Search

Конспект лекцій з дисципліни «Управління інформаційною безпекою» знайомить студентів з загальними принципами управління інформаційною безпекою, основними поняттями управління інформаційною безпекою підприємства на базі міжнародних стандартів серії ISO/IEC серії 27000. Значна увага приділяється засвоєнню принципів, завдань системи управління інформаційною безпекою, вивченню нормативної та правової бази з питань організації та проведення аудиту інформаційної безпеки, методик оцінки інформаційних ризиків, здійсненню комплексу заходів, спрямованих на розроблення і впровадження інформаційних технологій, які забезпечують обробку інформації в інформаційно-телекомунікаційних системах згідно з вимогами, встановленими нормативно-правовими актами та нормативними документами у сфері захисту інформації.

Por mi experiencia profesional, la mayoría de las empresas pequeñas o medianas carecen de cualquier tipo de formalismo o plan de seguridad. En este proyecto se plantea formalizar el SGSI para un grupo empresarial donde convergen varios tipos de empresas diferentes, con necesidades diferentes, de un tamaño considerable en conjunto, pero que son administradas desde un servicio de TI unificado. Esta estructura empresarial particular requiere de un análisis y planificación concreta que se materializará en un Plan Director de Seguridad Empresarial. Este Plan Director de la Seguridad Empresarial, abordará el estudio del contexto de la empresa, la evaluación de los niveles actuales de seguridad informática, comprobaran los puntos fuertes y los puntos débiles, para finalmente ofrecer un documento con propuestas y planes que puedan servir de ayuda a reforzar los mecanismos de seguridad informática del grupo empresarial. Para ello se emplearan la familia de normativas ISO 27K, la Metodología Magerit v3 desarrollada por la Administración Electrónica del Gobierno de España y los planes de contingencia y continuidad de negocio desarrollados por el INCIBE.

The paper presents and analyzes new information about the modern aspects of standardization of information technology security techniques, covered the work of experts of technical standardization committees for the creation and updating of international standards on information security management system, sets an example, experts talk about the standardizing technical proposals and methods for solving problems in information security with help of years of practice, implemented in a series of international standards, found that the root cause of hard work Standardization Technical Experts on updating ISO/IEC 27000 was to update ISO/IEC 9000. This work resulted in harmonizing the provisions of standards ISO/IEC 27000 series and the new work experts on information technology security techniques with the fundamentals of management systems, which principles are laid and announced by the latest standards. These principles are known and constitute the methodological basis of international standards on the management system, namely, the process approach, the PDCA cycle and thinking on the risk based. The provisions of the revised standards and the standards that will be published by the ISO in the future, lies in the fact that the process approach – is the systematic identification and management processes, as well as their interaction in order to achieve the desired results in accordance with established policies and strategic direction organization. Process control and system as a whole can be achieved using the PDCA cycle with the general emphasis thinking on the risk based, aimed at seizing opportunities and prevent unwanted results., В статье приведены и проанализированы новые сведения о современных аспектах стандартизации методов безопасности информационных технологий, освещена работа экспертов технических комитетов стандартизации по созданию и обновлению международных стандартов на системы управления информационной безопасностью, подано примеры, озвученные экспертами стандартизации о технических предложениях и методах решения проблем по информационной безопасности с помощью сводов практических правил, реализованных в серии международных стандартов. В статье установлено, что первопричиной кропотливой работы технических экспертов стандартизации над обновлением международных стандартов серии ISO/IEC 27000 было обновление основных стандартов серии ISO/IEC 9000. Результатом этой работы стало приведение в соответствие положений стандартов серии ISO/IEC 27000 и наработка специалистов по методам безопасности информационных технологий с фундаментальными основами систем управления, принципы которых заложены и озвучены новейшими стандартами., У статті наведено та проаналізовано нові відомості щодо сучасних аспектів стандартизації методів безпеки інформаційних технологій, висвітлено роботу експертів технічних комітетів стандартизації зі створення й оновлення міжнародних стандартів на системи управління інформаційною безпекою, подано приклади, озвучені експертами стандартизації стосовно технічних пропозицій та методів розв’язання проблем щодо інформаційної безпеки за допомогою зводів практичних правил, реалізованих у серії міжнародних стандартів. У статті з’ясовано, що першопричиною кропіткої роботи технічних експертів стандартизації над оновленням міжнародних стандартів серії ISO/IEC 27000 стало оновлення основоположних стандартів серії ISO/IEC 9000. Результатом цієї праці було приведення у відповідність положень стандартів серії ISO/IEC 27000 та напрацювання спеціалістів з методів безпеки інформаційних технологій до фундаментальних основ систем управління, принципи яких закладено й озвучено новітніми стандартами.

