Cybersecurity classification and protection of information Lic. Claudio Jorge Tana Gerente de Consultoría NeoSecure S.A. LA27001 - LA25999 – CISM - CBCP ctana@neosecure.com May 2016

Index Cyber Security and Information Protection Reasons for Identification and Classification Main concepts Goals Implementation Summary

CyberSecurity Protecting information assets, through treatment of threats that exposed risk the information is processed, stored and transported by information systems that are interconnected. ISACA (Information Systems Audit and Control Association) Monterrey Chapter

Differences Between Cybersecurity and Information Security Seeks to protect information that may affect risk in its different forms and states. Focus on information in digital format and interconnected systems that process, store or transmit. Methodologies, standards, techniques, tools, organizational structures, technology and other elements that support the idea of protection in the various facets of information. Approach with Security. It involves the implementation and management of appropriate security measures, through a holistic approach. Threats and vulnerabilities in cyberspace. Information threats and infrastructure threats. Information Classification. Cybersecurity Information Sharing Classification System.

Reasons for classifying information in digital format Companies need to protect their information today more than ever. The need is obvious but solutions are not. Management must ensure company information is protected. Mobile Technology Cloud Computing Distinguishing Information Classification and Cybersecurity Information Sharing Classification System.

Principal Objectives Understand what an effective information classification system should accomplish. Be easy to understand, use and maintain. Focus only on confidentiality. Specially in “Private” and “Confidential” Information. Protecting it from inappropriate access. Apply “least privilege” / “need to know” concepts. Strategy for Information Sharing and Safeguarding.

Successful implementation Identify all information sources and media that need to be protected. Identify information protection measures Authentication Role based Access Encryption Administrative controls Technology control Assurance Map information protection measures to information classes. Classify information. Repeat as needed.

Iterative and an on-going process. Summary Iterative and an on-going process. Information security policy (updated). Standards and procedures (updated). Updated on new technologies. Security awareness. If this sounds like too much work, consider… Without data classification, all decisions about information protection are being made by the discretion and judgement of security, system, and database administrators only

Presencia Local en: Argentina Chile Colombia Perú Argentina Carlos Pellegrini 1265 – 6to Piso Teléfono: 5235-8875