1 – 4 Participants in an ISMS

1. Board of Directors
2. Executive Staff
3. Management
4. Operation

5 – 8 Why ISMS is beneficial?

1. Defensible
2. Differentiator
3. Business Enabler
4. Structure

9 – 13 5 ways to prevent data breach

1. Use strong password

2. Use multi factor authentication
3. Keep software up-to-date
4. Use secure URL’s
5. Educate and Train Employees

14 – 17 COMMON TYPES OF TARGETED CYBERATTACKS

PHISHING ATTACK, MALWARE, VULNERABILITY EXPLOITS, DENIAL OF SERVICE

18 – 20 Causes of DATA BREACH

LOSS OR THEFT

INSIDER ATTACK

TARGETED ATTACK

21. An unintentional data breach occurs when a legitimate custodian of information such as an
employee loses or negligently uses corporate tools.

22. RA 10173 This Act shall be known as the “Data Privacy Act of 2012”.

23. DATA BREACH - Is an event that results in confidential, private, protected, or sensitive information
being exposed to a person not authorized to access it.

24. INTENTIONAL DATA BREACH - Occurs when a cyberattacker hacks into an individual’s or company’s
system for the purpose of accessing proprietary and personal information.

25. RA 10173 An act protecting individual personal information in information and communications
systems in the government and the private sector, creating for this purpose a national privacy
commission, and for other purposes.

26. risk assessment is a thorough look at your workplace to identify those things, situations, processes,
etc. that may cause harm, particularly to people. After identification is made, you analyze and evaluate
how likely and severe the risk is.
27 – 28 The processing of sensitive personal information and privileged information shall be prohibited,
except in the following cases: • The processing is necessary to protect the life and health of the data
subject or another person. • The processing is necessary for purposes of medical treatment.

29. Information security: Preservation of confidentiality, integrity, and availability of information.

30. Management system: Coordinated activities to direct and control an organization.

31. National Privacy Commission - • Ensure compliance of personal information controllers

• Issue cease and desist orders, impose a temporary or permanent ban on the processing of personal
information.

• Monitor the compliance of other government agencies or instrumentalities.

• Coordinate with other government agencies and the private sector on efforts.

• Provide assistance on matters relating to privacy or data protection.

• Generally perform such acts as may be necessary to facilitate cross-border enforcement of data
privacy protection

32. Information security management system (ISMS): Coordinated activities to direct and control
the preservation of confidentiality, integrity, and availability of information.

33 – 40. Why ISMS is important in an organization?