+55 (21) 3211-2223 
+1 (619) 860-6666 info@telcomanager.com
When we study information security there is an abbreviation that we find in several materials, the CIA (confidentiality, integrity and availability) or CID in Portuguese, which represents the confidentiality, integrity and availability triad. These three items are known as the pillars of security of information, in other words, they are of vital importance for guaranteeing the protection of the data and systems.
In the following there is the definition of each of the pillars according to the ISO 27001 which establishes the standardization for systems of management of information security.
Confidentiality – “Property that the information will not become available or being disclosed to individuals, entities or non-authorized processes”
Integrity – “Property of safeguard of accuracy and completeness of assets”
Availability – “Property of being accessible and usable on demand by an authorized entity”
SYSTEM OF MANAGEMENT OF INFORMATION SECURITY
The system of Information Security Management (ISM) concentrates all the strategies and controls for the maintenance and improvement of the security of information. In addition to seeking the adequate controls of security, the same provides greater confidence for stakeholders. In accordance to the ISO 27001 the structure of the ISM must be applied in the PDCA model.
Plan – Establishes and delimits the scope of the management system. Therefore, according to the characteristics of the business.
Do – Implementing what was established. Managing the operations connected to the ISM, implementing the controls and the plan for treatment of risks.
Check – To monitor and collect data for performing of an analysis for updating the plans of information security. To create metrics for verifying the controls and if all the requirements of security are being attended.
Act – Maintaining with the implementation of continuous improvement of the ISM. In this form, acting with preventive and corrective actions according to the assessment.
Management Of The Continuity Of The Business
Among the controls attributed to the ISM we can highlight the management of the continuity of the business relative to the information security. In this scenario, the continuity is connected to the non-interruption of the activities, protection of critical processes against failures and when necessary, the recovery with the greater agility possible.
In this sense it becomes necessary the implementation of the management of failures. The monitoring of the network through the protocol SNMP will allow the accompanying of the performance of assets and identifying those that present failures. With the SLAview, the administrator of the network will be able to configure alarms for notifying the teams responsible of all the occurrences that were relevant relative to the infrastructure. Besides notifying, the alarm will point the asset through which the occurrence originated.
The SLAview still allows the configuration of maps with a representation of all the network topology. With such resource, the monitoring team will be able to have a global vision of assets. In a way that if some of those are alarmed, the color of your icon in the map will be changed according to the level of urgency of the alarm.
Management Of Operations And Communications
Still inside the ISM, the management of operations have as a purpose the guaranteeing of correct and safe operations of all the resources of processing of data. For this, among other good practices recommended is the management of the capacity. With the intention of monitoring the utilization of the resources, to project future needs and guaranteeing the minimal acceptable performance. Utilized resources in an inappropriate manner must be restricted, mainly those that demand a lot of processing and are not critical to the business.
One of the mostly read articles in our blog is: https://www.telcomanager.com/blog/capacity-planning-desafio-do-gestor-de-ti/ which denotes the importance of such theme. The challenge is that beyond knowing when I should increase the capacity (through an upgrade or of the expansion of some link) is if the resources of my company are being utilized in a consistent form with my business.
The monitoring through the protocol NetFlow will allow a complete overview of the traffic of your network, being possible to stratify according to the origin, destiny and content. With the TRAFip it is possible to configure possible profiles of traffic for visualizing with details all the distribution of traffic of the network. The profiles will help in the identification of how the network is utilized according to the sectors of the company, subsidiaries or any other parameter that needs to be analyzed.
Besides profiles, the administrator of the network will be able to execute reports of projection for supporting predictive analysis and substantiate future decisions relative to increasing of capacity. Another important point that is worthy to be highlighted is the report of raw data, that can provide all the details about each bit that passes by your infrastructure, what can help, for example, in the investigation of the abnormal traffic or bad usage of the network.
FINAL CONSIDERATIONS
How to protect something without visibility? In this manner, protocols such as NetFlow and ISM in conjunction with the TRAFip and SLAview will be allied in this battle for the security of information.
In this sense, there are no doubts about the importance of investing in network management. Also, bringing not only benefits to the visibility of the infrastructure, but also a way to guarantee greater agility in the resolution of problems which could affect the availability of the network.
Thinking about that, Telcomanager, leader in Latin America in the sector of software for network management, since 2002 in the market with a unique and innovative methodology, makes available smart solutions for the monitoring of data in order to provide complete visibility to the infrastructure of the client, allowing your Company to accompany the main aspects of your network.
