Health information secuirty session 5 best practise in information security
This document outlines best practices for information security management and defense in depth. It discusses implementing security across multiple layers including personnel, procedural, technical, and physical controls. Specific controls mentioned include physical security measures, technical controls like encryption and access control lists, and administrative controls such as security policies, training, and disaster recovery plans. The document also provides best practices for protecting networks such as access controls, logging, patching, user education, policies, activity monitoring, and data breach response plans. Finally, it lists best practices for personal security including using antivirus software, strong passwords, locking computers in public, protecting personal information, limiting social media sharing, safe file downloads, and regular backups.
Health information secuirty session 5 best practise in information security
- 1. Best practices of information security management Health Information Security Session 05:Best Practices of Information Security Management
- 2. “Cyber security… It’s not just about technology”
- 3. DEFENCE IN DEPTH • Concept in which multiple layers of security controls (defence) are placed throughout an information technology (IT) system. • Its intent is to provide redundancy in the event of a security control fails or a vulnerability is exploited. • Cover aspects of personnel, procedural, technical and physical for the duration of the system's life cycle.
- 4. DEFENCE IN DEPTH CONTINU......
- 5. DEFENCE IN DEPTH CONTINU......
- 6. SECURITY CONTROLS 1. Physical control 2. Technical control 3. administrative control
- 7. 1. PHYSICAL CONTROLS Implementation of security measures in a defined structure used to defend or prevent unauthorized access to sensitive material. e.g.: • Closed-circuit surveillance cameras • Motion or thermal alarm systems • Security guards • Picture Ids
- 8. 2.TECHNICAL CONTROLS • Use of technology as a basis for controlling the access and usage of sensitive data throughout a physical structure and over a network. • e.g.: • Encryption • Access control lists (ACLs) • File integrity auditing software
- 9. ADMINISTRATIVE CONTROLS • Administrative controls define the human factors of security. • It involves all levels of personnel within an organization and determines which users have access to what resources and information by such means as: • e.g.: • Information Security policy • Training and awareness • Disaster preparedness and recovery plans
- 10. BEST PRACTISES - PROTECT YOUR NETWORK 1. Create Specific Access Controls • Minimum user privileges 2. Collect Detailed Logs • for security and troubleshooting purposes • backup logs 3. Maintain Security Patches • make sure your software and hardware security is up to date 4. Educate and Train Your Users • users will always be your weakest link
- 11. BEST PRACTISES - PROTECT YOUR NETWORK CONTIN.. 5. Policies and Guidelines • Clear User Policies for New Employees and Vendors • Security policy and guidelines for staff 6. User Activity Monitoring 7. Data Breach Response Plan 8. Back up and Restore
- 12. BEST PRACTICES -PROTECT OURSELF 1. Install anti-virus software and keep all computer software patched and updates. 2. Use a strong password • Password Vs Pass phrase 3. Log off public computers/Lock your computer 4. Keep personal information safe • Be wary of suspicious e-mails • Use secure Wi-Fi connections • properly delete any personal information before sell or dispose of your hardware
- 13. 5. Limit social network information • you should be wary about how much personal information you post. 6. Download files only from trusted souses 7. Regular data Back up
- 14. Thank you