The Adoption of Information Security Management Standards

2009 ◽  
pp. 119-140 ◽  
Author(s):  
Yves Barlette ◽  
Vladislav V. Fomin
Keyword(s):  
Information Security ◽  
Literature Review ◽  
Success Factors ◽  
Security Management ◽  
Information Security Management ◽  
Diffusion Of Information ◽  
Management Standards ◽  
Business Market ◽  
Security Standards ◽  
Iec 27001

This chapter introduces major information security management methods and standards, and particularly ISO/IEC 27001 and 27002 standards. A literature review was conducted in order to understand the reasons for the low level of adoption of information security standards by companies, and to identify the drivers and the success factors in implementation of these standards. Based on the findings of the literature review, we provide recommendations on how to successfully implement and stimulate diffusion of information security standards in the dynamic business market environment, where companies vary in their size and organizational culture. The chapter concludes with an identification of future trends and areas for further research.

The Adoption of Information Security Management Standards

2010 ◽  
pp. 69-90 ◽  
Author(s):  
Yves Barlette ◽  
Vladislav V. Fomin
Keyword(s):  
Information Security ◽  
Literature Review ◽  
Success Factors ◽  
Security Management ◽  
Information Security Management ◽  
Diffusion Of Information ◽  
Management Standards ◽  
Business Market ◽  
Security Standards ◽  
Iec 27001

This chapter introduces major information security management methods and standards, and particularly ISO/IEC 27001 and 27002 standards. A literature review was conducted in order to understand the reasons for the low level of adoption of information security standards by companies, and to identify the drivers and the success factors in implementation of these standards. Based on the findings of the literature review, we provide recommendations on how to successfully implement and stimulate diffusion of information security standards in the dynamic business market environment, where companies vary in their size and organizational culture. The chapter concludes with an identification of future trends and areas for further research.

scholarly journals Business Impacts of International Standards for Information Security Management. Lessons from Case Companies

2013 ◽  
pp. 25-40
Author(s):  
Robert M. van Wessel ◽  
Henk J. De Vries
Keyword(s):  
Information Security ◽  
Success Factors ◽  
Security Management ◽  
International Standards ◽  
Information Security Management ◽  
Financial Benefits ◽  
Business Opportunities ◽  
New Business ◽  
Iec 27001 ◽  
Iec 27002

This paper describes the business impact of two international standards for information security management: ISO/IEC 27001 and ISO/IEC 27002. Six company cases show that companies had different reasons for wanting to implement these standards, but that they achieved most of their objectives. Benefits include improved service quality, higher customer satisfaction, and in some cases, new business opportunities. A number of common success factors ensure the objectives can be achieved, and financial and non-financial benefits can indeed be obtained. The lessons learnt from these cases can help other companies to also reap such benefits.

scholarly journals Analisis Sistem Manajemen Keamanan Informasi Menggunakan ISO/IEC 27001 : 2013 Serta Rekomendasi Model Sistem Menggunakan Data Flow Diagram pada Direktorat Sistem Informasi Perguruan Tinggi

2016 ◽  
Vol 6 (1) ◽  
pp. 38
Author(s):  
Yuni Cintia Yuze ◽  
Yudi Priyadi ◽  
Candiwan .
Keyword(s):  
Information Security ◽  
Asset Management ◽  
Management System ◽  
Security Management ◽  
Maturity Level ◽  
Information Security Management ◽  
Capability Maturity ◽  
Information Security Management System ◽  
Level 3 ◽  
Iec 27001

The importance of information and the possible risk of disruption, therefore the universities need to designed and implemented of the information security.  One of the standards that can be used to analyze the level of information security in the organization is ISO/IEC 27001 : 2013 and this standard has been prepared to provide requirements for establishing, implementing, maintaining and continually improving an information security management system. The objective of this research is to measure the level of information security based on standard ISO/IEC 27001: 2013 and modeling systems for information security management. This research uses descriptive qualitative approach, data collection and validation techniques with tringulasi (interview, observation and documentation). Data was analyzed using gap analysis and to measure the level of maturity this research uses SSE-CMM (Systems Security Engineering Capability Maturity Model). Based on the research results, Maturity level clause Information Security Policy reaches level 1 (Performed-Informally), clause Asset Management reaches level 3 (Well-Defined), clause Access Control reaches level 3 (Well-Defined), clause Physical and Environmental Security reaches level 3 (Well-Defined), clause Operational Security reaches level 3 (Well-Defined), Communication Security clause reaches the level 2 (Planned and Tracked). Based on the results of maturity level discovery of some weakness in asset management in implementing the policy. Therefore, the modeling system using the flow map and CD / DFD focused on Asset Management System.

scholarly journals Information Security Management System Analysis Menggunakan ISO/IEC 27001 (Studi Kasus: STMIK STIKOM Bali)

2018 ◽  
Vol 8 (1) ◽  
pp. 1
Author(s):  
Dedy Panji Agustino
Keyword(s):  
Information Security ◽  
Management System ◽  
System Analysis ◽  
Ad Hoc ◽  
Security Management ◽  
Information Security Management ◽  
Information Security Management System ◽  
Iec 27001

Informasi merupakan aset paling penting yang dimiliki oleh sebuah organisasi. Di era perkembangan teknologi yang semakin pesat ini, semua informasi yang dimiliki dapat disimpan dan dikelola secara digital. Hal ini membuat proses pengelolaan informasi di dalam organisasi menjadi semakin efektif dan efisien. Di sisi lain, keamanan informasi menjadi suatu hal yang mutlak untuk dipenuhi oleh organisasi. Kebocoran informasi pada sebuah organisasi akan berakibat tidak baik bagi keberlangsungan organisasi tersebut. Keamanan informasi harus memenuhi aspek CIA (Confidentiality, Integrity, dan Availability). Dengan semakin pesatnya perkembangan teknologi, ancaman terhadap aspek C.I.A (Confidentiality, Integrity, dan Availability) dalam sebuah organisasi juga semakin tinggi. Jika salah satu dari aspek C.I.A tersebut tidak dapat dipenuhi oleh organisasi, maka akurasi dan ketersediaan informasi pada organisasi tersebut akan dipertanyakan dan kepercayaan para pengguna informasi tersebut akan menurun sehingga berdampak besar bagi kelangsungan operasional organisasi. STMIK STIKOM Bali merupakan sebuah perguruan tinggi di bidang Teknologi Informasi di Bali yang saat ini sudah memiliki lebih dari 5000 mahasiswa. Hal tersebut membuat kompleksitas pengelolaan informasi yang dimiliki oleh STIKOM Bali cukup tinggi, sehingga aspek keamanan informasi yang dimiliki oleh STIKOM Bali menjadi sangat penting. Namun hingga saat ini belum dilakukan suatu manajemen keamanan informasi yang baik dan terstruktur yang berdasarkan kepada standar keamanan informasi bagi suatu organisasi. Pada penelitian ini, dilakukan proses analisa manajemen keamanan informasi pada infrastruktur teknologi informasi yang ada di STMIK STIKOM Bali, dan didapat hasil pengukuran tingkat kematangan sebesar 1,72 (Initial/Ad Hoc).

Sign in / Sign up

Export Citation Format

Share Document