Knowing what to choose between Network Security or Cloud Security. What is the difference between them? And how can it affect the integrity of the organization?
Network Security or Cloud Security
Network Security is the security of the network infrastructure including the hardware, software, and the interconnections between them. Any changes to the network infrastructure that occur after it has been deployed are also considered to be network security. So, the main concern of network security is making sure that data is delivered and accessed only by authorized users.
This is to ensure that data is not altered in transit and to enforce other security policies such as acceptable use. So, security measures for a company’s network include physical security (locks on doors and windows). Also, this includes software products that can prevent unauthorized access (firewalls), and intrusion detection systems (IDSs) to detect attempted intrusions.
What Involves Network Security?
Network Security is a collection of technologies, processes, and practices designed. So, this is to ensure the confidentiality, integrity, and availability of computer networks and systems. Also, Network security involves protecting networks from damage as well as from unauthorized use or access.
This is accomplished by using firewalls, intrusion detection systems and Intrusion Prevention Systems (IPS), anti-virus software, and passwords. So, the primary objectives of Network Security are confidentiality, integrity, and availability. Also, a consistent policy must be developed, implemented, and maintained in all organizational units.
Furthermore, a security policy defines the level of risk management based on a cost-benefit analysis that takes into account threats. So, this includes vulnerabilities and consequences to determine appropriate controls for protecting an organization’s information assets. Also, the security policy should define clear rules for all users within organizational boundaries.
Security Controls to Sensitive Data
Sensitive data should be identified for protection by its value to the organization. Also, the following factors should be taken into account when identifying sensitive data:
1. sensitivity of data
2. location of data
3. importance of data
4. frequency at which data changes
5. the amount of data; ownership of data
6. authorized access to data; potential impact if unauthorized parties obtain access
7. the likelihood that unauthorized parties will obtain access
8. means available to an unauthorized party to obtain access
9. difficulty involved in an unauthorized party obtaining access
10. the extent to which an unauthorized party would benefit if they obtained access
11. costs associated with preventing or detecting unauthorized access.
Security Requirements
The following requirements should be included in a security policy:
1. The security policy must be reviewed and approved by senior management.
2. The security policy is publicly available to all users.
3. All users are required to comply with the security policy and shall be subject to disciplinary action for violations of the security policy.
4. All employees are responsible for information security in their respective areas of responsibility, including the protection of sensitive information.
5. All employees are required to report any incidents or violations of the security policy without delay to their direct supervisor or designated individual as well as to Security or Information Technology (IT) personnel.
6. The organization must maintain a record of incidents reported by users within 72 hours of incident detection and retain them for a minimum period of five years from the date the incident occurred.
Moreover, an effective set of controls must be established these controls should encryption of data at the time of storage. So, this is during transport and while in use. Hence, this can be accomplished through standard encryption or the use of industry-recognized encryption products.