\u201cYour ISO 27001 is nice in theory, but if our system administrator goes crazy, we\u2019re dead.\u201d \u2013 I hear this quite often when speaking to my clients about which security controls they should apply.<\/p>\n
And it\u2019s not only system administrators, it is also the line managers, engineers, top management, etc. \u2013 actually, anyone who has access to sensitive information or systems could be a potential threat. For instance, the biggest damage in banks is not done by robbers (with guns in their hands), but by inside jobs (with computers in their hands).<\/p>\n
Of course, money theft is not the only purpose of these kinds of attacks \u2013 it can also be sabotage, theft of confidential corporate information, altering of data, theft of identities, etc.<\/p>\n
Since this is such a complex issue, how can you deal with it?<\/p>\n
ISO 27001<\/a> is a standard which approaches security management mainly from the preventive point of view \u2013 the first step is to find out which incidents could happen regarding your employees (but also external partners with access to your systems), and then to choose appropriate security controls in order to avoid those incidents. In ISO 27001, this process is called risk assessment and risk treatment<\/a>.<\/p>\n However, risk assessment shouldn\u2019t be done superficially. If you didn\u2019t think really hard about all the bad things that can happen, then you won\u2019t mitigate those risks and someone could exploit those vulnerabilities.<\/p>\n Therefore, don\u2019t rush through this step; do it systematically.
\n