{"id":10899,"date":"2017-03-13T15:38:01","date_gmt":"2017-03-13T15:38:01","guid":{"rendered":"https:\/\/multiacademstg.wpengine.com\/27001academy\/?p=10899"},"modified":"2024-12-21T13:35:37","modified_gmt":"2024-12-21T13:35:37","slug":"information-security-focus-asset-protection-compliance-corporate-governance","status":"publish","type":"post","link":"https:\/\/advisera.com\/27001academy\/blog\/2017\/03\/13\/information-security-focus-asset-protection-compliance-corporate-governance\/","title":{"rendered":"Should information security focus on asset protection, compliance, or corporate governance?"},"content":{"rendered":"

Traditionally, information security has been perceived as an activity that was built around protecting sensitive information assets \u2013 after all, this is what the first (2005) revision of ISO 27001<\/a>, and its predecessor BS 7799-2, also emphasized. These standards required companies to identify all the assets, and then build the safeguards (i.e., defense) around those assets.<\/p>\n

But, in the last decade, other ways to look at information security have emerged as well: that security is primarily a compliance job, and that security is part of an internal control, i.e., part of corporate governance. (Note: this blog post has adapted the model presented in the paper Information assurance: Strategic alignment and competitive advantage<\/a>.)<\/p>\n

So, which of these three approaches is the best to take?<\/p>\n

Information security as a protection of information assets \/ IT security approach<\/h2>\n

This traditional approach of protecting the assets came from the philosophy that has existed in physical security for thousands of years \u2013 you have a physical asset, and then you build a security perimeter around it. (See also: Physical security in ISO 27001: How to protect the secure areas<\/a>.)<\/p>\n

This traditional approach was mostly taken over by IT departments who had developed their IT security technology \u2013 e.g., firewalls, anti-virus protection, intruder-detection systems, etc. \u2013 around the assets they wanted to protect. (See also: Information security or IT security?<\/a>)<\/p>\n

And this approach worked fine for physical security; however, the problem is now with cloud services, mobile devices, insiders, backdoors, hackers, etc. \u2013 it is becoming really difficult to define the security perimeter around information assets and then build the controls around them; obviously, something else is needed.
\n

<\/div>