Connecting linkedin


Montash Blog: Governance risk compliance – The role of information security

16/04/2015 by


Information security is no longer just a concern for the IT department. Insider threats, cryptography, threat vulnerabilities and public key infrastructure are just several of the activities that impact the ability of a business to adopt an effective governance risk compliance strategy. Modern businesses need to juggle data protection legislation, mitigate threats from inside and outside influences and inspect, record, destruct and account for every piece of data – all while ensuring business continuity is not affected.

Insider threats

Insider threats can pose a risk to the realisation of a modern organisation's objectives, so it is important that they are managed effectively – especially when personal issues arise. Staff reductions and performance plans can result in information security problems as disgruntled employees attempt to remotely access the computer system. Ensuring that legal, IT and human resources departments work in tandem to create a plan for communicating personal information can mitigate these security issues.

For example, HR will be the first to know about pending personnel changes and other sensitive information, so is it is vitally important that they notify the IT department about an elevated risk. This communication will ensure the company is vigilant about insider threats, which improves risk management as the threats are known and accounted for.

Cryptography and PKI

Cryptography and public key infrastructures are central to compliance strategies. The UK Data Protection Act states that SMEs and big corporations must know where their data is being processed and stored. Breaching these laws can have devastating consequences and result in lasting damage to a business’ reputation and huge fines. Public key infrastructure (PKI) provides the standards, protocols and a framework to deploy an information security system that works and is flexible to change. Certificates and certificate authorities are central to cryptography as they ensure that users on a network are genuine. Service providers such as Oracle can also deliver several default-trusted certificates. PKI enables delegated trust and improves information security across a business.

Threat vulnerabilities

Testing for threat vulnerabilities is an important information security process. Security flaws allow erroneous third parties to make a successful attack, so testing will improve a firm's ability to respond effectively in real time as dangers arise. It is also a core governance risk compliance strategy as it is invaluable for technology and policy development. Selecting the right technology will save both time and money and improve business-wide decision-making. The threat landscape is constantly in flux and open source code commonly used in an organisation's applications poses greater risks. Keeping track of these vulnerabilities through a proactive approach will reduce these operational risks.

This article has been written by John Winfield - Information Security Consultant,if you have any questions or would like a detailed discussion about your Information Security recruitment requirements for 2015, please contact John Winfield on: +44 (0)20 7014 0230 or send an email to

Montash is a multi-award winning global technology recruitment business. Specialising in permanent and contract positions across mid-senior appointments across a wide range of industry sectors and IT functions, including:

ERP Recruitment, BI & Data Recruitment, Information Security Recruitment, IT Architecture & Strategy Recruitment , Energy Technology Recruitment, Demand IT and Business Engagement Recruitment, Digital and E-commerce Recruitment, Leadership Talent, Infrastructure and Service Delivery Recruitment, Project and Programme Delivery Recruitment.

Montash is headquartered in Old Street, London, in the heart of the technology hub. Montash has completed assignments in over 30 countries and has appointed technical professionals from board level to senior and mid management in permanent and contract roles.


Latest Blogs