Computer security and data protection

Information security management.

The author Álvaro Gómez, in his work Enciclopedia de la Seguridad Informatica , defines the Information Security Management System (ISMS) as: “that part of the general management system that includes the policy, the organizational structure, the necessary resources , the procedures and processes necessary to implement information security management in an organization. 

It should be noted that, in practice, information security cannot be fully guaranteed , that is, it is impossible to eliminate all the risks that may exist. However, what we can do is manage them. In order to reduce risks to a minimum , we have to implement a series of tasks, procedures, programs and policies that allow us to guarantee a certain level of information security in the organization.

In this process, the following aspects of the organization should be considered:

1.            Persons

2.            Technology

3.            Applicable legislation

4.            Organizational structure

Finally, following the author Álvaro Gómez, we can distinguish the following stages or levels of maturity in the management of information security in an organization:

1.            Implementation of basic security measures by common sense : consists of the implementation in the organization of primary security measures, such as: backup copies or access control to computer resources.

2.            Adaptation to the requirements of the legal framework and the demands of the clients : the company begins to become aware of the importance of security and complies with the applicable legal regulations, such as the protection of personal data.

3.            Comprehensive information security management : at this stage, security policies, plans and procedures for the analysis and management of information security risks begin to be defined.

4.            Information security management certification : at this stage, it is intended to be certified in the field of information security, for which a certification process based on standards such as ISO is usually used.

Security policies, plans and procedures.

For a computer security system to achieve and develop all the objectives and function, it is necessary for the organization to define, design and implement a series of policies, plans and procedures in the field of information security.

In this sense, the author Álvaro Gómez defines these concepts, in his work Enciclopedia de la Seguridad Informática, as follows:

1.            Security policy : a high-level statement of intent that covers the security of computer systems and that provides the basis for defining and delimiting responsibilities for the various technical and organizational actions that are required.

2.            Security plan : set of decisions that define future courses of action, as well as the means that will be used to achieve them.

3.            Security procedure : detailed definition of the steps to be executed to carry out certain tasks. Security procedures allow the application and implementation of security policies that have been approved by the organization.