Evaluasi Keamanan Informasi Pada Perguruan Tinggi Bina Insani Berdasarkan Indeks Keamanan Informasi SNI ISO/IEC 27001

2018 ◽  
Vol 6 (1) ◽  
pp. 95-104
Author(s):  
Mardi Yudhi Putra ◽  
Djajasukma Tjahjadi
Keyword(s):  
Higher Education ◽  
Information Security ◽  
Private Higher Education ◽  
Security Requirements ◽  
Probability Sampling ◽  
Low Level ◽  
Information Security Management System ◽  
Security Index ◽  
Iec 27001 ◽  
Iso 27001

Abstract   Efforts to improve information security are so important to an organization that not only in planning but up to the stage of information security. In reality, there is a lack of awareness of the organization of its importance that it causes the occurrence of security issues such as spam so that it affects the business process of the organization. This study examines the evaluation of the completeness (readiness and maturity) of the Information Security Management System (SMKI) at the Private Higher Education Institution of Bina Insani as measured using the Information Security Index (KAMI). Evaluation carried out refers to the ISO / IEC 27001 information security standard regarding information security requirements. Population and sample of this research consist of 4 working unit that is BAAK, BKEU, PMB and BSIJ & UPT so total amount 20. Sampling technique used is non probability sampling that is saturated sampling. The evaluation results of both the preparedness and maturity of the ISMS are at a very low level with the dependence on the role of information and communication technology at the organization at a moderate level. The level of completeness is at a low level with a score of 167 out of a total of 588 and the level of maturity is at level II. Meanwhile, to obtain ISO / IEC 27001: 2009 certification minimum level of information security is at level III. To achieve the level of maturity of Higher Education Bina Insani need to make improvements gradually starting from kesadaraan importance of information security, such as knowledge sharing and information security related training.   Keywords: Information Security, Index KAMI, ISO 27001     Abstrak   Upaya meningkatkan keamanan informasi sangat penting pada sebuah organisasi, tidak hanya dalam perencanaan akan tetapi sampai dengan tahap penerapan keamanan informasi. Pada kenyataannya ditemukan kurangnya kesadaran dari organisasi akan pentingnya hal tersebut sehingga menyebabkan terjadinya masalah keamanan informasi sehingga berdampak pada proses bisnis organisasi. Penelitian ini membahas tentang evaluasi kelengkapan (kesiapan dan kematangan) Sistem Manajemen Keamanan Informasi (SMKI) yang ada pada Lembaga Pendidikan Swasta Perguruan Tinggi Bina Insani yang dievaluasi menggunakan Indeks Keamanan Informasi (KAMI). Evaluasi yang dilakukan mengacu pada standar keamanan informasi ISO/IEC 27001 mengenai persyaratan keamanan informasi. Populasi dan sampel penelitian ini terdiri dari 4 unit kerja yakni BAAK, BKEU, PMB dan BSIJ & UPT sehingga jumlah secara keseluruhan 20. Teknik sampling yang digunakan adalah non probability sampling yakni sampling jenuh. Hasil evaluasi baik kesiapan dan kematangan SMKI berada pada tingkat yang sangat rendah dengan ketergantungan peran teknologi informasi dan komunikasi pada organisasi pada tingkat sedang. Untuk tingkat kelengkapan berada pada tingkat yang rendah dengan skor 167 dari total 588 dan tingkat kematangan berada pada tingkat II. Sementara untuk mendapatkan sertifikasi ISO/IEC 27001:2009 minimal level keamanan informasi adalah berada pada tingkat III. Untuk mencapai tingkat kematangan tersebut Perguruan Tinggi Bina Insani perlu melakukan perbaikan secara bertahap mulai dari kesadaraan pentingnya kemanan informasi, seperti sharing knowledge dan pelatihan terkait keamanan informasi.   Kata kunci: Keamanan Informasi, Indeks KAMI, ISO 27001

Assessing the Information Security Awareness of Employees in PT ABC Against International Organization for Standardization (ISO) 27001:2013

2020 ◽  
Vol 17 (2) ◽  
pp. 1441-1446
Author(s):  
Risma Lukitowati ◽  
Kalamullah Ramli
Keyword(s):  
Information Security ◽  
International Organization ◽  
International Electrotechnical Commission ◽  
Security Awareness ◽  
Information Security Awareness ◽  
International Organization For Standardization ◽  
Information Security Management System ◽  
Information Assets ◽  
Iec 27001 ◽  
Iso 27001

