Information security? It's really all about people…
Suppose you were to lock away all your documents in a safe… Exactly—that would create an unworkable situation. Documents are, after all, the carriers of information and the fuel for our daily work. But if you don’t secure access to both analog and digital documents, information can always end up in places where you’d rather it not be—whether intentionally or unintentionally.
They are creative beings
Here’s an example. Under GDPR regulations, documents containing BSN numbers associated with individuals may not be exchanged between organizations. Therefore, the system prevents such documents from being sent via email. The technology detects when this happens and issues a preemptive warning. A seemingly effective solution. However, there are also resourceful employees who use their smartphones to take a photo of the document in question. You can probably guess that this “image containing the BSN number”—namely, the photo—slips through the cracks. “It worked anyway!” Not only has an illegal act been committed, but personal data is also stored on the smartphones of these resourceful employees. That is why information security is primarily about people.
5 tips about people:
- Develop policies, as this is a prerequisite for information security.
- Work together to classify information by value. That way, you’ll know which “crown jewels” require better protection.
- Stay alert and proactive. Is there any confidential information in the wrong place?
- Look beyond the office workspace—employees work in hybrid environments, which means they also work from home and on the go.
- Make sure that information security is regularly on the agenda of the board or executive management. They are responsible!
The conclusion is that technology is merely a tool for information security. Even if you’ve earned an ISO 27001 certification for information security, people remain the most important factor in ensuring its success. Is your information security under control?