Search

Настоящая статья посвящена вопросам защищенности информационных систем и, в частности, построению и исследованию модели управления рисками информационной безопасности, при которой учитывается накопление ущерба от происходящих инцидентов. Предполагается, что в случайные дискретные моменты времени в информационной системе происходят инциденты, приводящие к нарушению информационной безопасности: компьютерные атаки, сбой в работе, нарушение правил эксплуатации и тому подобное. Каждый инцидент сопровождается ущербом. Определяется множество возможных вариантов величины ущерба при появлении инцидентов. Средства защиты информационной системы реагируют на инциденты, и возможные действия могут осуществляться по нескольким сценариям. Один из возможных вариантов сценария состоит в последовательном сравнении величин ущерба при возникновении очередного инцидента с максимально допустимой величиной ущерба. В случае если величина ущерба, причиненного инцидентом, независимо от других инцидентов, не превышает установленную границу, система продолжает работу в штатном режиме. В противном случае производится корректировка политики безопасности, введение дополнительных защитных мер и другие аналогичные мероприятия. Во втором варианте сценария при возникновении инцидентов производится последовательное суммирование значений соответствующих ущербов и последующее сравнение значения суммы с максимально допустимой величиной ущерба. Если при появлении очередного инцидента суммарный ущерб не превышает максимального значения, информационная система продолжает работу в штатном режиме. В противном случае, аналогично первому сценарию, делается вывод о недостаточной защищенности системы и необходимости корректировки политики безопасности, в частности, введении дополнительных мер защиты. На основании построенных моделей предложена процедура оценки риска нарушения информационной безопасности и найдено вероятностное распределение времени безопасной работы информационной системы. В качестве иллюстрации предложенного подхода построены экспериментальные модели количества несанкционированных операций со счетами юридических лиц и количества несанкционированных операций с использованием платежных карт. Указанные модели основаны на анализе реальных инцидентов и строятся с применением разработанных ранее методов прогнозирования в виде непрерывной аппроксимирующей функции., This article is devoted to the issues of security of information systems and, in particular, to the construction and study of the information security risk management model, which takes into account the accumulation of damage from incidents. It is assumed that at random discrete moments in the information system, incidents occur that lead to a violation of information security: computer attacks, malfunction, violation of operating rules, and the like. Every incident comes with damage. The set of possible options for the magnitude of damage in the event of incidents is determined. Information system protection tools react to incidents, and possible actions can be carried out according to several scenarios. One of the possible variants of the scenario consists in sequential comparison of the values of damage in the event of the next incident with the maximum allowable amount of damage. In the event that the amount of damage caused by the incident, regardless of other incidents, does not exceed the established limit, the system continues to work as usual. Otherwise, the security policy is adjusted, additional protective measures are introduced and other similar measures. In the second variant of the scenario, when incidents occur, the values of the corresponding damages are sequentially summed up and then the value of the sum is compared with the maximum allowable amount of damage. If, when the next incident occurs, the total damage does not exceed the maximum value, the information system continues to work in normal mode. Otherwise, similar to the first scenario, it is concluded that the system is insuffi ciently protected and the need to adjust the security policy, in particular, the introduction of additional protection measures. On the basis of the constructed models, a procedure for assessing the risk of information security breach is proposed and a probabilistic distribution of the time of safe operation of the information system is found. As an illustration of the proposed approach, experimental models of the number of unauthorized transactions with the accounts of legal entities and the number of unauthorized transactions using payment cards are constructed. These models are based on the analysis of real incidents and are built using previously developed forecasting methods in the form of a continuous approximating function., Промышленные АСУ и контроллеры, Выпуск 8 2021

Risk management is today a major steering tool for any organisation wanting to deal with information system (IS) security. However, IS security risk management (ISSRM) remains a difficult process to establish and maintain, mainly in a context of multi-regulations with complex and inter-connected IS. We claim that a connection with enterprise architecture management (EAM) contributes to deal with these issues. A first step towards a better integration of both domains is to define an integrated EAM-ISSRM conceptual model. This paper is about the elaboration and validation of this model. To do so, we improve an existing ISSRM domain model, i.e. a conceptual model depicting the domain of ISSRM, with the concepts of EAM. The validation of the EAM-ISSRM integrated model is then performed with the help of a validation group assessing the utility and usability of the model.

