OSAC Item (Printer Friendly Version)

[an error occurred while processing this directive]

CurzTech News Network

OSAC Item (Printer Friendly Version)
from Business Day 1st Edition on Wednesday, March 26, 2003

Monitoring around the clock

PROTECTING information assets against security breaches in an increasingly hi-tech age is a prime challenge.

But information security cannot be viewed as the prerogative of a company's IT department. It needs to fall under the direct control of the company board as part of the business continuity and the risk management decision-making process, says Nelius Snyman, CEO of Nanoteq.

Snyman says the threat to information security in SA is very real.

"Often organisations only respond after they have experienced a breach of security and suffered damage to their information assets.

"The secret of good information security is to be proactive, to predefine your policies, procedures and standards, to put mechanisms in place to ensure that your data is secure and to monitor on a 24-hour basis."

Snyman estimates that at present about 70% of all threats to information security are internal, although external security threats from fraud syndicates for instance are on the increase.

The majority of SA companies do not comply with King 2 in terms of information securityrelated aspects, he says.

"Most organisations still regard these as an IT issue and delegate responsibility for information security to the IT department, which in some instances could compromise security."

Operational responsibility should be devolved to a chief security or information officer who has the authority and mandate to react to security issues quickly without needing to cut through miles of red tape, says Snyman.

Such an officer should report directly to the board, ideally to the CEO.

Nanoteq has developed an information assurance model to identify information assets and to prioritise those that could be at greatest risk, he says.

Procedures, policies and standards relating to information security within the company are examined, as well as the mechanisms in place to protect information.

Snyman says that as IT systems increasingly become more open and suppliers and clients are able to have access to a company's systems, it is essential that organisations put proper corporate governance procedures in place.

"If they fail to do so they won't be able to perform properly because their clients and partners will no longer trust them."

[an error occurred while processing this directive]