Protection against spyware

Information security is the state of protection of information in which its confidentiality, integrity and availability are ensured.

Personal data is any information relating, directly or indirectly, to a certain or definable natural person (subject of personal data). That is, if the information can be used to identify the individual to whom it relates, such information is personal data. For example, such information as name, surname, patronymic and year of birth are personal data, as they allow to identify a specific person. The requirements for the protection of personal data are reflected in the Federal Law “On Personal Data” No. 152-FL and other regulatory and legal documents.

Information security protection tools

Information protection means – technical, software, software and hardware means designed or used to protect information.

Protection means can be classified according to the following categories:

• by realized security functions: means of protection against unauthorized access, means of anti-virus protection, means of intrusion detection, firewalls, etc…;
• by binding to the hardware platform: software, hardware, hardware-software;
• by location (level) of installation: operating system level, host level, local network level, at the network boundary, etc.

Information security audit and personal data audit

In order for an organization to understand what measures need to be taken to protect the information being processed or to determine the sufficiency of the protection measures already in place, a company needs to conduct an information security audit.

An information security audit is an assessment of the compliance of the processing of protected information with the requirements of current legislation, conducted by an external organization. If we talk about auditing the information security of personal data, then in this case it is necessary to assess the compliance of the personal data protection system with the requirements of regulators.

In accordance with the requirements of the 152-FZ, a personal data operator is obliged to take measures necessary and sufficient to fulfill the obligations stipulated by the law, including internal control or audit of compliance of personal data processing with the federal law and regulatory legal acts adopted in accordance with it, personal data protection requirements, the operator’s policy with regard to personal data processing, and the operator’s local acts.

If the organization can perform the audit in terms of organizational measures and availability of the necessary documentation by itself or seek assistance from expert companies, the audit in terms of implementation of technical measures stipulated by the requirements of RF Regulation No. 1119, Order of the FSTEC of Russia No. 21, Order of the FSB No. 378 (if necessary) should be performed with the involvement of organizations licensed by the FSTEC of Russia for the relevant type of activity (FSB of Russia).