The main purpose of information security is maintaining information assets that are owned by an organization, such as confidentiality, integrity, and availability (known as CIA). In maintaining information assets, a company usually manages information security by making and implementing an Information Security Management System (ISMS) policy. A widely used and applied ISMS policy in Indonesia is ISO/IEC 27001 (International Organization for Standardization/International Electrotechnical Commission). Indonesian telecommunications company PT ABC has implemented the ISO/IEC 27001:2013 standards and procedures. The company conducts an audit once a year to maintain the level of compliance with ISO/IEC 27001:2013. However, only a few people are involved in conducting audits, and it is still unknown how many employees are aware of the company’s information security. This research focused on assessing how much information security awareness exists within PT ABC. Questionnaires were distributed in two departments of the company: supply chain management and service delivery of the Jakarta operations network. This research also examined company documents and surveillance audits in 2018. The employees were grouped based on their length of employment. The results of the questionnaires, with an error margin of 6%, were further compared with the results of the surveillance audit. Our data show that most employees who have worked at the company for more than six years understood and implemented ISO 27001 controls. Meanwhile, companies still need to socialize ISO to employees who have worked at the company for just one to two years.

scholarly journals Aligning Two Specifications for Controlling Information Security

2014 ◽  
Vol 4 (2) ◽  
pp. 46-62
Author(s):  
Riku Nykänen ◽  
Tommi Kärkkäinen
Keyword(s):  
Information Security ◽  
Security Management ◽  
Security Requirements ◽  
Information Security Management ◽  
Security Controls ◽  
Information Security Management System ◽  
Security Control ◽  
High Level ◽  
Iec 27001 ◽  
Iec 27002

Assuring information security is a necessity in modern organizations. Many recommendations for information security management exist, which can be used to define a baseline of information security requirements. ISO/IEC 27001 prescribes a process for an information security management system, and guidance to implement security controls is provided in ISO/IEC 27002. Finnish National Security Auditing Criteria (KATAKRI) has been developed by the national authorities in Finland as a tool to verify maturity of information security practices. KATAKRI defines both security control objectives and security controls to meet an objective. Here the authors compare and align these two specifications in the process, structural, and operational level, focusing on the security control objectives and the actual controls. Even if both specifications share the same topics on high level, the results reveal the differences in the scope and in the included security controls.

Analisis kesenjangan sistem manajemen keamanan informasi (SMKI) sebagai persiapan sertifikasi ISO/IEC 27001:2013 pada institusi pemerintah

Teknologi ◽  
2021 ◽  
Vol 11 (1) ◽  
pp. 1-15
Author(s):  
Sitta Rif’atul Musyarofah ◽  
◽  
Rahadian Bisma ◽  
Keyword(s):  
Information Security ◽  
Organizational Context ◽  
Gap Analysis ◽  
Security Management ◽  
City Government ◽  
Security Requirements ◽  
Information Security Management ◽  
Information Security Management System ◽  
Iec 27001 ◽  
Government Institution

The Madiun City Communication and Informatics Service (Diskominfo) is a government institution that has the responsibility for managing information and communication technology in the Madiun city government. As a government institution to serving and providing information to the public, Diskominfo Madiun City is vulnerable to information security threats that can hinder its performance. Information Security Management System ISO / IEC 2701: 2013 is a system that expected to be able to provide effectiveness and efficiency of information security management at Diskominfo Madiun city. This research aims to determine the current conditions and how the readiness of Diskominfo Madiun City to achieve ISO/IEC 27001:2013 certification. From the results of the gap analysis, it can be seen that the percentage of readiness of Diskominfo Madiun City is 71%, with a readiness range between 19% - 100%. The highest level of readiness is 100% on the requirements of clause 4 concerning the organizational context and clause 10 concerning improvements, where all information security requirements have been met. While the lowest readiness percentage is 19% which is shown in the requirements of clause 6 regarding planning. The gap analysis method is used to determine how far the ISO/IEC 27001:2013 requirements are fulfilled. The results of the gap analysis show the extent of the readiness of Diskominfo Madiun City to carry out ISO/IEC 27001:2013 certification. The results of the research indicate that Diskominfo Madiun City must improve its readiness for ISO/IEC 27001:2013 certification by fulfill the requirements of the required information security documents based on ISO/IEC 27001:2013 standards.

scholarly journals Analisis Sistem Manajemen Keamanan Informasi Menggunakan ISO/IEC 27001 : 2013 Serta Rekomendasi Model Sistem Menggunakan Data Flow Diagram pada Direktorat Sistem Informasi Perguruan Tinggi

