Information Governance And Cyber Security

This document discusses the significance of information governance and cyber security in maintaining data confidentiality and protecting computer systems from threats. It explores the latest cyber security threats and the need for information governance. The document also justifies the approaches used and evaluates information governance frameworks. Additionally, it highlights the importance of risk assessment methodologies.

Information Governance AndInformation Governance And
Cyber SecurityCyber Security
1

Table of Contents
Introduction......................................................................................................................................3
Task 1...............................................................................................................................................3
Critically appraise latest cyber security threats along with need of information governance.....3
Task 2...............................................................................................................................................5
Justify the approaches used as well as rationale for scope of ISMS. Evaluate information
governance frameworks...............................................................................................................5
Task 3...............................................................................................................................................8
Justify significance of information governance to along with risk assessment methodologies.. 8
Conclusion.....................................................................................................................................10
References......................................................................................................................................11
2

Introduction
Information governance refers to overall strategies of information that are liable for
balancing the risk associated with value that is being rendered by data. It assists firms within
operational and legal compliance with reduction in expenditures that are related with legal
discovery (Abomhara, 2015). Cyber security denotes securing of computer systems from any
kind of damage or theft. It refers to practices, technologies and processes which are designed for
protection of programs, networks and devices from unauthorised access. This report is based on
Wallington Trust Hospital which is liable for rendering secondary health services. It is important
to maintain confidentiality as well as privacy of digital information. This report comprises of
cyber security threats, information security management system, and information governance.
Apart from this, it includes risk assessment methodologies.
Task 1
Critically appraise latest cyber security threats along with need of information governance.
The defensive techniques which are being used for protection of programs, data as well as
network from unwanted access, attack or damage are defined as cyber security. This comprises
of protecting information along with systems from threats that are in the form of phishing,
malware, exploit kit and ransomware (Brown, Gommers and Serrano, 2015). The threats which
might be faced by Wallington Trust Hospital are illustrated beneath:
Ransomware: It is a kind of malicious software or malware which makes an attempt to
scramble or encrypt data and carry out extortion for releasing unlocked data. Basically, it is
delivered by the usage of emails. To ensure that Wallington Trust Hospital have ransonware
systems or information, they need to make their people aware about the mails which prompt a
response. Along with this anti-virus along with malware protection software must be installed as
well as maintained. Furthermore, technical team needs to ensure that their systems are kept up to
date so that any kind of vulnerability is not present within which will lead intruder to enter
within their system.
Phishing: This implies an effort for gaining access to sensitive information while
pretending like a trustworthy source like online services or bank. It is highly targeted for
attaining information from individual (Collins, 2016). The emails which are sent through
phishing seem to be authenticated as genuine logos and faultless wording. This denotes form of
3

spear phishing n which fake mails are sent from CEO or CFO for making some payments, it
implies whaling. To protect information from phishing Wallington Trust Hospital must be
suspicious from unexpected emails that are being received, along with this, their employees need
to ensure that any company will not ask for confidential information and if this happens it must
be immediately told to the technical team. Apart from this, spam filters must be turned on.
Cryptojacking: It is referred to as secret usage of computing devices for mining
cryptocurrency. They are installed within the system of victim unknowingly and are responsible
for secretly mining cryptocurrency (Graham, Olson and Howard, 2016). This is being carried out
by hackers by making casualty to click on the malicious links which are being sent through mails
which loads codes of cryptomining on systems or by creating infection on online ad or website
with JavaScript which is liable for auto implementing when it is loaded on the browser of victim.
Wallington Trust Hospital can prevent such kind of attack from occurring by making use of
installing anti-cryptomining or ad-blocking extension on their website or web pages and making
use of endpoint protection which is capable for detecting crypto. Apart from this, web filtering
tools can be used which must be up to date, this will enable technical team of Wallington Trust
Hospital to ensure that third person do not get access into their systems.
Some cyber security threats have been mentioned above and it is important for
organisation (Wallington Trust Hospital) to furnish appropriate training to their employees so
that they do not click on or provide any kind of information to anyone even if they seem
authenticated. Breaches always lead to pessimistic impact on overall operations of organisation
as well as their customers (Gupta, Agrawal and Yamaguchi, 2016). An instance can be taken into
consideration with respect to Wallington Trust Hospital, if system is hacked then details of their
patients will also be leaked which denotes that hospital needs to carry out appropriate actions
through which privacy can be maintained. For this, they can opt for information governance so
that such kind of things can be prevented. It is important to make sure that systems are updated
which will enable them to eliminate any kind of exploits or vulnerabilities present within their
system. Along with this, it is important to monitor the activities that are carried out in network on
regular basis so that in case if any kinds of unauthenticated actions are carried out then they can
be identified before things get worst (Hendrix, Al-Sherbaz and Bloom, 2016).
Information governance refers to holistic approach that is used for management of
information by implementation of controls, processes, roles and metrics that is liable for treating
4

