Importance of Information Governance and Cyber Security Threats

This document discusses the importance of information governance and the latest cyber security threats. It explores the roles of information security auditors and the scope of Information Security Management Systems (ISMS). The document also covers risk assessment methodologies and the identification of information assets.

INFORMATION
GOVERNANCE AND
CYBER SECURITY
(PART A)

Table of Contents
INTRODUCTION...........................................................................................................................1
TASK 1............................................................................................................................................1
Critical evaluation of latest cyber security threats......................................................................1
Roles of Information Security auditors.......................................................................................2
TASK 2............................................................................................................................................3
Scope and content of
Information Security Management Systems (ISMS).................................................................3
Critical evaluation of Information governance framework.........................................................4
TASK 3............................................................................................................................................5
Importance of information governance.......................................................................................5
Risk
assessment methodologies.........................................................................................................6
Identify information
assets..........................................................................................................................................6
CONCLUSION................................................................................................................................7
REFERENCES................................................................................................................................8

INTRODUCTION
Information governance is policies, controls, processes, strategies and technology of
organisation are employed so that information can be amend to achieve business objectives.
Cyber security is technology, practices and processes formulated so that data, networks, devices
and programs are protected from unauthorised access (Murphy, 2015). Wallington Trust Hospital
(WTH) is concerns with providing health related services in London. In this report understanding
about new cyber security threats to data and need for information governance will be discussed.
Role of information security auditors in terms of social, legal and ethical requirements so that
information security management system (ISMS) is effective for organisation will be explained.
Scope and content of ISMS in context of organisation based on principles will be evaluated. At
last, evaluation of importance of information governance in relation with organisational context.
TASK 1
Critical evaluation of latest cyber security threats
Cyber security can be explained as processes, devise, practices and technology that helps
organisation in protecting its data, devices, programs and networks from unlawful or unapproved
access. Technologies and precautions are developed overtime so that risk can be minimised so
that loss of data can be reduced. Wallington Trust Hospital (WTH) is a healthcare organisation
which assist in secondary services related to health in London. There is need that management
should be aware about the significance of security to privacy and confidential data of patients.
There are number of threats to data which outline importance of information governance needed
by hospital, some of them are as follows:
Phishing: This threat is related to digital messages that leads to install malware or
passing on personal data to hackers. These are transmitted through e-mails, text messages that
leads to links and by clicking on it (Martin and et. al., 2017). By this hackers will be able to use
logins, credit credentials, and personal financial information, gain access to personal data. For
this tools like spam detector, blocking system for unauthorised links, etc. can be installed by
Wallington Trust Hospital so that threat can be reduced.
Electronic Media Records: Healthcare sector is going through evolution of moving
patients records and information online so that they can be maintained effectively. By this when
healthcare is adapting the digital technology, there are number of threats and safety concern for
1

organisation. As hospital is still adapting the technology of transforming data into digital
information, it is more vulnerable to hackers. Data contain sensitive information about patients
that cause illegal access and need of cyber security arises. For this Wallington Trust Hospital can
install encryption tools that will protect data from outside access and internet jammers that will
restrict access to unauthorised websites.
Smart Medical Devices: Another digital technology in healthcare sectors is
advancement of medical devices into smart (von Solms and von Solms, 2018). More devices and
connected to hospitals these days which posses threat to information to patients privacy data of
Wallington Trust Hospital. More threat is that these devices are connected to patient by which
hacker can control the dosages and functionality of operations creating risk to patients life. This
requires that there is proper and integrated system which can control any illegal or unauthorised
activity in process of these devices so that risk can be mitigated.
State Attacks: There are hackers who make profits by stealing personal and business
data, on the other hand other nations are also using cyber related skills to attack critical
infrastructure of other country. In near future, state – sponsored cyber threats going to increase
which will pose threat to infrastructure like healthcare sector as well. Thus there is need that such
risk should be analysed and strategies can be framed by Wallington Trust Hospital to mitigate
them.
Roles of Information Security auditors
Information Security auditors are those individuals which indulge in activities related to
checking systems and security processes, verifying, reporting and administration information
system of organisation. There are many roles that they perform in healthcare sector as well, some
of them are as follows:
Risk Evaluator: one of the basic role that Information Security auditor performs in
organisation in which evaluate risk with processing systems and design of programs. They
identify all threats related to systems before and after implementing them in organisation
(Eastman, Versace and Webber, 2015). In case of Wallington Trust Hospital, firm is moving
towards digital storage of data will require to review and monitor system so that information can
be protected from cyber threat. This role can be seen as social requirements that any company
will perform so that patients does not suffer any type of financial loss.
2