2016 ◽  
Vol 6 (1) ◽  
pp. 38
Author(s):  
Yuni Cintia Yuze ◽  
Yudi Priyadi ◽  
Candiwan .
Keyword(s):  
Information Security ◽  
Asset Management ◽  
Management System ◽  
Security Management ◽  
Maturity Level ◽  
Information Security Management ◽  
Capability Maturity ◽  
Information Security Management System ◽  
Level 3 ◽  
Iec 27001

The importance of information and the possible risk of disruption, therefore the universities need to designed and implemented of the information security.  One of the standards that can be used to analyze the level of information security in the organization is ISO/IEC 27001 : 2013 and this standard has been prepared to provide requirements for establishing, implementing, maintaining and continually improving an information security management system. The objective of this research is to measure the level of information security based on standard ISO/IEC 27001: 2013 and modeling systems for information security management. This research uses descriptive qualitative approach, data collection and validation techniques with tringulasi (interview, observation and documentation). Data was analyzed using gap analysis and to measure the level of maturity this research uses SSE-CMM (Systems Security Engineering Capability Maturity Model). Based on the research results, Maturity level clause Information Security Policy reaches level 1 (Performed-Informally), clause Asset Management reaches level 3 (Well-Defined), clause Access Control reaches level 3 (Well-Defined), clause Physical and Environmental Security reaches level 3 (Well-Defined), clause Operational Security reaches level 3 (Well-Defined), Communication Security clause reaches the level 2 (Planned and Tracked). Based on the results of maturity level discovery of some weakness in asset management in implementing the policy. Therefore, the modeling system using the flow map and CD / DFD focused on Asset Management System.

scholarly journals ANALYSIS OF ROUTER ATTACK WITH SECURITY INFORMATION AND EVENT MANAGEMENT AND IMPLICATIONS IN INFORMATION SECURITY INDEX

2019 ◽  
Vol 2 (1) ◽  
pp. 1-7
Author(s):  
CITRA ARFANUDIN ◽  
Bambang Sugiantoro ◽  
Yudi Prayudi
Keyword(s):  
Information Security ◽  
Forensic Analysis ◽  
Event Management ◽  
Information Security Management System ◽  
Security Information ◽  
Information Assets ◽  
Security Index ◽  
Syn Flooding ◽  
The Government ◽  
The Impact

Information security is a need to secure organizational information assets. The government as the regulator issues an Information Security Management System (ISMS) and Information Security Index (US) as a measure of information security in the agency of a region. Security Information and Event Management (SIEM) is a security technology to secure information assets. SIEM is expected to provide information on attacks that occur on the router network and increase the value of the Indeks KAMI of government agencies. However, the use of SIEM is still questionable whether it can recognize a router attack and its impact on the value of our index. This research simulates attacks on routers with 8 attacks namely Mac Flooding, ARP-Poisoning, CDP Flooding, DHCP Starvation, DHCP Rogue, SYN Flooding SSH Bruteforce and FTP Bruteforce. 8 types of attacks followed by digital forensic analysis using the OSCAR method to see the impact on routers and SIEM. Also measured is index KAMI before and after the SIEM to be able to measure the effect of SIEM installation on the value of index KAMI. It was found that the use of SIEM to conduct security monitoring proved successful in identifying attacks, but not all were recognized by SIEM. SIEM only recognizes DHCP Starvation, DHCP Rogue, SSH Bruteforce and FTP Bruteforce. Mac Flooding, ARP-Poisoning, CDP Flooding, SYN Flooding attacks are not recognized by SIEM because routers do not produce logs. Also obtained is the use of SIEM proven to increase our index from the aspect of technology

A Pattern-Based and Tool-Supported Risk Analysis Method Compliant to ISO 27001 for Cloud Systems

2015 ◽  
Vol 6 (1) ◽  
pp. 24-46
Author(s):  
Azadeh Alebrahim ◽  
Denis Hatebur ◽  
Stephan Fassbender ◽  
Ludger Goeke ◽  
Isabelle Côté
Keyword(s):  
Cloud Computing ◽  
Information Security ◽  
Risk Analysis ◽  
Computing System ◽  
Security Requirements ◽  
Analysis Method ◽  
Computing Systems ◽  
Cloud Systems ◽  
Cloud Computing System ◽  
Iso 27001

To benefit from cloud computing and the advantages it offers, obstacles regarding the usage and acceptance of clouds have to be cleared. For cloud providers, one way to obtain customers' confidence is to establish security mechanisms when using clouds. The ISO 27001 standard provides general concepts for establishing information security in an organization. Risk analysis is an essential part in the ISO 27001 standard for achieving information security. This standard, however, contains ambiguous descriptions. In addition, it does not stipulate any method to identify assets, threats, and vulnerabilities. In this paper, the authors present a method for cloud computing systems to perform risk analysis according to the ISO 27001. The authors' structured method is tailored to SMEs. It relies upon patterns to describe context and structure of a cloud computing system, elicit security requirements, identify threats, and select controls, which ease the effort for these activities. The authors' method guides companies through the process of risk analysis in a structured manner. Furthermore, the authors provide a model-based tool for supporting the ISO 27001 standard certification. The authors' tool consists of various plug-ins for conducting different steps of their method.