valuable asset of data within a firm. It will lead to eradicate threats which may be caused on
information present on systems of Wallington Trust Hospital. An instance can be taken into
account, information governance renders organisation with enterprise content management. This
acts as a practice and strategy that can be used to confine, manage, store as well as deliver data
and content by making use of technological tools (Johnson, 2015). Information security auditors
are responsible for carrying out analysis along with accessing infrastructure of firm for ensuring
that processes as well as systems are implemented in an efficacious and accurate manner. In
addition to this, they are also liable for identification of IT issues related with security as well as
risk management and if in any case problems are recognised then communication can be carried
out with respect to solution for enhancing processes.
Task 2
Justify the approaches used as well as rationale for scope of ISMS. Evaluate information
governance frameworks.
With respect to cybersecurity, some threats have been illustrated above, it is crucial to have
appropriate strategies through which firm can eliminate all kind of threats which might take
place. This is important for firm to make sure that systems are protected. It can be ensured by
making use of distinct approaches (Knowles and et. al, 2015). Wallington Trust Hospital can opt
for cyber security approaches which denotes the way through which organisation can secure their
systems from threats which may occur like phishing, malware, spyware and various others. The
following steps can be taken by Wallington Trust Hospital to ensure that their systems are
protected. Bolster access control: The process which is related with confining the access to physical
or virtual resources with respect to what can be accessed by whom is referred to as access
control. If weak control accesses are applied on the system then data might be accessed
by anyone who can misuse the system. It is crucial for Wallington Trust Hospital to
enhance control measures like making use of strong passwords as well as control policies. Update software: When pop-up for update appears then it must not be neglected as it
brings with them enhanced security features (Liu and et. al, 2018). This will aid
Wallington Trust Hospital to eliminate the vulnerabilities or exploits that are present
5

within outdated software. Furthermore, as manual software are time consuming, thus it is
mandatory to opt for automatic updates for every programs and processes. Use network fortification methods: It is important for securing network for making sure
that illegitimate user do not access to the system of Wallington Trust Hospital. To attain
appropriate frameworks must be used by their technical team. For this, they can make use
of firewall, access controls, IDS/IPS for monitoring of packet floods, make use of virtual
private network (VPN), network must be segmented and make use of appropriate
maintenance frameworks (Sayan, Hariri and Ball, 2017). Employee training: This is observed as an external threat which prevails within the
internal environment that acts like a weaker association in Wallington Trust Hospital. It is
important for organisation to render training to their employees so that if any kind of
unwanted activity occurs then they can realise it and take an appropriate action for
securing their systems. In case if it prompts again for making reply then it must be told to
technical team so that systems of Wallington Trust Hospital can be protected from any
kind of pessimistic impacts. Standardise software: The firm need to make sure that they make use of licensed
software as others bring in vulnerabilities with them. In addition to this, other individuals
or staff must be restricted to configure any of the software without permission from
technical department (Sun, Hahn and Liu, 2018). The reasons for this is that, it is not
possible identify which software can create harm to systems of Wallington Trust
Hospital. For this, it is necessary that each system have operating system plugins and
identical browsers.
These are some approaches which can be utilised by technical team of hospital as this will
enable them to prevent their systems from any kind of unwanted activities. The purpose behind
this is furnishing secured working environment with respect to system and data. Information
security management system denotes the control which organisation must implement to maintain
confidentiality, integrity and availability of assets from threats and exploits. It allows them to
assess risks as well as carry out essential operations for protection of systems (THOMAS and et.
al, 2019). This can be done by Wallington Trust Hospital by making use of information
governance framework for attaining security. It will provide them with details associated with
definition, creation, utilisation, security and permission for carrying out modifications within
6

their systems as per requirements (Abomhara, 2015). This is responsible for covering all models
as well as roles that are needed for management of processes and policies that can create an
impact on business & technical usage of data by enterprises. Rationale behind its usage is that it
will furnish ECM, information lifecycle management, access governance and covers various
other aspects which are important for Wallington Trust Hospital. With respect to this, framework
has been illustrated below which can be used by hospital.
COBIT (Control objective for information and related technology) framework: It is
formulated for managing and IT governance. It will act as a supportive tool for Wallington Trust
Hospital which will bridge gap that exit among technical issues, control requirements along with
risks.
Figure 1 COBIT Framework
(Source: COBIT 4.1: Framework for IT Governance and Control, 2019)
It is for ensuring control, reliability as well as quality of services in context of information
system. By making its usage, Wallington Trust Hospital can formulate plans, ensure their
delivery, monitor, and support, organise and evaluate the performance of entire system by
attaining higher levels of security (Brown, Gommers and Serrano, 2015). COBIT framework will
7

