{"id":7935,"date":"2017-04-10T23:13:14","date_gmt":"2017-04-10T23:13:14","guid":{"rendered":"https:\/\/media.am\/lack-of-financial-means-is-no-reason-not-to-have-information-security\/"},"modified":"2020-07-21T23:32:09","modified_gmt":"2020-07-21T23:32:09","slug":"lack-of-financial-means-is-no-reason-not-to-have-information-security","status":"publish","type":"post","link":"https:\/\/media.am\/en\/crossroads\/2017\/04\/10\/7935\/","title":{"rendered":"\u201cLack of financial means is no reason not to have information security\u201d"},"content":{"rendered":"

Information security expert, Ukrainian Mykola Kostinian mainly works with media and non-profit organizations, providing advice on their information security issues. <\/p>\n

He is convinced that a lack of financial means is no reason not to have information security, as there are organizations that help media outlets. <\/p>\n

\n

\u201cIt\u2019s not a matter of money; you don\u2019t need money to protect your email. Protected are those organizations that are well-managed, not those that have greater financial means.\u201d<\/p>\n<\/blockquote>\n

According to Kostinian, to ensure its information security, a media organization must have a discussions with management and a few key staff members, and do a risk assessment once a year.<\/p>\n

\n

\u201cFirst you have to understand what to protect. Probably the data and communication in computers, on servers, or in email, as well as the website should be protected from hacking and attacks. <\/p>\n

\u201cFrom whom and what the data should be protected should also be decided. For example, from competitors, who can organize a DDoS attack, or from police, who can come one day and seize the organization\u2019s computers. A list that includes all the risks must be compiled at the meeting.<\/p>\n

\u201cAfter identifying the risks, you should assess their likelihood and consequences, then separate, for instance, the five main issues, which only after they are resolved can you move to the secondary issues.\u201d<\/p>\n<\/blockquote>\n

According to Kostinian, following the meeting is a security audit, which preferably an invited organization conducts. It must assess to what extent the media organization is protected from risks. <\/p>\n

\"Mykola<\/p>\n

\n

\u201cThe audit will check how realistic these risks are; it may find that the organization is already protected from certain risks. Then the audit makes recommendations \u2014 both technical (the use of passwords on computers or having special access to email) and managerial (determining procedures).<\/p>\n

\u201cWhen a decision is made on which recommendations can be implemented, they are implemented, after which a final audit is carried out. For example, if a decision is made that passwords must be of a certain length, it\u2019s checked by reviewing employees\u2019 passwords, sometimes several times a year.<\/p>\n

\u201cThis process of meeting, assessment, audit, implementation, and oversight must be repeated every year.\u201d<\/p>\n<\/blockquote>\n

To organizations wanting to work according to international information security standards, Kostinian recommends becoming acquainted with ISO 27001standard, which is called \u201cInformation security management system.\u201d<\/p>\n

\"Mykola<\/p>\n

And those media organizations that are unable to follow all the rules, Kostinian provides some basic advice:<\/p>\n