Information Security, Cybersecurity and UAE Data Protection Essentials

Posted on Oct 23, 2026 in Business Administration and Innovation Management

Information Security

Information security is the practice of protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, and destruction.

  • Confidentiality: our ability to protect our data from those who are not authorized to view it.
  • Integrity: our ability to prevent our data from being changed in an unauthorized or undesirable manner.
  • Availability: our ability to access our data when we need it.

The Growing Importance of Information Security

  • Growing digital dependence
  • Rising cyber threats
  • AI-driven threats
  • Sensitive data at risk
  • Government and critical services targeted
  • Financial and operational impact

Information Security Policies, Procedures, and Standards

  • Policies: general rules explaining what employees are allowed and not allowed to do.
  • Procedures: step-by-step instructions explaining how employees perform a specific task correctly and securely.
  • Standards: defined requirements that organizations follow to maintain an appropriate level of information security and protect their information and systems.

UAE Cybercrime Laws: Development and Purpose

  • Prevent cybercrime
  • Protect individuals and organizations
  • Protect national security
  • Deter offenders
  • Build trust in the digital environment

Cybercrime laws protect people, information, systems, and national interests in the digital environment.

Forms of Information and Assets

Forms of information: written, electronic, or oral.

Assets: services, information, facilities, and programs.

Ways to Protect Information

  • Managerial: through rules, policies, and people management.
  • Technical: through technology and security systems.
  • Physical: protection from physical access, theft, or damage.

UAE Personal Data Protection Law

  • Controller: decides why and how personal data will be processed.
  • Processor: processes personal data on behalf of the Controller and follows its instructions.
  • DPO: monitors data protection compliance and helps the organization follow the law.

GDPR and GCI

GDPR = General Data Protection Regulation. GDPR is the European Union regulation that protects individuals and their personal data.

GCI means Global Cybersecurity Index and its pillars are:

  • Legal
  • Technical
  • Organizational
  • Cooperation
  • Capacity development

Concept of Cybersecurity

The term “cyber” comes from cybernetics, a term introduced in 1948 for the study of control and communication in machines and systems. Over time, “cyber” became associated with cyberspace, the digital world of computers, networks, systems, and data.

Cybersecurity is the protection of digital systems, networks, devices, and databases from cyberattacks, security breaches, and threats. It includes implementing measures and technologies to ensure the confidentiality, integrity, and availability of information and digital assets.

The Importance of Cybersecurity

  • Protection of personal data
  • Ensuring business continuity
  • Protection of critical infrastructure
  • Maintaining trust between companies and customers
  • Protecting individuals from extremist and harmful ideas

NIST Cybersecurity Framework (CSF)

The NIST CSF 2.0 consists of six interconnected core functions that help organizations manage cybersecurity risks, strengthen protection, respond to incidents, and recover from disruptions:

  • Govern: Establish cybersecurity policies, assign responsibilities, and oversee cybersecurity risks.
  • Identify: Identify the organization’s important assets, systems, data, and cybersecurity risks.
  • Protect: Implement security measures to protect systems and data from cyber threats.
  • Detect: Monitor systems to detect suspicious activities and potential cyberattacks.
  • Respond: Take appropriate actions to contain and manage cybersecurity incidents.
  • Recover: Restore affected systems and services after a cybersecurity incident.

Risk Management Process

  1. Identify assets
  2. Identify threats
  3. Assess vulnerabilities
  4. Assess risks
  5. Mitigate risks

Data Classification and Document Labeling Policy

  1. Public: This information could be freely disseminated, resulting in negligible impact. Examples are ICA internet website content, public reports, and job vacancies.
  2. Restricted: When unauthorized or accidental disclosure, alteration, or destruction of that information could result in an adverse impact on ICA, its stakeholders, partners, and customers. Examples are phone and email directories, service level agreements, and personal contact details.
  3. Confidential: When unauthorized disclosure, alteration, or destruction of that information could result in a serious impact on ICA. This classification applies to sensitive business information. Examples are salary-related information, employee records, and vendor contracts.
  4. Highly Confidential: When unauthorized disclosure, alteration, or destruction of that information could result in a catastrophic impact on ICA. Examples are unpublished strategic plans and proprietary information.