ROLE AND SECURITY OF INFORMATION IN PUBLIC AND PRIVATE HIGHER EDUCATION SCHOOLS

2011 ◽  
Vol 162 (4) ◽  
pp. 434-446
Author(s):  
Ireneusz JÓŹWIAK ◽  
Artur SZLESZYŃSKI
Keyword(s):  
Higher Education ◽  
Decision Making ◽  
Information Security ◽  
Information Entropy ◽  
Evaluation Criteria ◽  
Information Value ◽  
Private Higher Education ◽  
Decision Making Process ◽  
Public And Private ◽  
Expected Benefits

The paper presents the role of information in the activity of public or private higher education schools. The paper defines two evaluation criteria for information value. The first of them is uncertainty, which is called information entropy. Then the influence of information entropy on the decision-making process is shown. The types of threats to information security are defined. The other criterion enables the evaluation of the value of message. This is strictly a statistical function of the expected benefits which can occur when a message will be used in the decision-making process. The paper presents a classification of the sources of threats which are divided into two groups: internal or external. The article explains a necessity to establish an information security system in an educational organisation such as a college or a university. Its important part is a security forum, which gathers personnel from each department of a college or a university. The security forum specifies risks for the university information assets which will next be protected by safeguards.

scholarly journals Information Security Management System Analysis Menggunakan ISO/IEC 27001 (Studi Kasus: STMIK STIKOM Bali)

2018 ◽  
Vol 8 (1) ◽  
pp. 1
Author(s):  
Dedy Panji Agustino
Keyword(s):  
Information Security ◽  
Management System ◽  
System Analysis ◽  
Ad Hoc ◽  
Security Management ◽  
Information Security Management ◽  
Information Security Management System ◽  
Iec 27001

Informasi merupakan aset paling penting yang dimiliki oleh sebuah organisasi. Di era perkembangan teknologi yang semakin pesat ini, semua informasi yang dimiliki dapat disimpan dan dikelola secara digital. Hal ini membuat proses pengelolaan informasi di dalam organisasi menjadi semakin efektif dan efisien. Di sisi lain, keamanan informasi menjadi suatu hal yang mutlak untuk dipenuhi oleh organisasi. Kebocoran informasi pada sebuah organisasi akan berakibat tidak baik bagi keberlangsungan organisasi tersebut. Keamanan informasi harus memenuhi aspek CIA (Confidentiality, Integrity, dan Availability). Dengan semakin pesatnya perkembangan teknologi, ancaman terhadap aspek C.I.A (Confidentiality, Integrity, dan Availability) dalam sebuah organisasi juga semakin tinggi. Jika salah satu dari aspek C.I.A tersebut tidak dapat dipenuhi oleh organisasi, maka akurasi dan ketersediaan informasi pada organisasi tersebut akan dipertanyakan dan kepercayaan para pengguna informasi tersebut akan menurun sehingga berdampak besar bagi kelangsungan operasional organisasi. STMIK STIKOM Bali merupakan sebuah perguruan tinggi di bidang Teknologi Informasi di Bali yang saat ini sudah memiliki lebih dari 5000 mahasiswa. Hal tersebut membuat kompleksitas pengelolaan informasi yang dimiliki oleh STIKOM Bali cukup tinggi, sehingga aspek keamanan informasi yang dimiliki oleh STIKOM Bali menjadi sangat penting. Namun hingga saat ini belum dilakukan suatu manajemen keamanan informasi yang baik dan terstruktur yang berdasarkan kepada standar keamanan informasi bagi suatu organisasi. Pada penelitian ini, dilakukan proses analisa manajemen keamanan informasi pada infrastruktur teknologi informasi yang ada di STMIK STIKOM Bali, dan didapat hasil pengukuran tingkat kematangan sebesar 1,72 (Initial/Ad Hoc).

Sign in / Sign up

Export Citation Format

Share Document