Review deliverables: In this role auditors are concern about ensuring that high quality
services are provided to customers. This role also ensure that minimal errors are made so that
there is no problem related to data loss or privacy threat to patients in Wallington Trust Hospital.
By this auditors makes sure that information system are reviews periodically so that any malware
and threat can be recognise at starting stage before data loss. This is ethical role of hospital
which need to perform so that there is no threat to information or security.
Control Requirements Compliance: This is one of legal role that any Information
system auditor performs to protect data from unauthorised access. There are certain rules and
regulations of government under which it is important that firms protect personal and private
data of customers from hackers (Smallwood, 2019). Same in case of Wallington Trust Hospital
there are rules as well so that systems are controlled in such a way that it protect stored
information from access of illegal or hackers.
Inform to Management: This role is related with finding any deviations in information
system and communicating it to management so that corrective actions can be taken. There is
need that any type of malware, illegal access or activity of hacker should kept in front f
department or top – management. This is one of the ethical role that information system auditor
will perform in Wallington Trust Hospital to protect cyber data.
Thus above roles concludes that different role of information system auditor are related
with social, legal and ethical responsibilities in any organisation.
TASK 2
Scope and content of
Information Security Management Systems (ISMS)
Information Security Management Systems (ISMS) are programs of organisation which
tends to cover aspects of policy with the help of security procedures and controls (De Bruin and
Von Solms, 2016). There are different content and scope of this system. Some of them are as
follows:
Content: This is general principles that this system contains for organisation so that security
objectives can be achieved by Wallington Trust Hospital.
3

Security Policy: This system contains policy which provides complete demonstration and
clear direction for security control. It is equally important that these policies should align with
goals and objectives of Wallington Trust Hospital.
Physical and Environmental Security: In case of information system it is important that
physical and environment security to information equipment and facilities so that they are
protected. This ensures that it involves each aspect of controlling and protecting information of
patients of Wallington Trust Hospital.
Scope: There is lot of scope of Information Security Management Systems (ISMS) in any
organisation. In context of Wallington Trust Hospital as it moving towards digitalisation will be
facing threats related to cyber security for patients information. Thus it is required to install such
system so that data can be protected from unauthorised access. Use of such system should be
included in policies and procedures so that security related objectives can b achieved and firm is
effective in keeping information of patients safe and confidential (Trim and Lee, 2016).
Critical evaluation of Information governance framework
Information governance framework provides different principles for healthcare business
so that their ability can be enhanced in keeping information secure in relation with attaining
business goals. These also helps business to effectively conduct its operations that are aligned
with legal requirements and other company responsibilities and duties. Some of the principles are
as follows:
Integrity Principle: This principle of information governance states that programs are
constructed and manage in such a way that it should provide guarantee of reliability and
authenticity to organisation (Smallwood, 2018). In context with healthcare sector it means that
information are integrated so that Wallington Trust Hospital has ability to prove that data is
accurate, complete, authentic and timely managed. This is essential so that it can perform its
fundamental expectations of providers, stake holders, government and patients. This principles
some information that information governance must include:
 Faithfulness to Wallington Trust Hospital's policies and procedures.
 Effective training on information governance management
 Reliable enough to control information systems
4

 Reliability of information
 Eligibility of managed record for legal purpose
 Accept trails for audit.
All these are important so that organisation can critically determine processes and
responsibilities for internal or external information and analysing before adding it to the medical
record of patients. These principles will not only help Wallington Trust Hospital to fulfil legal
and regulatory requirements moreover ensure safety and quality services to patients. It is equally
important that systems, technology and infrastructure used for such principles should be reliable
enough so that it can be created, maintained, used and stored effectively. Even take corrective
actions so that appropriate decisions can be taken to mitigate risks.
Protection Principle: This principle states that there should be appropriate level of
protection on private information systems so that they can be protected from loss, breach,
attacked, etc. This lays more emphasis on healthcare sector because nature of information record
and stored are sensitive, life sustaining and personal (Zukis, 2016). There are examples of many
businesses who have successfully established information security programs and integrated it
with overall information governance programs.
TASK 3
Importance of information governance
There are many significance in implementing information governance programs other
than regulatory and legal compliance. There are many profitable importance of information
governance also, some of them are as follows:
 Effective informational governance will provide rules, standards, regulations and
responsibilities so that data and information can be managed with Safety and Security.
 It is important for enhancing Productivity whenever there is collaboration of relevant
information and operation in organisation (Staff, 2017).
 To Reduce Repeated Work implementation of information governance program is
important as data is organised at one place and can be access with authorised individuals.
5

