data security, including at their subsidiaries and affiliates. 

Principles of Information Security provision in corporations

These principles are formulated on the basis of the international standard ISO 27014:

• Information Security at the company level should be comprehensive, multi-layered and all-encompassing;

• every decision should be based on the corporation's information security policy;​

• the strategy for acquiring and investing in IS security should be consistent with business requirements, with the cost of organising the Information Security system not exceeding the value of the protected assets. 

• compliance with legal and regulatory requirements described in international standards. 

• promoting positive attitudes towards security measures among all stakeholders, the continuous educational process aimed at raising awareness of cyber security issues.

• the measures taken should not hinder the corporation's activities, interfere with processes, etc.

Key corporate security components

The key elements of a sound corporate security policy are listed below.

Implementing legal measures

As mentioned before, if Information Security measures are insufficient, the corporation may be fined. To avoid sanctions and fines from regulators, it is necessary to comply with requirements described in the regulations.

International standards are developed by organisations such as ISO (International Organization for Standardisation) and IEC (International Electrotechnical Commission). Here are some of them:

• ISO/IEC 27001:2022 "Information Technology. Methods of ensuring security. Information Security Management Systems. Requirements".

• ISO/IEC TR 19791:2018 "Information technology. Cloud Computing. Reference Architecture for Data Protection".

Based on the above, a security officer is obliged to be well-versed in the specifics of Information Security legislation. In this regard, it is often necessary to seek professional assistance.

Control of Information Security Incidents

Corporate security is directly correlated with incident management. These include, in particular, violations of the existing corporate security policy, loss (or theft) of equipment, unauthorised changes in operation of systems and services, leaks of sensitive information, and so on.

Unfortunately, today there are no methods and hardware equipment capable of providing 100% protection against the occurrence of Information Security incidents. However, their timely detection, response and elimination significantly minimise possible material, financial and reputational losses.

In addition to preserving the integrity, availability and confidentiality of corporation's information assets, a robust security policy that, among other things, describes proactive responses to various threats must be in place.

Personnel securitisation

Every business unit, department and individual employee should take Information Security issues seriously in the corporation.

Securitisation, or training staff in the basics of safe online behaviour, can significantly reduce risk of cyber incidents caused by employees.

Typically, this system of training involves:

• organising seminars, webinars, trainings, drafting manuals and handouts;

• regular mailings describing new or current Internet fraud schemes;

• conducting so-called cyber training, i.e. testing how well the corporation's employees are aware of cyber security issues, etc.

Co-operation between units

The overall level of Information Security in the corporation can be assessed by consistency of measures, which have been taken in the most poorly protected division or branch belonging to the IS.

That's why corporation-wide collaboration is critical to ensuring a solid security strategy.

Key Information Security assurance mechanisms

When developing and implementing an Information Security system inside the corporation, as a rule, organisational and software-technical measures are applied. The implemented mechanisms and principle of their operation should be described in detail in the corporation's security policy.

Among others, the following IS enforcement mechanisms are  identified.

1. Firewalls and antivirus software. This is your first line of defence against cyber threats. Firewalls track inbound and outbound traffic, blocking suspicious activity, while antivirus software detects and removes malware from your devices.

2. Data encryption. This involves converting your data into code to prevent unauthorised access. If even hackers manage to intercept encrypted data, they will not be able to read it without the decryption key.

3. Deployment of SIEM and DLP systems. SIEM-systems aggregate data on security events and make it possible to manage proactive measures to eliminate incidents and minimise damage from their implementation. DLP-systems allow controlling the activity of employees at their workstations and significantly reduce the probability of leakage of protected information through the fault of personnel.

4. Distinction and access control. Not everyone in the corporation needs access to all data at once. Implementing strict access control ensures that only authorised personnel can view or modify sensitive information. And the introduction of the zero trust principle will reduce the risks of unauthorised access to protected data.

5. Timely updates and patches. Cybercriminals are constantly exploiting vulnerabilities in outdated software. Regularly updating systems and applying patches helps close these security gaps.

6. Restriction of the software environment. Eliminating software, services and components not used by employees, managing temporary files, controlling the installation of programmes and services, etc.

7. And others.

Conclusion

Corporate security plays a critical role in protecting business's assets, reputation and competitiveness. By implementing comprehensive measures, corporations may reduce the likelihood of risks and threats, as well as mitigate potential consequences by securing physical assets, the confidentiality of sensitive information and the continuity of business operations. 

The importance of corporate security cannot be overemphasised, as it literally determines the profitability, reputation and reliability of the corporation in the eyes of customers, partners and other stakeholders. Therefore, investing in a reliable Information Security is not just a necessity — it is a strategic task for every corporation.