I den tidiga IT-historien utgick data från att endast kunna angripas genom att befinna sig på fysisk plats för att kunna genomföra ett intrång och tillförskaffa sig data eller information. I äldre actionfilmer syns ofta någon rysk eller amerikansk spion som överför data från en fysisk dator till en lika fysisk disk. I takt med den ökade globaliseringen finns också ett ökat behov av tillgång till data och information på olika platser samt på olika sätt. För att tillfredsställa ett ökande behov av tillgänglighet och rörlighet har IT-världen fått skapa nya lösningar vilka uppfyller det behovet. Första steget var i och med införandet av internet och numera med nya olika molnlösningar tillgängliga för företag, privatpersoner och även angripare via internet. Moderna tekniker frambringar också i princip alltid nya risker och hot. Där det tidigare i mänskligheten användes lås för dörrar, måste nu beaktning tas där vilken typ av kryptering, virusskydd och andra åtgärder krävs för att skydda privat information. Cloud Computing och användningen av molntjänster som Software as a Service (SaaS), Plattform as a Service (PaaS) och Infrastructure as a Service (IaaS) fortsätter att öka vilket kan bidrar med många fördelar för företag (Balco, Drahošová & Law, 2017; Basishtha & Boruah, 2013; SCB, 2018; Sultan, 2011; Shahzad, 2014). Dock ger inte en flytt av data, från marken upp till molnet, en garanti för säkerhet eftersom molnets tillgänglighet och förflyttning av data utanför företagets gränser ställer frågor kring informationssäkerheten och kommer med många utmaningar samt risker (Kavitha & Subashini, 2011; Dorey & Leite, 2011). I och med utökad globalitet borde det väl vara passande att data lagras på olika platser i världen. Men hur säkert är det egentligen när ett företag baserat i exempelvis Finland har viktig data lagrad på andra sidan jordklotet? Eftersom ”Molnet” fortsätter att öka finns ett behov att undersöka hur, var och när användning av molnet kan bidra till att öka informationssäkerheten samt även varför och under vilka omständigheter. Studien kommer fokusera på användningen kring informationssäkerheten inom SaaS och vilka aspekter som påverkar om företag kan tillförskaffa ökad informationssäkerhet. SaaS har valts ut då molntjänsten är mest frekvent förekommen inom företag. Studiens rapport är uppbyggd på följande sätt: kapitel två tar upp relevanta begrepp samt bakgrund till ämnet. Därefter i kapitel tre beskrivs problemområdet samt rapportens syfte och frågeställning. I kapitel fyra presenteras studiens vetenskapliga metod vilken har använts för att samla in och analysera data. I kapitel fem presenteras analysen av arbetet vilket har lett fram till kapitel sex slutmodell. Slutligen följer en diskussion kring studien.

Information systems security (ISS) behavioral research has produced different models to explain security policy compliance. This paper (1) reviews 11 theories that have served the majority of previous information security behavior models, (2) empirically compares these theories (Study 1), (3) proposes a unified model, called the unified model of information security policy compliance (UMISPC), which integrates elements across these extant theories, and (4) empirically tests the UMISPC in a new study (Study 2), which provided preliminary empirical support for the model. The 11 theories reviewed are (1) the theory of reasoned action, (2) neutralization techniques, (3) the health belief model, (4) the theory of planned behavior, (5) the theory of interpersonal behavior, (6) the protection motivation theory, (7) the extended protection motivation theory, (8) deterrence theory and rational choice theory, (9) the theory of self-regulation, (10) the extended parallel processing model, and (11) the control balance theory. The UMISPC is an initial step toward empirically examining the extent to which the existing models have similar and different constructs. Future research is needed to examine to what extent the UMISPC can explain different types of ISS behaviors (or intentions thereof). Such studies will determine the extent to which the UMISPC needs to be revised to account for different types of ISS policy violations and the extent to which the UMISPC is generalizable beyond the three types of ISS violations we examined. Finally, the UMISPC is intended to inspire future ISS research to further theorize and empirically demonstrate the important differences between rival theories in the ISS context that are not captured by current measures. peerReviewed

Firms should disclose information on material cyber-attacks. However, because managers have incentives to withhold negative information, and investors cannot discover most cyber-attacks independently, firms may underreport them. Using data on cyber-attacks that firms voluntarily disclosed, and those that were withheld and later discovered by sources outside the firm, we estimate the extent to which firms withhold information on cyber-attacks. We find withheld cyber-attacks are associated with a decline of approximately 3.6% in equity values in the month the attack is discovered, and disclosed attacks with a substantially lower decline of 0.7%. The evidence is consistent with managers not disclosing negative information below a certain threshold and withholding information on the more severe attacks. Using the market reactions to withheld and disclosed attacks, we estimate that managers disclose information on cyber-attacks when investors already suspect a high likelihood (40%) of an attack.

