Information security management

The research has shown that the most vulnerable point in most information systems is the human user, operator, designer, or other human. The ISO/IEC 27002:2005 Code of practice for information security management recommends the following be examined during a risk assessment:

• security policy,

• organization of information security,

• asset management,

• human resources security,

• physical and environmental security,

• communications and operations management,

• access control,

• information systems acquisition, development and maintenance,

• information security incident management,

• business continuity management, and

• regulatory compliance.

In broad terms the risk management process consists of:

1. Identification of assets and estimating their value. Include: people, buildings, hardware, software, data (electronic, print, others), supplies.

2. Conduct a threat assessment. Include: Acts of nature, acts of war, accidents, malicious acts originating from inside or outside the organization.

3. Conduct a vulnerability assessment, and for each vulnerability calculate the probability that it will be exploited. Evaluate policies, procedures, standards, training, physical security, quality control, technical security.

4. Calculate the impact that each threat would have on each asset. Use qualitative analysis or quantitative analysis.

5. Identify, select and implement appropriate controls. Provide a proportional response. Consider productivity, cost effectiveness, and value of the asset.

6. Evaluate the effectiveness of the control measures. Ensure that controls provide the required cost effective protection without discernible loss of productivity.

For any given risk, Executive Management can choose to accept the risk based upon the relative low value of the asset, the relative low frequency of occurrence, and the relative low impact on the business. Or, leadership may choose to mitigate the risk by selecting and implementing appropriate control measures to reduce the risk. In some cases, the risk can be transferred to another business by buying insurance or out-sourcing to another business. The reality of some risks may be disputed. In such cases leadership may choose to deny the risk. This is itself a potential risk.

 

Vocabulary

vulnerable – уязвимый

point – пункт, место

human – человек

examine – исследовать

asset – актив

environmental – экологический

access – доступ

control – средства управления; контроль

acquisition – приобретение

development – развитие

maintenance – обслуживание, эксплуатация

incident – инцидент

continuity – непрерывность

regulatory – установленные требования

compliance – соответствие

in broad terms – в общих чертах

consist – состоять

estimate – оценивать

include – включать

supplies – питание, подвод; комплектующие

conduct – проводить

accident – несчастный случай

malicious – злонамеренный, вредный

originate – происходить

calculate – вычислять

probability – возможность

exploit – использовать

evaluate – оценивать

impact – влияние

select – выбирать

implement – осуществлять

appropriate – соответствующий, подходящий

response – ответ, реакция

consider – рассматривать

productivity – производительность

measure – мера

discernible – заметный, видимый

executive – исполнительный

choose – выбирать

accept – принимать

relative – относительный

frequency – частота

occurrence – возникновение

mitigate – уменьшать

insurance – страховка

out-sourcing – аутсорсинг, привлечение других,

передача функций другим

reality – реальность, действительность

dispute – оспаривать, ставить под сомнение

deny – отрицать, отвергать

ISO/IEC = International Organization for Standardization/ International Electrotechnical Commission – стандарт ISO/IEC, стандарт Международной комиссии по стандартизации и Международной электротехнической комиссии

 

Exercises