The information technology (IT) has been applied widely in Indonesia Higher Education Institution for various services. Many organizations responsible for managing the IT infrastructure, however, rarely have a framework for assessing the security maturity level of their information management. The implementation of a framework is one of solutions, but has not been yet maximized. Therefore we suggest to combine several frameworks in hope that they can be complementary. The combination of different frameworks will be more effective to monitoring the security maturity level by using an assessment security maturity management. This assessment security maturity management is a combination of framework control objective from IT Governance COBIT(R) 4.1 (Control Objectives for Information and related Technology) with Management Service in ITIL v3 (Information Technology Infrastructure Library) and ISO/IEC 27001. Since assessment of security maturity management is measured using COBIT(R) 4.1 assessment framework, and before it was adjusted with the ISO 27001 framework applied maximal. This paper present the results of assessment maturity security management, mapping of combination framework providing an indicator of security maturity level at one of university in Jakarta. A case study conducted shows that combination of some frameworks to support assessment of security maturity management level becomes more effective and efficient.

Los activos de información han adquirido un gran valor para las organizaciones, lo cual ha generado una necesidad legal y organizacional para todas las empresas por medio de la confidencialidad, integridad y disponibilidad de la información. Para poder dar solución a estas necesidades en las entidades públicas, el Gobierno Colombiano ha creado la estrategia de Gobierno en Línea, con un componente de seguridad y privacidad de la información basado en la norma ISO/IEC 27001, que plantea como objetivos el diseño, ejecución, monitoreo y control de un sistema de gestión de seguridad de la información. Este proyecto plantea como resultado la propuesta del diseño del Sistema de Gestión de seguridad de la información de una entidad pública, basándose en la familia de normas de la ISO 27000 y complementándose con el Modelo de Seguridad y Privacidad de la información propuesto por MinTic. The information assets have acquired a great value for the organizations, which has generated that safeguarding the confidentiality, integrity and availability of the information is a legal and organizational necessity for all the companies, to be able to give solution to these needs in the public entities , the Colombian Government has created the Online Government strategy, with a security and information privacy component based on the ISO/IEC 27001 standard, which sets out as objectives the design, execution, monitoring and control of a management system of information security. This project has resulted in the proposal for the design of the Information Security Management System of a public entity, based on the family of ISO 27000 standards, complemented by the guidelines of the Security and Privacy Model of the information proposed by MinTic.

espanolSe propone una metodologia de implementacion de un Sistema de Gestion de Seguridad de la Informacion (SGSI) basado en la familia de normas de la ISO/IEC 27000, con enfasis en la interrelacion de cuatro normas fundamentales a traves de las cuales se desarrollan las actividades requeridas para cumplir con lo establecido en la ISO/IEC 27001, los controles de seguridad presentados en la ISO/IEC 27002, el esquema de riesgos de la ISO/IEC 27005 y los pasos recomendados en la ISO/IEC 27003. Se genera como resultado un proceso metodologico que da respuesta al como abordar un proyecto de este nivel de importancia en el contexto actual de las organizaciones y basado en estandares internacionales. Este proceso metodologico representa un aporte a los profesionales que emprenden esta labor, y que buscan un metodo para una implementacion exitosa de un SGSI. EnglishA methodology for the implementation of an Information Security Management System (ISMS) based on the ISO/IEC 27000 family of standards is proposed, with an emphasis on the interrelationship of four fundamental standards which break down the activities to be developed in order to comply with the requirements established in the ISO/IEC 27001, the safety controls presented in the ISO/IEC 27002, the ISO/IEC 27005 risk scheme and the steps recommended in the ISO/IEC 27003. The result is a methodological process that explains how to face a project of this level of importance in the current context of organizations and based on international standards. This methodological process represents a contribution to the professionals who undertake this work, and who are looking for a method to carry out a successful implementation of an ISMS.

