Office Information Security

Office Information Security is critical to the future of any business. Learn how important data protection measures are in workplace in this article.

Introduction

According to an article on Forbes Media LLC by Carmen Ene, Forbes Councils Member, dated 22 February 2023, global spending on cyber incidents and data breaches is only expected to increase, reaching an unprecedented $10.5 trillion as early as 2025. This money could be used to introduce innovations, optimise business processes and create conditions for sustainable development of companies, their employees and customers. Attackers are diversifying tactics, refining cyber attack schemes, and expanding cyber threat landscapes — no sector of the economy is left unscathed.

The following facts emphasise the disturbing nature of the situation.

• According to the 2023 Allianz survey, 45 per cent of experts ranked IS incidents as the most dangerous cause of business disruption, surpassing natural disasters or power problems.

• In recent years, large enterprises and corporations have been increasing their Information Security (IS) budgets, and unexpected consequence of this trend is surge of interest from cybercriminal groups towards smaller and medium-sized organisations that have far fewer resources to ensure data protection.

• Small businesses are particularly hard hit by information breaches. Up to 60% of small companies will close within 6 months of cyberattack, unable to cope with the financial and reputational damage.

• According to IBM research, human actions are the cause of most data breaches. Up to 95% of all incidents are caused by user error — clicking on phishing link, downloading malware, disclosing confidential information, and so on.  

• There is a global shortage of Information Security professionals.  According to Cybersecurity Ventures, the number of open cybersecurity jobs worldwide grew by 350% between 2013 and 2021. The high demand for skilled professionals provokes significant increase in the cost of their services. Ultimately, these circumstances will result in the inability of some companies to implement defences or respond effectively to IS incidents.

It is important to understand: the majority of all data of organisations and enterprises is concentrated in offices and administrative buildings, on workstations, servers, digital and paper media. To protect this data from unauthorised dissemination, alteration or destruction, it is necessary to ensure the Information Security of the office and the organisation's personnel.

Information Security in the office: what data needs to be protected?

A huge amount of data is processed in offices, including personal data of citizens, employee and customer information, financial and operational information, intellectual property, business strategies, operational, network and infrastructure data. This emphasises the critical need for robust security practices.

Therefore, the first step in ensuring IS in the company is to understand what data is at its disposal, what information can be publicly available, and what information needs to be protected. To do this, it is necessary to inventory and categorise information assets by confidentiality and criticality of loss.

Information that needs to be protected can be categorised as follows.

1. Confidential information to which access is restricted by law or internal rules of the organisation. This includes personal data of employees and customers, trade secrets, official secrets, etc. 

2. State secrets and information that may harm the security of the country and its citizens. Access to such information is strictly controlled by the state.

3. Professional secrecy, i.e. information that relates to professional activities and can be used for personal gain. For example, medical, lawyer, notary secrecy.

4. Intellectual property: copyrights in works of art, inventions, trademarks and other intellectual property.

5. Financial information: details of financial transactions, accounts, income and expenditure.

6. Security information: data on system vulnerabilities, security measures and other aspects related to information protection.

Security information: data on system vulnerabilities, security measures and other aspects related to information protection.

Why is it important to protect data?

Unauthorised access to information assets, strategic plans and other "sensitive" information can cause serious financial damage and loss of competitive advantage in the marketplace.

Moreover, today consequences of a data breach go beyond financial losses, affecting organisation's reputation, customer relationships and overall sustainability.

Organisations must be vigilant and constantly update their security measures to protect themselves from data breaches and fines from regulators.

Threats to Information Security in the office

Information Security threats are traditionally divided into internal and external threats.

External threats typically originate outside the office and can be related to actions of intruders, competitors or due to external factors.

Malware and ransomware continue to pose significant threat to Information Security. For example, between 2018 and 2023, 72.7% of all organisations fell victim to ransomware attacks.

DoS and DDoS attacks are powerful attacks on an office's information system to overload a company's servers, which can lead to breach of data integrity and availability.

Phishing and social engineering are another serious threat to data integrity and confidentiality. Cybercriminals have an endless arsenal of methods to infiltrate organisations' IS perimeter using phishing links, websites, applications, etc.