New information technologies alongside their benefits also bring new dangers with themselves. It is difficult to decide which authentication tool to use and implement in the information systems and electronic documents. The final decision has to compromise among the facts that it faces several conflicting requirements: highly secure tool, to be a user-friendly and user simplicity method, ensure protection against errors and failures of users, speed of authentication and provide these features for a reasonable price. Even when the compromised solution is found it has to fulfill the given technology standards. For the listed reasons the paper argues one of the most natural biometric authentication method the dynamic biometric signature and lists its related standards. The paper also includes measurement evaluation which solves the independence between the person’s signature and device on which it was created.

Information systems are frequently exposed to various types of threats which can cause different types of damages that might lead to significant financial losses. Information security damages can range from small losses to entire information system destruction. The effects of various threats vary considerably: some affect the confidentiality or integrity of data while others affect the availability of a system. Currently, organizations are struggling to understand what the threats to their information assets are and how to obtain the necessary means to combat them which continues to pose a challenge. To improve our understanding of security threats, we propose a security threat classification model which allows us to study the threats class impact instead of a threat impact as a threat varies over time. This paper addresses different criteria of information system security risks classification and gives a review of most threats classification models. We define a hybrid model for information system security threat classification in order to propose a classification architecture that supports all threat classification principles and helps organizations implement their information security strategies.

Data recovery is a significant problem that presents a real challenge to forensics investigators today. File carvers have traditionally helped mitigate these difficulties. However, two issues still present significant challenges – 1) Prior knowledge of file types is required for building file carvers, and 2) fragmentation prevents file carvers from successful recovery. In previous research, we proposed a framework for recovering deleted files without prior knowledge of file types and with the existence of fragmentation. In this paper, we introduce the design and a functioning implementation of our system by modifying an exFat filesystem running on top of FUSE. Evaluation of the overhead of our filesystem shows only a 5% decrease in performance in write operations when compared to an unmodified exFat filesystem, and almost identical read measurements. Our system also shows significantly better recovery rates in the presence of fragmentation when compared to two selected file carvers.

For the e-VRE being developed by the VRE4EIC project, the security, privacy and trust requirements significantly vary amongst the potential end-users from various research domains and public. In deliverable D5.1, the VRE4EIC project has defined the strategies handling potential issues and risks regarding security, privacy and trust aspects. However, these strategies are mainly produced to help the technical developers better design the e-VRE and choose appropriate technologies for the implementation of the e-VRE. We assume that most of the potential end-users will have limited ICT knowledge so that they may have a different understanding or interpretation regarding these strategies to deal with security, privacy and trust related issues. In order to help our potential end- users understand the logic and consideration of the strategies developed in D5.1, this deliverable clarifies these strategies in the early stage of e-VRE development. The user is a global actor representing any user accessing the e-VRE (according to its definition, "VRE users" only concern people that want to access research data). This approach will also help the engagement of potential end-users. After implementing an e-VRE prototype that will be tested by user groups, a second version of this deliverable will be completed in Month 33 (D5.4). Upon acceptance of this strategy document, it will be made publicly available and especially distributed to target users of the existing e-RI initiatives and VRE-related initiatives.

