Digital

March 2017, France slowly enters the presidential election campaign. Candidates and voters pour their hearts out on the Internet. And now a controversy is swirling: some candidates’ websites have been hacked, or at least monitored. Two months earlier, similar rumors were circulating on the Web about the American presidential election. Also in the USA, a connected teddy bear made headlines in early March, when it was discovered that 800,000 user accounts for these stuffed animals had been hacked, enabling parents and children to send messages to each other via a telephone application, through the teddy bear. And these messages find their way onto the Web… All this illustrates the extent to which malice and piracy have taken hold on the Internet. To paralyze these companies, cybercriminals have opted for DDoS(distributed denial of service), an attack classified as an advanced persistent threat(APT, read here). The principle: flood a computer server with mounds of incomprehensible requests, clogging up its response capabilities. As a result, customers no longer have access to the various services. What’s striking is the scale of the attack, multiplied tenfold by the use of a network of so-called “zombie” or “botnet” machines, specifically targeting connected objects, which lack the security required to fend off these assaults. Today, ever greater dangers (social engineering, internal attacks, etc.) threaten both public and private organizations, using increasingly sophisticated means. Added to the blow to the credibility of an entity victimized by such a charge is the exorbitant cost of the necessary repairs. For example, following a monstrous hack suffered in 2015, the TV5Monde group had to spend more than 4.5 million euros to plug the breaches and devote 2.5 million euros each year to its security. With their limited resources, SMEs are increasingly targeted(see figures here), and pay a heavy price in the event of an attack. Best practices As François Lorek, who has been an auditor for AFNOR Certification since 2008, points out, “. Information security is broader than IT security, which is linked solely to resources, and looks at the problem as a whole in relation to the value of information, whether oral, paper or electronic. It concerns all entities, and particularly those holding sensitive assets such as third-party data, for example healthcare or banking data. In addition to this need for confidentiality, they must also ensure the availability and continuity of their systems, such as the cloud or e-mail, as well as their integrity: saved data must not be able to be erased or overwritten. “. Information security, which has become a business of fear, requires the deployment of multiple, effective means. First of all, you need to look after your e-reputation. ” It’s all about anticipating risks by mapping them and using measurement and monitoring tools. An organization’s reputation is often built on the opinions expressed online about it, its products, and so on. Our NF Z74-501 standard, currently being transposed to ISO, ensures the reliability of consumer opinion processing. And our guide FD Z 74-510 on e-reputation management lists a number of best practices, ” explains Sylvie Arbouy, project manager at AFNOR Normalisation. Because of the high stakes involved, some opt for a specific approach known as privacy by design, or taking privacy into account right from the design stage of a system or practice. ” Today, even the slightest piece of information can be used to profile individuals and, in some cases, maliciously harm their interests. Visit privacy by design guarantees end-to-end security during the design process for the entire data retention period. Impossible to invade users’ privacy “explains Frédéric Solbès, project manager at AFNOR Normalisation. E-REPUTATION Buy the “Online reputation management” guide Computer hygiene An increasingly precise arsenal of regulations and standards covers the issue of information security. For example, European Regulation 2016/679 on the protection of personal data, published in June 2016, will come into force in mid-2018. It focuses on information security to guarantee confidentiality, integrity and the absence of data leakage, etc. ” The European eIDAS regulation, in force since July 2016, covers digital identity and the security of electronic transactions,” adds Benoît Pellan, digital product manager at AFNOR Certification. It is the ANSSI (Agence nationale de la sécurité des systèmes d’information) that qualifies electronic signature and electronic seal certificate issuance services, following an audit. We will also be auditing the first certified health data hosts in accordance with the procedures defined in the order of January 12, a text stemming from the law of January 24, 2016 on the modernization of our healthcare...

Digital

AFNOR information on personal data protection and ISO 27001-style information security management to ward off cyber-attacks.

Cybersecurity: vigilance is the order of the day!

Join the BIM revolution!

AFNOR and INPI, working together for business development

European voluntary standardization 2016: accessibility, environment and smart technologies in the spotlight

French standard NF Z42-013 on electronic archiving transposed into an international standard by ISO

Business sites

Useful links

For security reasons, our emails are hidden.
To display them, complete the captcha below

Digital

AFNOR information on personal data protection and ISO 27001-style information security management to ward off cyber-attacks.

Cybersecurity: vigilance is the order of the day!

Join the BIM revolution!

AFNOR and INPI, working together for business development

European voluntary standardization 2016: accessibility, environment and smart technologies in the spotlight

French standard NF Z42-013 on electronic archiving transposed into an international standard by ISO

Business sites

Useful links

For security reasons, our emails are hidden. To display them, complete the captcha below

For security reasons, our emails are hidden.
To display them, complete the captcha below