Cyber Security with ISO 27001

          Cyber Security is a word which we are all aware of but it has no single definition. But all these definitions have some common ground. But when the question of achieving cyber security comes the domain becomes highly debatable. Over the last one decade this has been a hot issue, being discussed everywhere. Even national defence establishments are now working in this dimension. This is evident from the fact the US President Barack Obama had a speech dedicated to this issue, a whole web page is dedicated for this purpose in the White House's website.

           Quoting from Techtarget.com '"Cyber security is the body of technologies, processes and practices designed to protect networks, computers, programs and data from attack, damage or unauthorized access.' Cyber Security is not Information Security, but a sub-part of it. But in today's world it has been a major area of Information Security.

           Businesses today are dependent on IT infrastructure. And IT infrastructure carries with it the issue of cyber security. All information these days are in digital form, communications are via email. Information Security also ensures the cyber security. So nowadays all organizations are concerned about cyber security.

           So it turns out that cyber security can be implemented only by proper procedures, policies, processes and secure technologies. This is where ISO 27001 comes into the picture. Without a proper framework it is difficult to determine the cyber security level. ISO 27001 provides standards for Information Security.

          ISO 27001 helps in implementing Cyber Security in the following ways:

• It forces organisations to work comprehensively, thus making sure that important sectors like cyber security are addressed.
• Technology is not the only solution for cyber security. ISO 27001 recognizes this fact and emphasises on proper relation between People and Process.
• The basic philosophy of this standard is risk assessment. It provides a flexible approach in risk management. It allows organizations to have their own customised methods to address these risks based upon their need and requirements. It also focuses more on the important issues thus prioritising risks and issues.
• ISO 27001 standard is also the inspiration of most of the Information Security related legislations in countries around the world. Thus complying with it also helps in due diligence.

          ISO 27001 doesn't offer any guidelines about implementation. This is a major issue with the standard. But it must be remembered the intention of ISO 27001 is to provide a frame work. So ISO 27001 should not be the only standard for Cyber Security but it forms the first step towards Cyber Security. It provides a path to start and follow to implement Cyber Security.

          Cyber Security today is a major threat to the economy of the nations. Thus few steps in ensuring cyber security will be a major step in Information Security and securing businesses.

Rahul Das,
M.S Cyber Law and Information Security (IIIT-Allahabad)