Darbo tikslas - pagerinti sukurtos daiktų interneto informacinės sistemos saugumą, aptinkant įsilaužėlių atakas ir pritaikant apsaugos priemones. Daiktų interneto viena iš pagrindinių sudedamųjų dalių yra informacinė sistema, kuri apdoroja sukauptus duomenis. Viena iš iškylančių problemų kuriant tokias sistemas yra duomenų perdavimo ir saugojimo saugumas. Daiktų interneto informacinė sistema turi užtikrinti tris pagrindines saugumo funkcijas, tokias kaip: duomenų konfidencialumą, vientisumą ir prieinamumą. Realizuotoje daiktų interneto informacinėje sistemoje pagerinu išmaniojo įrenginio autorizavimo metodą bei pritaikau perduodamų ir talpinamų duomenų šifravimo algoritmą. Taip pat realizuoju įrenginio blokavimo ir atakų aptikimo metodus. Realizuoti metodai gali būti pritaikomi visiems, tirtą belaidį duomenų perdavimo protokolą palaikantiems įrenginiams, nepakeičiant standarto specifikacijų. Tai užtikrina sistemos suderinamumą su visais šią technologiją palaikančiais įrenginiais., The goal of this work is to improve the internet of things information system security by detecting hacker attacks and applying security measures. One of the key components of internet of things is an information system, which processes the collected data. Data transmission and storage security is one of the problems facing the development of such systems. Information system of internet of things must guarantee the three key security features: data confidentiality, integrity and availability. In established internet of things information system it was improved smart device authentication method and applied cryptographic algorithm for the transferred and stored data. It was also implemented device blocking and attack detection methods. Researched methods can be applied to all devices which support tested wireless data transmission protocol, without changing standard specification. This ensures that the system will be compatible with all of this technology enabled devices.

Informacije so postale zelo pomemben dejavnik in temeljni vir v organizaciji. Za uspešno poslovanje podjetja je pomembno obdelava in varovanje informacij, s katerimi podjetje razpolaga. Pri varovanju informacij je pomembno, da te ohranjajo celovitost, zaupnost in razpoložljivost. Če informacije pridejo v napačne roke, ima lahko to resne posledice za podjetje in njegovo poslovanje. Pomembno je, da se nevarnosti zavedajo tako vodstvo kot zaposleni v podjetju. Varnostna politika tako predstavlja nekakšna pravila in pomoč zato, da bi se izognili incidentom in bi se posledice zmanjšale. Je dokument, na katerem lahko razvijemo učinkovit in celovit program informacijske varnosti v podjetju. V diplomski nalogi sem opisal teoretične osnove s področja informacijske varnosti in določenih standardov, ki so najbolj uveljavljeni za varovanje informacij. Izdelava varnostne politike je kompleksen postopek, ki poteka v več fazah. Tako smo upoštevali vse faze in izdelali varnostno politiko za specifično podjetje. Information has become a significant factor and a primary source in any organization. A successful business depends upon the processing and security of information at its disposal, which must remain integral, confidential and available at all times. If the information falls into the wrong hands, a company and its business activities may be confronted by serious consequences. Both management and employees should be aware of such risks. Security policy thus represents the rules and guidelines on how to avoid incidents, or at least, how to minimize the consequences. It has a form of a document, on which effective and comprehensive programme of company's information security policy is based. This thesis describes the theoretical foundations for information security and its established standards. Developing security policy is a complex process that takes place in several stages. In formulating a security policy for a specific company, we considered all of them.

Managing the vast quantities of data generated in the context of information system security becomes more difficult every day. Visualisation tools are a solution to help face this challenge. They represent large quantities of data in a synthetic and often aesthetic way to help understand and manipulate them. In this document, we first present a classification of security visualisation tools according to each of their objectives. These can be one of three: monitoring (following events in real time to identify attacks as early as possible), analysis (the exploration and manipulation a posteriori of a an important quantity of data to discover important events) or reporting (representation a posteriori of known information in a clear and synthetic fashion to help communication and transmission). We then present ELVis, a tool capable of representing security events from various sources coherently. ELVis automatically proposes appropriate representations in function of the type of information (time, IP address, port, data volume, etc.). In addition, ELVis can be extended to accept new sources of data. Lastly, we present CORGI, an successor to ELVIS which allows the simultaneous manipulation of multiple sources of data to correlate them. With the help of CORGI, it is possible to filter security events from a datasource by multiple criteria, which facilitates following events on the currently analysed information systems., Il est aujourd'hui de plus en plus difficile de gérer les énormes quantités de données générées dans le cadre de la sécurité des systèmes. Les outils de visualisation sont une piste pour faire face à ce défi. Ils représentent de manière synthétique et souvent esthétique de grandes quantités de données et d'événements de sécurité pour en faciliter la compréhension et la manipulation. Dans ce document, nous présentons tout d'abord une classification des outils de visualisation pour la sécurité en fonction de leurs objectifs respectifs. Ceux-ci peuvent être de trois ordres : monitoring (c'est à dire suivi en temps réel des événements pour identifier au plus tôt les attaques alors qu'elles se déroulent), exploration (parcours et manipulation a posteriori d'une quantité importante de données pour découvrir les événements importants) ou reporting (représentation a posteriori d'informations déjà connues de manière claire et synthétique pour en faciliter la communication et la transmission). Ensuite, nous présentons ELVis, un outil capable de représenter de manière cohérente des évènements de sécurité issus de sources variées. ELVis propose automatiquement des représentations appropriées en fonction du type des données (temps, adresse IP, port, volume de données, etc.). De plus, ELVis peut être étendu pour accepter de nouvelles sources de données. Enfin, nous présentons CORGI, une extension d'ELVIs permettant de manipuler simultanément plusieurs sources de données pour les corréler. A l'aide de CORGI, il est possible de filtrer les évènements de sécurité provenant d'une source de données en fonction de critères résultant de l'analyse des évènements de sécurité d'une autre source de données, facilitant ainsi le suivi des évènements sur le système d'information en cours d'analyse.