To ensure that the information asset is protected and available to organisations, information security needs to be governed by security standards. The ISO/IEC 27000 family of standards is one such standard; it keeps information assets secure and provides an information security management best practises framework. Despite its importance, the usage and adoption of the ISO/IEC 27000 standards is missing in Namibian organisations. An exploratory pilot survey conducted in 2015 with the key stakeholders namely the Communications Regulatory Authority, Internet Service Providers and government departments revealed that these standards are not being implemented at all. Based on literature review and the preliminary surveys, this paper presents the extent to which the ISO/IEC 27000 implementation framework is adopted in Namibia. The study will focus on the implementation extent for ISO 27000, 27001, 27002, 27003 and 27004 as these are the critical standards to the security posture of any organisation. A qualitative case study research approach with security critical organisations in Namibia was used for this study. Surveys and interviews were used to collect data from purposefully identified key stakeholders. The stakeholders offered rich information about the phenomenon under study. The survey results were used to evaluate the extent of implementation and the factors contributing to the poor implementation. A theoretical framework was derived from the findings and is thus presented in this paper. The factors making up the theoretical framework will be used as a basis in designing a policy framework for the adoption of security standards by organisations in Namibia to secure its critical assets, manage risks more effectively, improve and maintain customer confidence, demonstrate conformance to international best practice, avoid brand damage and change its information security posture as the technology is evolving.

This master thesis deals with the topics Information Security Management by the group of ISO/IEC 27000 norms and implementation of the Information Security Management System (ISMS) in one particular company. The theoretical part describes the group of norms ISO/IEC 27000 and the legislation and institutions related to these norms. Then the theoretical framework of a risk analysis is introduced. The benefits and possible obstacles when implementing the ISMS in an organization with emphasis on small businesses is described at the end of the theoretical part. The practical part includes a complex risk analysis and measures to be taken for the revealed risks. Furthermore, it involves the settings of the information security internal rules in the company Bluepool s.r.o. with regard to the risk management and information security policy. The conclusion of this part puts forward a proposal of the process and examples of implementation, time schedule and budget for implementation of adopted measures.

Informacijska varnostna politika in njeno izvajanje sta ključna dejavnika, ki pomembno vplivata na poslovanje podjetja in organizacije. Ker so med podjetji razlike in specifike v načinu delovanja, univerzalna varnostna politika pa ne obstaja, si podjetja pri njenem ustvarjanju lahko pomagajo z različnimi standardi. Diplomsko delo predstavlja informacijsko varnostno politiko in upravljanje informacijske varnosti po standardih ISO/IEC 27002 ter ISO/IEC 17799 oziroma BS 7799. Glavni namen te naloge je predstavitev in medsbojna primerjava obeh izbranih standardov na primeru podjetja Štore Steel d.o.o. in na podlagi izdelanega kontrolnega vprašalnika ocene skladnosti prikaz primernejšega standarda za to podjetje. Information security policy and its implementation are key factors that have a significant impact on the operations of companies and organizations. A universal security policy does not exist because of the differences and specifics in the mode of operation amongst various companies. Companies develop their own policy with the help of variety of standards. The present thesis represents informaton security policy and information security management according to the ISO/IEC 27002 and ISO/IEC 17799 respectively BS 7799. The main purpose of this thesis is presentation and comparison of these two selected standards based on the case of company Štore Steel d.o.o. and presentation of the most appropriate standard for this company based on the created checklist of compliance assessment.

Information classification deals with the handling of sensitive information, such as patient records and social security information. It is of utmost importance that this information is treated with caution in order to ensure its integrity and security. In Sweden, the Civil Contingencies Agency has established a set of guidelines for how governmental agencies should handle such information. However, there is a lack of research regarding how well these guidelines are followed as well as if the agencies have made accommodations of these guidelines of their own. This work presents the results from a survey sent to 245 governmental agencies in Sweden, investigating how information classification actually is performed today. The questionnaire was answered by 144 agencies and 54 agencies provided detailed documents of their classification process. The overall results show that the classification process is difficult, while those who provided documents proved to have good guidelines, but not always consistent with the existing recommendations.

Pričujoče diplomsko delo predstavlja področji revizije informacijskih sistemov in upravljanja informacijske varnosti po standardu ISO/IEC 27001. Obe področji sta pri tem povezani z relevantno in veljavno slovensko zakonodajo. Glavni namen te naloge je združiti obe področji v enoten in skladen sistem revidiranja informacijske varnosti. Za dosego tega cilja so usklajene zahteve standarda ISO 27001 s standardnim orodjem, tako revizije informacijskih sistemov, kot tudi upravljanja informatike nasploh COBIT 5. V končni fazi pa so izdelana natančna priporočila za revizijo informacijske varnosti, ki jih omogočata standarda ISO/IEC 27002 in ISO/IEC 27007. The present diploma work presents the fields of information systems audit and management of information security according to standard ISO/IEC 27001. Both areas are linked to the relevant and applicable Slovenian legislation. The main purpose of this diploma work is to unite the two areas into a unified and consistent system of information security auditing. This goal was achieved by aligning the requirements of ISO/IEC 27001 standard with the standard tool for not only performing information systems audit but also management of information technology in general COBIT 5. In the final stage detailed recomendations for information security audit that are made possible by the standards ISO/IEC 27002 and ISO/IEC 27007 are formed.

