Enterprise Information Security Strategy: Monitoring and Management

The security of an economic entity’s information and the infrastructure that supports it remains one of the key challenges at the current stage of economic relations. Unauthorized access to information, accidental or malicious impacts on information, and third-party intrusion into the operation of the supporting infrastructure threaten to reduce economic benefits and cause damage to economic entities, both legal entities and individuals. Under these conditions, one of the tasks of an organization’s economic security service is to prevent threats and mitigate risks related to unauthorized access to sensitive and financial information about the enterprise and to employees’ personal data. The objective of the study is to develop methodological recommendations for organizing the process of managing enterprise information security risks. In the course of the study, the authors obtained the following scientific results: the elements of information security (information protection, access restriction, encryption, security system, two-factor authentication, information transfer, document forgery, verification of the vulnerability of the information source, and information authenticity) were examined comparatively, considering both their current state and their historical development; information on participants involved in information theft and methods of unauthorized access was systematized; factors limiting compliance with personal data protection principles were analyzed; and information security risks were systematized in the context of object-vulnerability-threat. The practical significance of the research results lies in the possibility of integrating them into an organization’s management system and developing an internal control system to minimize threats and mitigate the risks of unauthorized access to sensitive and financial information and employees’ personal data.