This theses concerns with social engineering and defense against it. Social engineering attacks represents significant threat for organizations and their information systems, especially because they target weakest link in information systems security, its users. That way attacker can easily bypass even highly sophisticated security system. This theses tries to deal with question, how to effectively secure human factor of information system.

International audience; This communication may be intended as an exploratory research with a managerial perspective. We will investigate local authorities facing information system security issues. We aim to propose alternative theoretical framework in order to complement regular methods used in public administrations. Through six perspectives we will propose managerial advices which may be implemented in information system security projects; Cette communication peut être entendue comme une recherche exploratoire en cours à visée managériale. Elle porte sur le domaine des collectivités locales intégrant toujours plus d’applications numériques et ainsi confrontées à un nombre croissant de risques « cyber ».Dans ce cadre, cette communication a pour but de proposer des cadres théoriques venant enrichir l’approche classique rationnelle prévalant dans les méthodes de sécurité des systèmes d’information les plus courantes et mise en œuvre dans les organisations publiques. Au travers de six angles d’approches nous proposons des recommandations managériales simples et susceptibles d’être prise en compte dans des projets de SSI.

Raziskava obravnava predlog za uvedbo skupinskih politik v veliko podjetje. Predstavili smo teoretična izhodišča s področja skupinskih politik. Opisali smo tako osnovno delovanje skupinskih politik kot tudi varnostne nastavitve, ki bistveno vplivajo na povečanje informacijske varnosti. Predstavljene so dobre prakse in priporočila pri vpeljavi skupinskih politik v veliko podjetje. Dobre prakse se nanašajo na samo pripravo okolja za vpeljavo skupinskih politik in tudi na specifične nastavitve posameznih skupinskih politik. Izdelali smo predlog za odvzem administratorskih pravic, pripravo testnega okolja, pripravo skupin uporabnikov in predlog strukture organizacijskih enot v aktivnem imeniku. Predvideni učinki uvedbe skupinskih politik v veliko podjetje so predvsem povečanje varnosti informacijskega sistema, poenostavitev upravljanja, skrajšanje časa za upravljanje, zmanjšanje števila napak in večja preglednost nastavitev informacijskega sistema. The master's thesis presents a proposal for the group policy introdution in a large company. We have presented the theoretical basis regardings the group policy. We have described the basic group policy operations as well as the security settings, which can significant impact on the increase of information security. We have described the best practices for the group policy implementation to the large company. Best practices relate to the environment preparation for the group policy implementation as well as to specific settings for a individual group policy. We have prepared a poposal for the administrator rights removal, preparation of user groups, and we have proposed a structure of organizational units in the active directory. The focus of proposal was on the security settings. We have shown that the successful implementation of the group policy significantly increase the level of information security in the enterprise. Other expected impacts of introducing the group policy in a large company are mainly the following: simplified and less time consuming management, less system errors, and better transparency of information system settings.