enable within description of maturity models, processes and formulation of management
guidelines.
Task 3
Justify significance of information governance to along with risk assessment methodologies.
The process that is responsible for illustration of ways in which organisation can process or
handle data is defined as information governance. Its significance in context of Wallington Trust
Hospital has been shown below:
 Workflow automation: This will lead hospital to digitise and automate mundane as well
as iterative aspects related with information governance. Through this, advancement can
be attained in speed and accuracy in context of security perspectives of processes that
will minimise errors and cost (Collins, 2016).
 Knowledge management: This denotes creating, using and sharing of knowledge as well
as management of information which is possessed by Wallington Trust Hospital to reach
their goals by making optimum use of knowledge. This will assist firm to have
appropriate information with respect to security and accordingly they can formulate their
strategies with respect to network.
 Know your customer (KYC): It implies the process of identification of clients or
customers and assess risk with respect to legal or criminal business relationship. This is
essential for Wallington Trust Hospital to take appropriate measures which can be
attained through usage of information governance (Graham, Olson and Howard, 2016).
 Audit trails: They implies chronological records that are responsible for furnishing
documentary evidences associated with series of operations that are associated with
events, workflow or any other kind of specified events. Through this, firm will be able to
preserve as well as capture important assets.
 Information governance software: Tools such as enterprise content management
(ECM) can be used for acknowledging needs of data governance (Gupta, Agrawal and
Yamaguchi, 2016). Furthermore, as per the responsibilities of individuals they can be
provide with specified tools as per stipulated standards.
8

Figure 2 Information Governance
(Source: What is Information Governance and how does it differ from Data Governance?, 2019)
By making proper use of information governance hospital can make sure that relevant
standards are maintained with respect to security aspects and services can be furnished
accordingly (Hendrix, Al-Sherbaz and Bloom, 2016). Risk assessment denotes methodical
process which is being used for evaluating potential risks that might create negative impact on
individuals, assets and working environment. With respect to cyber security quantitative methods
implies development of models or algorithms for dealing with specified problem. But there is
possibility that this might not yield affirmative results. Qualitative methods will aid with in
making use existing models by evaluating them on the basis of positive and negative impact
which will be created by them. This method will provide appropriate results to Wallington Trust
Hospital as they can accomplish their operations by making use of tools which will deliver them
with extra functionalities. This will also allow them to formulate new strategies and policies for
avoiding security threats.
Data is crucial aspect for every firm and it is mandatory to ensure its integrity,
confidentiality along with availability (Johnson, 2015). This will enable them to furnish access to
authenticated users only which will protect their network from unwanted access. Along with this,
firm need to ensure that threats must be identified along with vulnerabilities as this will ensure
9

that any kind of data breach will not take place. Furthermore, it is crucial for Wallington Trust
Hospital to ensure that systems that are being utilised by them are secured.
Conclusion
From above it can be concluded that, cyber security denotes the way in which
information and data can be secured through utilisation of suitable strategies and tools. This acts
as an important asset of firm as without information operations cannot be carried out as per
desired standards. Different threats which create impact on operations of organisation are
illustrated and it is important to identify them as all the information can be gone into wrong
hands which can be misused. To secure the systems and processes information governance
framework can be used.
10

References
Books & Journals
Abomhara, M., 2015. Cyber security and the internet of things: vulnerabilities, threats, intruders
and attacks. Journal of Cyber Security and Mobility, 4(1), pp.65-88.
Brown, S., Gommers, J. and Serrano, O., 2015, October. From cyber security information
sharing to threat management. In Proceedings of the 2nd ACM workshop on information
sharing and collaborative security (pp. 43-49). ACM.
Collins, A. ed., 2016. Contemporary security studies. Oxford university press.
Graham, J., Olson, R. and Howard, R., 2016. Cyber security essentials. Auerbach Publications.
Gupta, B., Agrawal, D.P. and Yamaguchi, S. eds., 2016. Handbook of research on modern
cryptographic solutions for computer and cyber security. IGI global.
Hendrix, M., Al-Sherbaz, A. and Bloom, V., 2016. Game based cyber security training: are
serious games suitable for cyber security training?. International Journal of Serious
Games, 3(1).
Johnson, T.A. ed., 2015. Cybersecurity: Protecting critical infrastructures from cyber attack and
cyber warfare. CRC Press.
Knowles, W. and et. al, 2015. A survey of cyber security management in industrial control
systems. International journal of critical infrastructure protection, 9, pp.52-80.
Liu, X. and et. al, 2018. Trace malicious source to guarantee cyber security for mass monitor
critical infrastructure. Journal of Computer and System Sciences, 98, pp.1-26.
Sayan, C., Hariri, S. and Ball, G., 2017, September. Cyber security assistant: Design overview.
In 2017 IEEE 2nd International Workshops on Foundations and Applications of Self*
Systems (FAS* W) (pp. 313-317). IEEE.
Sun, C.C., Hahn, A. and Liu, C.C., 2018. Cyber security of a power grid: State-of-the-
art. International Journal of Electrical Power & Energy Systems, 99, pp.45-56.
THOMAS, R.K. and et. al, 2019. System and method for modeling and analyzing the impact of
cyber-security events on cyber-physical systems. U.S. Patent 10,262,143.
11