A company should pay much attention to information systems security. It is necessary to secure the support system of the organization if we want continuity and effectiveness of business. In addition to providing security through technological precautions to prevent intrusion and abuse, it is necessary to pay more attention to the vulnerability and threats caused by the engaged users. Here we refer to unintentional threats, as a result of faulty workmanship or lack of knowledge of the information system. It is important to strive to reduce the possibility of causing the occurrence of incidents which are the result of improper use of information technology, which is due to ignorance. An organization shall consider and identify vulnerabilities of the system and threats to it. We confront the growing amounts of information in electronic form. Ensuring security of information systems (IS) in the workplace involves many steps that a company must adopt and carry out. The vulnerability of the systems is being examined, whereas the form of the new age of terrorism, cyber- terrorism, is being presented. This paper deals with ways of reducing risks and increasing safety and security of IS. It presents possible ways of ensuring the safe use of IS. Key words:Information system, management, safety, security.

Las empresas de desarrollo de software han apostado por la implantación de modelos y estándares de calidad con el objetivo de ofrecer productos que se adapten a las necesidades de los clientes y aumenten su satisfacción. Además de mejorar sus procesos de desarrollo de software, estas organizaciones también desean aumentar la capacidad de los procesos de otras disciplinas, como pueden ser la gestión de servicios de Tecnologías de la Información (TI) o la gestión de la seguridad de la información. Las normas ISO que definen las mejoras prácticas de estas áreas guardan una gran cantidad de relaciones entre sus recomendaciones, directrices y requisitos. A partir del estudio de todos estos elementos y aspectos comunes, se ha desarrollado el marco MIN-ITs, un marco que facilita la implantación integrada de los diferentes estándares ISO de gestión de TI. Software development companies have opted for implementing quality models and standards in order to provide products that meet customers’ needs and increase their satisfaction. In addition to improving their software development processes, these organizations also wish to increase the capability of the processes related to other disciplines, such as Information Technology (IT) service management and information security management. The ISO standards that define the best practices in these areas keep a great number of relations among their recommendations, guidelines and requirements. From the study of all these common elements and aspects we have developed MIN-ITs, a framework that facilitates the integrated implementation of different ISO IT management standards.

With the increasing significance of information technology, there is an urgent need for adequate measures of information security. Systematic information security management is one of most important initiatives for IT management. At least since reports about privacy and security breaches, fraudulent accounting practices, and attacks on IT systems appeared in public, organizations have recognized their responsibilities to safeguard physical and information assets. Security standards can be used as guideline or framework to develop and maintain an adequate information security management system (ISMS). The standards ISO/IEC 27000, 27001 and 27002 are international standards that are receiving growing recognition and adoption. They are referred to as “common language of organizations around the world” for information security [1]. With ISO/IEC 27001 companies can have their ISMS certified by a third-party organization and thus show their customers evidence of their security measures.

The work demonstrates practical application of information security integral engineering technique to solve standards analysis and refinement problem. The application was exemplified by the development and analysis of the ISMS standards (ISO/IEC 27000 series) dictionary object model. Standards refinement process consisting of model development, model and standards modification was described. As a result of the research the weaknesses related to "Asset", "Risk management", "Information security policy" and "Certification document" concepts were revealed and proposals on their elimination were formulated. The paper shows that semiformal modeling techniques can be successfully applied and efficiently used to analyze and amend international standards.

Maintenance is one approach to managing risk by a reduction of the probability of failure of technical systems and/or the consequences of their failure. However, history has shown that erroneous maintenance also can lead to reduced quality, incidents and accidents with extensive losses. Today, eMaintenance promises great opportunities for a paradigm shift from a rather narrow, condition-based maintenance approach with focus on a technical system’s health to a true risk-based maintenance approach that also considers organizational excellence. This is achieved by proper information logistic solutions that address the needs of all stakeholders of the maintenance process, which are possible due to new and innovative information and communication technology (ICT). However, all opportunities are also linked with some threats, which are seldom highlighted in the case of eMaintenance. In this article, a risk management framework for evaluation of eMaintenance solutions is proposed. The framework is based on a combination of international standards (e.g. ISO 31000, ISO/IEC 27000, and IEC (2004) 60300-3-14) to achieve integrated Enterprise Risk Management (ERM) and enable a linkage of eMaintenance to the strategic goals of an organization. The framework is illustrated in the railway context of Trafikverket (2010b) (the Swedish Transport Administration).