V nalogi je predstavljena problematika varovanja lokalnega omrežja banke, ki je pomemben del informacijskega sistema (v nadaljevanju IS) banke. Varno lokalno omrežje je pomembno za varen IS. Prvi dve poglavji opisujeta nevarnosti, ki ogrožajo IS. V teh poglavjih so obravnavane nevarnosti, ki grozijo sodobnim IS, in načini varovanja IS. Sledi opis sistema AAA kot enega ključnih elementov, ki omogočajo varovanje lokalnega omrežja iz notranjosti omrežja. Opisani sistem služi kot osnova za izgradnjo varnega lokalnega omrežja obravnavane banke. Naslednje poglavje je usmerjeno v razvoj rešitve v obravnavani banki. Izpostavljene so nevarnosti, ki ogrožajo lokalno omrežje banke in s tem tudi IS. Opisana je rešitev sistema za varovanje lokalnega omrežja v obravnavani banki z avtomatiziranimi sodobnimi varnostnimi mehanizmi. Opisu rešitve je dodana tudi kratka analiza ekonomske upravičenosti predlaganega modela. V zaključku so iz primera povzete sklepne ugotovitve implementirane rešitve za varovanje IS banke, podana pa je tudi splošna ocena ustreznosti izbrane rešitve. The thesis discusses problems regarding the security of a local area network in a bank, which is an important part of the IS (information system) of a bank. A secure local area network is important for a secure IS. The first two chapters describe risks that are threatening the information system’s security in general. They discuss risks that threaten the contemporary IS and ways to secure the IS. This is followed by a description of the system for checking genuineness as one of the key elements which enable protection of the local area network from inside of the network. The described system serves as a basis for building a secure local area network of the discussed bank. The next chapter is directed towards the development of a solution in the discussed bank. Highlighted are risks that threaten the bank’s local area network and consequently the IS. Described is a system solution to protect the local area network of the discussed bank with automated safety mechanisms. A short analysis of the economic viability of the proposed model is added to the description of the solution. The conclusion summarizes the final finding of the implemented solution for securing the bank’s IS, followed by a general evaluation of the solution’s adequacy.

Namen magistrskega dela je prikazati, kako lahko s pomočjo napotkov standarda ISO/IEC 27003 in z uporabo računalniških orodij za projektno vodenje izdelamo plan vpeljave SUIV za določeno organizacijo. V teoretičnemu delu smo prikazali osnove s področja varnosti informacijskega sistema. Predstavili smo družino standardov ISO 27000 in druge standarde, ki služijo kot osnova pri vpeljavi sistema za upravljanje informacijske varnosti (SUIV) v organizacijo in so v praksi največkrat uporabljeni. Prikazane so bile tudi osnove s področja projektnega dela. V aplikativnem delu smo podrobno predstavili model planiranja SUIV po standardu ISO/IEC 27003. V nadaljevanju smo ta model uporabili pri izdelavi plana vpeljave SUIV v podjetje Alpina, d.o.o. Za izdelavo podrobnega projektnega plana smo uporabili dve računalniški orodji, projektni sistem PROSIS in program Microsoft Project. V zaključku smo pokazali, kaj smo z izdelanim projektnim planom dosegli in kakšne naloge nas še čakajo v prihodnosti. The purpose of the master's thesis is to present the usage of the standard ISO/IEC 27003 and the project management computer tools for creation of the project plan of an information security management system (ISMS) implementation in a particular organization. In the theoretical part of the thesis, the bases of the information system security are given. The ISO 27000 family of standards as well as other standards which are widely used as the base for the ISMS implementation in organizations are presented. Besides, the fundamentals of the project management are described. In the applicative part of the thesis, the model of the ISMS planning up to ISO/IEC 27003 standard is described in detail. This model has been used to create a detailed plan of the ISMS implementation in the Alpina enterprise. For a creation of this project plan two computer tools have been used, the project system PROSIS and the Microsoft Project software. In the conclusion, our project achievements have been presented and the future tasks have been exposed.

Za uspešno poslovanje podjetja je ključno obvladovanje in varovanje informacij, s katerimi podjetje razpolaga. Če pomembne informacije preidejo v roke nepooblaščenih oseb, ima lahko to resne posledice za podjetje in njegovo poslovanje. Zaradi tega je pomembno, da se groženj in nevarnosti zavedajo tako zaposleni kot tudi vodstvo podjetja. Varnostna politika vsakemu podjetju predstavlja vodilo in pomoč, pri izogibanju incidentom oziroma zmanjševanju posledic. Je skupina dokumentov, ki združujejo navodila, priporočila in napotke s področja informacijske varnosti v podjetju. Izdelava varnostne politike je kompleksen postopek, ki se izvede v več fazah. V okviru diplomskega dela smo izdelali varnostno politiko za specifično podjetje. Pri tem so izvedli vse faze izdelave, pomagali pa smo si tudi z priporočili in navodili za pripravo varnostne politike. Every successful enterprise needs to manage and protect their key information. If important information is leaked and comes into the hands of malicious persons, this can have serious consequences for the enterprise and its business. Therefore it is vital that the management as well as employees are aware of the risks and security threats. The security policy of an enterprise is a guideline for avoiding incidents or reducing their consequences to a minimum. Security policy is a group of documents that combine instruction, recommendations and guidance in the field of information security within the enterprise. The making of a security policy is a complex process conducted in several phases. In the diploma work we develop a security policy for a specific company. In the development process we have to complete the mentioned phases in which we also consider recommendations and directions for preparing a good security policy.

