SECURITY CONCEPT: SO TEST THEREFORE, WHO JOIN FOREVER
So test therefore, who join forever, if heart to heart be found together! Delusion is short, remorse is long.
Friedrich Schiller already knew the methods of a considered and structured procedure before entering into a connection. Exactly this consideration must also be made before a new IT system establishes connections.
A written security concept (SiKo) is the continuation of the structured procedure of an ISMS.
The aim of a security concept is to identify risks and threats and to define appropriate security measures. The residual risks are determined and accepted by the responsible persons.
A security concept defined in writing is the continuation of the structured procedure of an ISMS.
In the IT environment, a security concept means classifying the data processed on the system before each new system is put into operation and then taking the necessary measures. The scope of the concept depends strongly on the criticality of the processed data and the complexity of the systems used. Often, the SiKo is defined directly from the minimum security measures for IT systems, which may have to be extended by higher-level security measures.
A security concept in its minimal form consists of:
- Inventory and structural analysis of the processed data and involved systems
- Implementation of a protection needs assessment
- Recording the hazards and evaluating them
- Definition of the necessary measures
- Evaluation and documentation of residual risks
The aim of the SiKo is to protect the processed data and to ensure the traceability of the implemented technical and organizational measures. The required level of security should be maintained throughout the service life of a system.
SEC4YOU gladly supports the creation of security concepts. During this process, all points of the minimal form are worked out and documented in a structured way.
The data protection concept in the context of the GDPR
A data protection concept (DSK) — even if it is called a “protection” concept — will not protect the processed data, but aims to protect the rights of the data subjects. In the course of the GDPR, the importance of creating a DSK increases, as this is the only way to ensure that the necessary data protection measures are defined and effective in all areas.
The responsibility for creating a DSK lies with the service manager and not with the data protection officer, since the data protection officer usually only has to create the structures, but is not directly responsible for all applications.
The following specifications are defined in a DSK:
- Definition of the specifications for the collection, processing and use of personal data
- Definition of the measures to primarily prevent the misuse of personal data and to ensure compliance with the requirements of the data protection act
The DSK of an application defines the target state that is to be documented in the course of the DSGVO.
The aim of the DSK is to fulfill the requirements of the Data Protection Act by protecting the personal rights of the data subjects and to describe the technical and organizational measures required for this purpose.
When implementing DSK, SEC4YOU uses the measures developed in the security concept and extends them with specific data protection measures.
YOUR ADVANTAGES
- A security concept is a structured procedure before the introduction of a new service
- Identifies the risks and threats and defines appropriate security measures for them
- Defines the required level of security over the entire service life
- A data protection concept is designed to protect the rights of data subjects, not the data being processed
Questions about security concepts and data protection concepts?
You would like to talk to an expert?