 Any program which leads to frameworks for information system in organisation will lead
to Managing Risk, by employing programs that control external access to database.
 In healthcare sector it is important that customers are provided qualitative health care
services so that they have Better Experience for this information governance is required
to provide efficient and quick information (Sedenberg and Mulligan, 2015).
 If Wallington Trust Hospital wants to avoid regulatory actions from state thus it is
important it classified, accessed and gather information for legal requirements.
Above points shows that there are many importance of information governance in respect to
healthcare sector so that they can effectively manage and secure information of patients.
Risk
assessment methodologies
Quantitative Assessment: It measures risks in terms of monetary losses based on mathematical
formula to find out expected loss due to risk of threat on information. These are based on value
of information which is at risk, frequency that attack on data occurs and estimation of financial
loss associated with data. This will help Wallington Trust Hospital to avoid spending resources
on risks that occur less and create minimal monetary loss and make strategies to overcome big
threats to information. With the help of cost benefit analysis it determine level of investment that
need to be done so that risk is treated effectively.
Advantages: Basic merit is that it provides complete and accurate information related to
financial loss that Wallington Trust Hospital will suffer due to different risk to database of
patients. It will also provide consequences and occurrence of risk in quantitative terms.
Disadvantages: Results of analysis may not prove to be effective and reliable for
measuring risks. Measures to identify occurrence and consequences are expensive as these are
advanced tools.
6

Identify information
assets
It is body of knowledge which is organised and managed as single business unit and also
have financial value like any other asset in organisation. Its value is directed with number of
employees who can access the information.
Threats: Major threat to information assets is that it depreciates in time when more and more
employees use this. The speed of loss in information value totally depends on information type
and accuracy to remain representative over time.
Vulnerabilities: There are chances that file are not kept in fire proof cabinet, no backup of
information, anti – virus programs are not effectively installed. Access control is not defined,
number of authorised access permission and lack of training to personnel handling information
assets (Martin, Kinross and Hankin, 2017).
Risks: There are different risk like fire, unauthorised access, failure of systems, malware or
virus, frequent errors, etc.
CONCLUSION
It can be concluded from above report that information governance are policies and
principles that collect and record information so that organisational objectives are achieved.
Cyber security is process or technology by which database and devices are protected from
unauthorised or illegal attacks which lead to loss of information. There are different cyber
security threats that need to be mitigated so that information of customer are kept safe and
confidential. Information system auditors plays different role in organisation to keep data safe
from outside attacks and compile for legal requirements as well. Information security
management systems covers every aspects of business with safety and security procedures in
organisation. Information governance provides principles for business by which it can keep
information safe and secure and have importance in achieving organisation goals. There are
quantitative risk assessment method by which impact and occurrence of risk can be calculated in
monetary losses.
7

REFERENCES
Books and Journals
De Bruin, R. and Von Solms, S. H., 2016, May. Cybersecurity Governance: How can we
measure it?. In 2016 IST-Africa Week Conference (pp. 1-9). IEEE.
Eastman, R., Versace, M. and Webber, A., 2015. Big data and predictive analytics: on the
cybersecurity front line. IDC Whitepaper, February.
Martin, G. and et. al., 2017. Cybersecurity and healthcare: how safe are we?. Bmj, 358, p.j3179.
Martin, G., Kinross, J. and Hankin, C., 2017. Effective cybersecurity is fundamental to patient
safety.
Murphy, S., 2015. Healthcare information security and privacy. McGraw-Hill Education Group.
Sedenberg, E. M. and Mulligan, D. K., 2015. Public health as a model for cybersecurity
information sharing. Berkeley Technology Law Journal. 30(3). pp.1687-1740.
Smallwood, R. F., 2018. Information Governance for Healthcare Professionals: A Practical
Approach. Productivity Press.
Smallwood, R. F., 2019. Information governance: Concepts, strategies and best practices. John
Wiley & Sons.
Staff, C. A. C. M., 2017. Cybersecurity. Communications of the ACM. 60(4). pp.20-21.
Trim, P. and Lee, Y. I., 2016. Cyber security management: a governance, risk and compliance
framework. Routledge.
von Solms, B. and von Solms, R., 2018. Cybersecurity and information security–what goes
where?. Information & Computer Security. 26(1). pp.2-9.
Zukis, B., 2016. Information Technology and Cybersecurity Governance in a Digital World. The
Handbook of Board Governance: A Comprehensive Guide for Public, Private and Not‐
for‐Profit Board Members, pp.555-573.
8