It is important to understand: a company may invest a huge amount of money in securing its IT infrastructure, but in the end, its information system will be only as secure as its employees are aware of cyber hygiene and safe online behaviour.

As attackers use increasingly sophisticated tactics to exploit vulnerabilities, IT needs to assess and manage potential risks. We address this issue below.

Theft or destruction of physical media and destruction of communication channels is another category of threats, especially relevant for so-called front offices.

Natural disasters, accidents, fires. Natural disasters can be dangerous not only to your employees — but also to workstations and other equipment. And while these unwanted events cannot be controlled or predicted, companies can prepare to minimise potential damage.

As mentioned above, almost 95 per cent of all IS breaches are caused by users. Actions that lead to breaches can be both intentional and unintentional. As a rule, internal threats to Information Security come from the company's personnel.

The following types of internal threats are distinguished. 

Violation of information system rules. Employees may violate IS rules, such as using a personal device for work or transmitting confidential information through unsecured communication channels.

Theft, fraud and abuse of authority. Staff with privileges or access to sensitive data may use it for personal gain. In addition, if there is lack of control, employees may steal equipment or change its configuration, which can lead to loss of resilience of the information system as a whole.

Negligence. Lack of Information Security awareness is often the cause of negligent behaviour by staff: clicking on phishing links, deliberate or accidental transfer of confidential data, reuse of passwords on work and home accounts, etc.

Data leakage to competitors. Employees can pass sensitive information to competitors either intentionally or by mistake.

Sabotage. This is the deliberate creation of conditions that would compromise the availability and integrity of information, such as server overloading, disabling or destroying critical equipment, and so on.

On a side note!

Theft, fraud and abuse of authority. Staff with privileges or access to sensitive data may use it for personal gain. In addition, if there is lack of control, employees may steal equipment or change its configuration, which can lead to loss of resilience of the information system as a whole.

• employees may use unsecured personal devices to access the corporate network and data, which often leads to information leakage or malware infections;

• control over the distributed environment becomes more complex, it is difficult to monitor IS events and identify intruders;

• remote employees may connect to unsecured public and home networks, etc.

Data protection measures in the office

There are several proven ways in which organisations can establish robust information security framework to ensure data protection and resilience to cyber-attacks in offices.

Start with risk assessment and risk management

Security risk assessment is the process of identifying vulnerabilities in IT ecosystem and analysing the threats they pose to the organisation, from downtime and associated loss of revenue to regulatory fines for non-compliance.

Some strategies for effective risk assessment include:

• identifying and identifying information assets that need to be protected;

• analysing potential threats for each asset;

• identifying and analysing current vulnerabilities of the information system;

• regular auditing of the enterprise's IT infrastructure;

• studying current IS threats, timely informing personnel about them and security measures.

This helps organisations to protect their assets in advance and maintain business continuity.

Develop and implement security policy

Developing of security policy with complete list of applicable rules and procedures helps to significantly minimise the risks of internal and external threats. The document serves as a kind of roadmap describing the specifics of information system operation, implemented means and measures to ensure data protection.

Office staff should be informed, by signature, of the company's security policies, as well as any changes to existing policies.

The company's safety policy is put into effect by a separate order.

Use NDAs and Trade Secrets Regulations

Legislative measures may not be sufficient to protect commercially valuable information. Therefore, the next step is to create the non-disclosure agreement (NDA) and the Trade Secrets Regulation.

For the non-disclosure agreement to be effective, it should contain the following information.

1. List of data that is considered confidential. This may include information about the company's processes and resources, its employees and customers, development plans, etc.

2. Detailed description of situations that would be considered leak of confidential information. This could be conducting similar business, publishing data in the media, communicating commercially valuable information as part of an oral conversation, etc.

3. Liability measures for breach of the NDA. These should be clearly stated in agreement.

4. Term of the agreement.

Terms and conditions for the use of confidential information can be further specified in the job description. The NDA should be signed together with the main contract.