V diplomski nalogi sem izvedel analizo varnosti informacijskega sistema v podjetju Stroka Produkt d.o.o. PE Ljubljana, kjer sem tudi zaposlen. V nalogi sem podal teoretične osnove s področja varnosti, predstavil sem podjetje in opisal njegov informacijski sistem. Analiza je narejena s popisom dobrin, njihovim vrednotenjem ter popisom groženj in ranljivosti, ki je skladna s starim standardom BS 7799 ter sedanjim ISO 27001 standardom. Z izvedeno analizo tveganja sem poizkusil izpostaviti kritična področja v podjetju ter podal predloge za izboljšavo in zmanjševanje tveganj. Z uvedbo teh ukrepov bi v obravnavanemu podjetju bistveno izboljšali varnost njihovega informacijskega sistema ter pripomogli k učinkovitejšemu poslovanju. This diploma deals with the security analysis of the information system in the company Stroka Produkt d.o.o. branch office Ljubljana. In the first part of the diploma a theoretical bases of information security are presented. Besides, the company as well as its information system is described. The main part of the diploma includes the qualitative risk analysis which has been performed using the old BS 7799 standard and currently valid ISO 27001. On the basis of the risk analysis results, some additional countermeasures have been suggested. Implementation of these countermeasures could slightly improve the existent level of information security that could result in more efficient business of the company under consideration.

This paper highlights the problem with access rights as a part of information security in enterprises with many information systems and their human users. In many organisations, users often write down their user names and passwords, thus enabling outsiders to enter information systems without proper authorisation. Furthermore, access rights commonly remain active after their possessors have left the organisation or after roles in the organisation have changed. In addition, there are instances in enterprises where access rights are managed with severe deficiencies. In this study we discuss a case where this issue was found out to be in a critical state when the organisation planned to extend and specialise its business abroad. Literature exposed several approaches and concepts to be concerned with. In our paper, we introduce how we approached the problem with a pragmatic contextual view. Based on prior research we explored access rights perceived in the enterprise with the help of a pre-study in the mode of a semi-structured questionnaire. The design science based framework described by Hevner et al. (2004) provided us with a solution that satisfied the enterprise in its information security efforts. Instead of describing the artifact, we highlighted the usability of the framework in real life and explained how we applied it in our research project.

