The document outlines an approach to information security emphasizing the importance of making information accessible while ensuring its protection through a five-step process: information location, classification, protection, audit, and training. It discusses the significance of classifying information to tailor protection measures and includes the necessity of auditing usage patterns to enhance policy effectiveness. Finally, end-user training is highlighted as a critical component for ensuring proper information handling and minimizing misuse.

1. Approach to Information Security
Rahul Khattar

2. Approach to Information Security
Setting the Agenda
• Making Information
available to all users, is
essential for the enterprise
to conduct its business
• Leakage of such
information may impact
the organization adversely
Five step approach to make information available and secure
Information Location  Classification  Protection  Audit  Training

3. Approach to Information Security
Where does Information Reside?
On File-Servers (FTP)
Shared
Within DMS
folders Backup
Content
Emails
Management
Backup Tapes
Extracts from BI tools
Laptops
Removable Mobile
Printer hard disk
media devices
This Information is shared with
Employees/ Vendors/ Partners/
Desktops
Email
Consultants/ Contractors/ Auditors
Recognize where information exists
Information Location  Classification  Protection  Audit  Training

4. Approach to Information Security
Classification
What is Information Classification?
It is the science to describe principles that
need to be followed to protect information
It guides you on how and to whom you
can distribute information with a particular
classification
Why Classify?
Classification of information is essential for every business
because without classification everyone treats the same piece of
information differently, which could have major consequences
Classified data helps to better define and implement protection policies
Information Location  Classification  Protection  Audit  Training

5. Approach to Information Security
Protection
What is Protection?
Ensure that only legit users have access to
the data
Control data with internal/external users
Define and apply policies based on
Classification
Why Protect?
Protection enables the enterprises to
manage the usage and consumption of its
valuable data
Information Location  Classification  Protection  Audit  Training

6. Approach to Information Security
Audit
Auditing Information Usage
Track all end user actions on
protected information
Generate and analyze reports
Keep a close eye on all your data
that resides within or outside the
organization
Why Audit Information Usage?
To understand the Information consumption pattern
To showcase the shortcomings of existing policies
To fine tune “Control-Policies” for your confidential data
Information Location  Classification  Protection  Audit  Training

7. Approach to Information Security
End User Training
What is Training
Educate employees on Information Usage
Ensure participation, role play for users
Using email, standees, flyers, KM portal
as a medium of knowledge transfer
Why Train Staff?
Helps enterprise define better control-policies on data
Minimize accidental misuse of information
Ensure technology platform is well accepted
Training ensures User participation and acceptance
Information Location  Classification  Protection  Audit  Training

8. Approach to Information Security
Importance of DFA in building better policies
Data Flow Analysis is an activity to
understand what is valuable information
and which department holds it
It also helps in tracking the information
and the consumption pattern & risk
DFA maps the information flow for a particular business
process
DFA clearly points out the security issues attached with a piece
of information at different stages of its lifecycle
DFA sharpens classification and protection policies on information

9. More Info?
www.seclore.com
+91-22-6130-4200
9