Use of software and technical means of protection

Technical means of data protection are devices, appliances and systems designed to ensure the security of data in a company. Technical means of protection include:

• firewalls;

• intrusion detection systems;

• video surveillance cameras;

• motion detectors;

• uninterruptible power supplies;

• crypto gateways, etc.

Information Security software tools are utilities and applications designed to protect information from unauthorised access, viruses and other threats. They include:

• antivirus;

• firewalls;

• antispyware;

• VPN services;

• data encryption services;

• SIEM and DLP systems;

• DDoS protection software.

In addition to this, regular backup procedure should be carried out to protect your data.

Access control and management system (ACS)

It is set of hardware and software technical means for controlling and physically restricting access to certain territories and premises.

The main functions of ACS:

• user identification;

• access rights verification;

• event registration (passages through control points, alarms, etc.);

• event data storage;

• access control (opening/closing doors, turnstiles and other access points).

ACS are widely used in modern offices with limited access. Among other things, access control and management system includes:

• various identifiers;

• pin code and bar code readers, biometric data readers;

• controllers;

• various software and computers for system management;

• electronic locks, door drives, turnstiles, barriers and so on. 

Access control and authentication

Access control and authentication are an integral component of robust IS strategy. Access control mechanisms determine who can gain access to certain information resources, while authentication methods establish the identity of users requesting access. 

Typically, managing user access to sensitive information includes:

• regular reviews and updates of access permissions; 

• prompt revocation of access for employees who leave the organisation;

• applying the principles of least privilege and zero trust to minimise potential risks.

Zero trust implies that no user or system inside or outside the network perimeter is inherently trusted. This means that every user and device is continuously verified and authenticated, regardless of their location or previous access. Using this model ensures that users and systems have access to only those resources required for their specific tasks, significantly reducing the risk of potential security breaches.

Data encryption

Encryption is conversion of information into unreadable format, making it understandable only to authorised users with appropriate decryption key. By implementing encryption, organisations can protect sensitive data during transmission and storage. This not only serves as preventive measure against cyber threats, but also helps organisations comply with regulatory requirements related to data protection and privacy.

Personnel training and awareness raising in the field of IS 

The most advanced IS measures will be ineffective if company personnel are not aware of the rules of cyber hygiene and safe online behaviour.

Trained staff tend to be better at recognising threats, which are growing by the day. According to Security Magazine, some 2,200 cyberattacks occur every day — and it's up to front-line employees to counter them.

It is advisable to train personnel to counter modern IS threats:

• organise regular lectures, seminars and trainings on the topic;

• inform about new topical IS threats in mailings;

• use handouts (booklets, brochures, etc.).

Process of educating employees on the basics of IS is also commonly referred to as "securitisation".

Information Security incident management

Despite the rise in cyberattacks, many companies still don't have an effective IT security incident response plan in place. Yet, if a company suffers data breach and does not have robust remediation strategy in place, damage can be catastrophic.

The process includes continuous monitoring of IS events, their recording and analysing the collected data for violations and anomalies. If incident is detected, timely action must be taken.

How to respond to incidents?

The response algorithm will be identical for any business and may look as follows.

• Localisation. The first stage involves identifying the perpetrators of incident and defining the area of unwanted event.

• Damage assessment. At the assessment stage, scope of incident is specified, i.e. consequences for an organisation that resulted from its implementation. Consequences of the incident may include changes in IS reference settings, destruction or disclosure of sensitive information, and so on.

• Remediation. This step involves dealing with the consequences of incident, such as recovering deleted files.

• Incident analysis. Final stage of the response is to analyse the data about unwanted event and record it in any convenient way accepted by a company. Based on information about incident, report should be prepared, analysed and then measures to prevent its recurrence should be developed and implemented.

As a side note. Response plan should be tailored to unique risk landscape relevant to a particular organisation.

It is important to regularly test and update plan according to new potential risks and threats. In addition, conducting so-called cyber drills and IS resilience testing ensures that the plan chosen by the company will allow for timely response to incident and quick remediation of consequences of its realisation.

In conclusion

IS threats are becoming increasingly sophisticated, complex, multi-stage. Identify the data that needs to be protected and implement the appropriate Information Security measures to meet the capabilities and needs of your business.