Primjena informacijskih tehnologija u svakodnevnom radu u stalnom je porastu. Dok je još prije samo desetak godina relativno mali broj zaposlenika za obavljanje svojih radnih obveza koristio računalo, danas je nezamislivo zaposliti novog djelatnika koji ne poznaje rad na računalu. Broj sati aktivnog rada za računalom raste, pri čemu se to ne odnosi samo na tvrtke koje se bave informatičkom djelatnošću. Stoga se stručnjaci za zaštitu na radu sve češće susreću s različitim problemima iz domene primjene računala u poslovnoj praksi, a koji direktno ili indirektno utječu na rezultate rada. Svako poduzeće posjeduje vlastiti informacijski sustav koji može, ali i ne mora biti podržan računalom. Ipak, danas je informacijska tehnologija duboko prodrla u sve pore poslovanja i svakodnevnog života, na što je značajno utjecala decentralizacija opreme i programske podrške (softvera). Pri tomu se često nije predviđala adekvatna zaštita računala i podataka, a postojeća pravila koja su se primjenjivala u centraliziranim računalnim centrima nisu se ažurirala. Uvođenje internetske tehnologije samo je pridonijelo nesigurnosti informacijskih sustava. Korisnici informacijskog sustava ili nekog njegova segmenta ponekad nisu ni upoznati s potrebom i značenjem podatkovnih resursa poduzeća kao ni načinima njihove zaštite. Podaci su osnovni resurs poslovnog sustava tako da se šteta nastala njihovom zloporabom (ili gubitkom, pogrešnom uporabom i slično) zapravo nanosi poduzeću u cjelini. Stoga je organizacija zaštite informacijskog sustava interdisciplinarni zadatak svih zaposlenika poduzeća kojem je cilj ostvariti što viši stupanj sigurnosti u skladu s prihvatljivim gubicima s kojima poduzeće mora računati. U tu svrhu najčešće se primjenjuju različiti dokumenti koji se odnose na pojedine aspekte zaštite sustava, a koji se uglavnom kreiraju i počinju primjenjivati tek kada se dogodi neki od oblika narušavanja sigurnosti sustava. U praksi se obveza izrade i primjene takvih dokumenata uglavnom propisuje posebnim pravilnikom, a tek rijetka poduzeća počinju uvoditi model zaštite informacijskog sustava u skladu s međunarodnom normom ISO/IEC 17799:2000. Također, zaštita radnika koji svakodnevno obavljaju svoj posao uz primjenu računala mora se provoditi u skladu s Pravilnikom o sigurnosti i zaštiti zdravlja pri radu s računalom. Njime su propisani zahtjevi koje računalna oprema mora zadovoljavati, te je propisana obvezna izrada procjene opasnosti za ta radna mjesta. Zaštita informacijskog sustava zajednička je odgovornost svih zaposlenika tvrtke, tako da samo zdravi, zadovoljni i adekvatno educirani radnici, koji rade u primjerenim uvjetima rada, mogu pridonijeti unapređenju sigurnosti opreme i podataka u poslovnom sustavu., SUMMARY: The application of information technologies in daily work is marking an ever-increasing trend. Only ten years ago a relatively small number of employees used a computer in their work, whereas it is nowadays unthinkable that a person without computer skills would get employment. The number of hours spent in active work at the computer is growing and not only in companies with business in information. One of the consequences is that occupational safety experts are constantly and increasingly faced with a range of problems arising from the application of the computer in business practice which directly or indirectly affect work results. Each company has its own information system that may or may not be supported by a computer. It may, however, be asserted that information technology has penetrated all pores of business and everyday life resulting from, to a great degree, a decentralization of equipment and software. In the process, more often than not, no suitable protection of computers and data has been designed, and the existing regulations applied in centralized computer centers are not regularly updated. The introduction of the Internet technology only compounds the insecurity of information systems. The users of an information system or one of its segments are occasionally not even aware of the need and importance of the data resources in a company and the methods for their protection. Data is the fundamental resource of a company, so that damage stemming from their abuse (loss, misuse, etc.) is harmful to the company as a whole. Therefore the organization of information system security is an interdisciplinary task involving all employees in a company with the aim to ensure as high as possible security, but with awareness that some losses are acceptable and need to be tolerated. For this purpose a variety of documents is used relevant to the different aspects of system security, which are by and large introduced only after some compromise in the system security has been observed. In practice, the obligation to compile and implement such documents is commonly prescribed by a special set of regulations, with only very few companies introducing a model of information system security which is in compliance with the international ISO/IEC 17799:2000 standard. Furthermore, the protection of employees working at the computer on a daily basis in their jobs must also be regulated in the Safety and Health Regulations in Working with Computers. The Regulations prescribe the requirements which the computer equipment must comply with, with a mandatory risk assessment for the work places. Information system security is the responsibility of all employees in a company. Only healthy, happy and suitably trained employees working in satisfactory working conditions may contribute to the improvements in equipment and data security in a business system.

This paper addresses the possibility of expert system's use in information system security (ISS) and defines a model of an expert system for selection of a security and protective measures. The development and increasing importance of information systems (IS) and their resources in business organizations emphasis the vulnerability of information systems and potential loses for organizations produced by different events that are threat for ISS. Some organizations are solving this problem with unplanned and inefficient use of security measures, but there are organizations that are using and implementing security measures that are appropriate, necessary and in accordance with other aspects of their organization. In this paper we explain a model how to define a set of security measures with those characteristics with help of an expert systems, that by combining the knowledge base, conclusion mechanism, risk assessment and ability to learn is able to select the necessary and appropriate security measures for ISS improvement.