Information security management standards: Compliance, governance and risk management

2008 ◽  
Vol 13 (4) ◽  
pp. 247-255 ◽  
Author(s):  
Edward Humphreys
Keyword(s):  
Risk Management ◽  
Information Security ◽  
Security Management ◽  
Information Security Management ◽  
Management Standards ◽  
Standards Compliance

scholarly journals The effectiveness of the Centralized Use of Digital Technologies, Information Resources and Information Protection Tools in Government by the Example of the Republic of Tyva

2020 ◽  
Vol 23 (6) ◽  
pp. 99-114
Author(s):  
B. S. Dongak ◽  
A. S. Shatohin ◽  
R. V. Meshcheryakov
Keyword(s):  
Risk Management ◽  
Information Security ◽  
Management System ◽  
Economic Effect ◽  
Security Management ◽  
Information Resources ◽  
Information Protection ◽  
Information Security Management ◽  
Information Security Management System ◽  
Software And Hardware

Purpose of research. The purpose of this study is to assess the possibility of applying the methodology for centralized management of systems and information risks using the example of informatization of public departments of Republic of Tyva in order to optimize the cost of purchasing technical, software and hardware-software means of protecting information, as well as the payroll of maintenance technical personnel.Methods. One of the main research methods is the creation of an experimental model of the mechanism of a single information and computing network, combining various government departments located within the same administrative building, which allows working simultaneously with distributed or centralized applications, databases and other services, as well as centralized information risk management security. The next research method is the analysis and study of the principle of operation of information resources, information systems, databases, and the increase in the number of domain users if they are combined into a single data transfer network. The interaction and effectiveness of personnel, a specialized unit based on one government agency, ensuring the regular functioning of the network and the necessary level of information security for all government departments.Results. As a result, an economic effect is achieved by eliminating the acquisition of duplicate software and hardware information protection, increasing the efficiency of using unified information services, and creating a centralized structural unit that uses risk management tools and makes information security management decisions based on the principles of system analysis , structuring method and expert survey methods. The results of the study have been used in solving problems of improving the information security management system of the authorities of Republic of Tyva.Conclusion. We have developed the original information technology architecture of the information security management system and centralized use of information technologies for the government of Republic of Tyva. The distinctive features of the structure of software tools for the centralized approach are the multi-agent implementation of the control elements of the decision support system and the integration of various types of security management models into a single complex. 

scholarly journals Wahyudi

2019 ◽  
Author(s):  
Wahyudi
Keyword(s):  
Risk Management ◽  
Information Security ◽  
Business Process ◽  
Security Management ◽  
Information Security Management ◽  
Security Control ◽  
Iso 31000 ◽  
Lawful Interception ◽  
Iso 27001

Menanggapi isu penyadapan yang dilakukan oleh Australia terhadap jaringan Indosat, manajemen Indosat mengatakan telah memiliki audit atas sistem keamanan jaringannya. Sistem tersebut sudah berstandard internasional yakni ISO 27001 dan ISO31000."Kami mempunyai manajemen tata laksana kebijakan dan pengendalian operasional dalam bentuk penerapan sistem manajemen standard ISO 27001 (Information Security Management) dan ISO 31000 (Risk Management) yang juga menyangkut audit keamanan sistem jaringan. Indosat juga mematuhi ketentuan lawful interception sesuai ketetuan dan Indosat menyatakan dengan tegas tidak memiliki kerjasama dengan pihak asing yang bertujuan untuk melakukan penyadapan," ujar President Director & CEO Indosat Alexander Rusli dalam keterangannya di Jakarta.Lebih lanjut dijelaskan, sistem adalah jaringan publik yang menggunakan standar seperti yang ditentukan oleh pemerintah. Dan satu-satunya tindakan penyadapan yang diizinkan adalah yang dilakukan oleh lembaga resmi negara berdasarkan aturan hukum yang berlaku. Bagaimana tanggapan anda mengenai artikel ini?Sesuai dengan UU No 36 Tahun 1999 tentang Telekomunikasi, Indosat hanya menyediakan fasilitas penyadapan kepada Aparat Penegak Hukum. Tidak hanya itu, seluruh perangkat Indosat telah memiliki sertifikat dari Kementerian Kominfo sesuai PM No. 29 Tahun 2008 tentang Sertifikasi Alat dan Perangkat Telekomunikasi dan sebagaimana telah disebutkan di atas bahwa keamanan jaringan Indosat sudah berstandar internasional sesuai ISO 27001.Bahkan, Indosat memiliki standard audit yang meliputi penerapan security control, business process, kepatuhan terhadap kebijakan serta pengujian teknis terhadap kerentanan jaringan, sehingga keamanan jaringan tetap terpelihara. Dalam hal ini, Indosat secara tegas menyatakan bahwa tidak ada kerjasama penyadapan dengan pihak luar terutama dengan pihak asing karena jelas hal tersebut melanggar Undang-undang yang berlaku serta merugikan kepentingan negara dan bangsa Indonesia sendiri.

