This document outlines best practices for information security management and defense in depth. It discusses implementing security across multiple layers including personnel, procedural, technical, and physical controls. Specific controls mentioned include physical security measures, technical controls like encryption and access control lists, and administrative controls such as security policies, training, and disaster recovery plans. The document also provides best practices for protecting networks such as access controls, logging, patching, user education, policies, activity monitoring, and data breach response plans. Finally, it lists best practices for personal security including using antivirus software, strong passwords, locking computers in public, protecting personal information, limiting social media sharing, safe file downloads, and regular backups.

1. Best practices of information security
management
Health Information Security
Session 05:Best Practices of Information
Security Management

2. “Cyber security…
It’s not just about technology”

3. DEFENCE IN DEPTH
• Concept in which multiple layers of security controls (defence)
are placed throughout an information technology (IT) system.
• Its intent is to provide redundancy in the event of a security
control fails or a vulnerability is exploited.
• Cover aspects of personnel, procedural, technical and physical
for the duration of the system's life cycle.

4. DEFENCE IN DEPTH CONTINU......

5. DEFENCE IN DEPTH CONTINU......

6. SECURITY CONTROLS
1. Physical control
2. Technical control
3. administrative control

7. 1. PHYSICAL CONTROLS
Implementation of security measures in a defined structure used
to defend or prevent unauthorized access to sensitive material.
e.g.:
• Closed-circuit surveillance cameras
• Motion or thermal alarm systems
• Security guards
• Picture Ids

8. 2.TECHNICAL CONTROLS
• Use of technology as a basis for controlling the access and usage
of sensitive data throughout a physical structure and over a
network.
• e.g.:
• Encryption
• Access control lists (ACLs)
• File integrity auditing software

9. ADMINISTRATIVE CONTROLS
• Administrative controls define the human factors of security.
• It involves all levels of personnel within an organization and
determines which users have access to what resources and
information by such means as:
• e.g.:
• Information Security policy
• Training and awareness
• Disaster preparedness and recovery plans

10. BEST PRACTISES - PROTECT YOUR
NETWORK
1. Create Specific Access Controls
• Minimum user privileges
2. Collect Detailed Logs
• for security and troubleshooting purposes
• backup logs
3. Maintain Security Patches
• make sure your software and hardware security is up to date
4. Educate and Train Your Users
• users will always be your weakest link

11. BEST PRACTISES - PROTECT YOUR
NETWORK CONTIN..
5. Policies and Guidelines
• Clear User Policies for New Employees and Vendors
• Security policy and guidelines for staff
6. User Activity Monitoring
7. Data Breach Response Plan
8. Back up and Restore

12. BEST PRACTICES -PROTECT OURSELF
1. Install anti-virus software and keep all computer software
patched and updates.
2. Use a strong password
• Password Vs Pass phrase
3. Log off public computers/Lock your computer
4. Keep personal information safe
• Be wary of suspicious e-mails
• Use secure Wi-Fi connections
• properly delete any personal information before sell or dispose of your
hardware

13. 5. Limit social network information
• you should be wary about how much personal
information you post.
6. Download files only from trusted souses
7. Regular data Back up

14. Thank you