The Adoption of Information Security Management Standards

2009 ◽  
pp. 119-140 ◽  
Author(s):  
Yves Barlette ◽  
Vladislav V. Fomin
Keyword(s):  
Information Security ◽  
Literature Review ◽  
Success Factors ◽  
Security Management ◽  
Information Security Management ◽  
Diffusion Of Information ◽  
Management Standards ◽  
Business Market ◽  
Security Standards ◽  
Iec 27001

This chapter introduces major information security management methods and standards, and particularly ISO/IEC 27001 and 27002 standards. A literature review was conducted in order to understand the reasons for the low level of adoption of information security standards by companies, and to identify the drivers and the success factors in implementation of these standards. Based on the findings of the literature review, we provide recommendations on how to successfully implement and stimulate diffusion of information security standards in the dynamic business market environment, where companies vary in their size and organizational culture. The chapter concludes with an identification of future trends and areas for further research.

The Adoption of Information Security Management Standards

2010 ◽  
pp. 69-90 ◽  
Author(s):  
Yves Barlette ◽  
Vladislav V. Fomin
Keyword(s):  
Information Security ◽  
Literature Review ◽  
Success Factors ◽  
Security Management ◽  
Information Security Management ◽  
Diffusion Of Information ◽  
Management Standards ◽  
Business Market ◽  
Security Standards ◽  
Iec 27001

This chapter introduces major information security management methods and standards, and particularly ISO/IEC 27001 and 27002 standards. A literature review was conducted in order to understand the reasons for the low level of adoption of information security standards by companies, and to identify the drivers and the success factors in implementation of these standards. Based on the findings of the literature review, we provide recommendations on how to successfully implement and stimulate diffusion of information security standards in the dynamic business market environment, where companies vary in their size and organizational culture. The chapter concludes with an identification of future trends and areas for further research.

MIN-ITs: A Framework for Integration of IT Management Standards in Mature Environments

2014 ◽  
Vol 24 (06) ◽  
pp. 887-908 ◽  
Author(s):  
Antoni-Lluís Mesquida ◽  
Antonia Mas ◽  
Tomás San Feliu ◽  
Magdalena Arcilla
Keyword(s):  
Information Security ◽  
Service Management ◽  
Security Management ◽  
It Management ◽  
It Service Management ◽  
Information Security Management ◽  
Iso Standards ◽  
It Service ◽  
Software Companies ◽  
Management Standards

The growing interest of software companies for improving their internal processes, not just software development processes, but also processes in other domains such as Information Technology (IT) service management or information security management, has encouraged these companies to implement recognized models or standards. Most of the ISO standards that define models for software quality, IT service management or information security management provide their recommendations, guidelines, requirements or good practices under a process approach. Due to this approach, there are a large number of relations between these models as well as many common elements. From the study of these relations, this paper presents MIN-ITs, a new framework that supports the integration of different ISO standards related to IT management.

Sign in / Sign up

Export Citation Format

Share Document