Type : Pdf File
Page : 11 Page
Source : www.connectingsomerset.co.uk
Read This Ebook
The information created, used, stored and transmitted by your organisation forms one of its most important assets. This document shows how you can use good practice to protect this information from being maliciously or unintentionally changed (integrity); make it available when and where needed (availability); and ensure that only those with a legitimate right can access it (confidentiality).
This document should be regarded as a starting point for developing organisation-specific controls and guidance for the classification and protection of information assets. Not all the guidance provided in this document may be applicable to an organisation's specific needs. It is therefore important to understand the organisation's business requirements and to apply this guidance appropriately. The document provides general guidance only and, if fully
implemented, can only reduce, not eliminate, your vulnerability.
Organisations which regularly handle UK government protectively-marked information must continue to follow the procedures agreed with the appropriate UK security authorities. However, this guidance has been developed in conjunction with them, and similar security procedures can therefore be applied to commercial and protectively-marked information. Who this document is for: those responsible for initiating, implementing or maintaining information security in their organisation as well as those who use and process their organisation's information.
DEFINITIONS
For the purposes of this booklet the following definitions apply:
- Information Security
Information security involves the preservation of confidentiality, integrity and availability of information (reference ISO/IEC 17799:2000).
- Risk assessment
Risk assessment is the overall process of risk identification, risk analysis and risk evaluation (ISO Guide 73:2002).
- Risk management
Risk management typically includes risk assessment, risk treatment, risk acceptance and risk communication (exchange or sharing of information about risk between the decisionmaker and other stakeholders) (ISO Guide 73:2002).
Showing posts with label E-Book. Show all posts
Showing posts with label E-Book. Show all posts
Tuesday, September 25, 2007
Wednesday, September 12, 2007
Protection of sensitive information and improving IT control by implementing Six Sigma approach
by Kaskyrbekova Aigerim
Table of contents
Abstract
Introduction (purpose of the project, problem statement, motivation, significance of the
project etc)
I Data loss results: confirmed losses of sensitive data
· Which data are most sensitive?
II Leading causes of data loss.
· The primary channels for sensitive data loss
III Strategic actions to protect sensitive data
· More monitoring and measurement
· IT controls and sensitive data losses
· Lost data: lost revenues, lost customers and additional expenses
· Benefits of protecting sensitive data
IV Implementing Six Sigma approach in IT control.
· Case Studies/Applications Motorola company
· Six Sigma Methodologies
· Six Sigma’s Role in Information Technology
Conclusion
· Reference
Introduction
It’s hard to imagine what businesses would do without technology. With most commercial interactions (and transactions) riding on multiple internal and external electronic environments—and ever-mounting mandates for demonstrating accountability—organizations have more incentive than ever to keep core business data safe and secure. What are companies doing to protect their data, and are these efforts successful? My project provides a clearer understanding of the state of data protection across many different industries, and compares the characteristics, strategic and tactical Actions for improving results. Due to the under-reported nature of the issue—no organization wants to be featured on the front-page of the business press for losing customer data—the findings and numbers are enlightening, compelling, and hopefully will act as a diagnostic framework for taking action that will help to reduce data loss, customer loss, revenue loss and hence improve results.
Nowadays, protection of information became more crucial issue than two, three decades ago. The mass circulation of information allows people to find all the necessary information through internet. Therefore, protection of sensitive information such personal, financial, customers and employee information are becoming more difficult especially for big companies where from Customer Lists, to Merger and Acquisition information, emails and electronic documents companies hold most valuable and sensitive data. In high competitive world, companies are trying be most innovative in order to be profitable and sustain which come being different by creating unique products. Nevertheless, to make it so companies should protect their internal privacy this can be attack as well by external for example hackers as internal by employees and customers. In world of information overflow, each can easily gather electronic documents of most valuable and sensitive information some are trying to be benefit from selling stolen information. According to the Privacy Rights Clearinghouse (PRC) from February 15 2005 to January 19 2007 453 separate incident of data lost was recorded where almost 100 million sensitive, personally identifiable information was unprotected and stolen or lost. Based on information of stolen or lost data which was made public, it becomes clear that different industries are faced and have experienced with sensitive data lost where some companies affected more than others due to kind of industry and size of organization. In the list of organizations, which was announced as data lose, were widely known companies where trust hood is playing a big role. Thus, protecting the sensitive electronic information is a huge challenge, which can be improved by leveraging Six Sigma program by eliminating defect in order to meet customer and employees satisfaction. This report will help understand Six Sigma theory, Six Sigma tools that are available, and the ways in which Six Sigma can be applied to IT.
Read More : http://citebm.business.uiuc.edu/TWC%20Class/Project_reports_Spring2007/Information%20Trust%20and%20Compliance/kaskyrbe/kaskyrbe.pdf
Table of contents
Abstract
Introduction (purpose of the project, problem statement, motivation, significance of the
project etc)
I Data loss results: confirmed losses of sensitive data
· Which data are most sensitive?
II Leading causes of data loss.
· The primary channels for sensitive data loss
III Strategic actions to protect sensitive data
· More monitoring and measurement
· IT controls and sensitive data losses
· Lost data: lost revenues, lost customers and additional expenses
· Benefits of protecting sensitive data
IV Implementing Six Sigma approach in IT control.
· Case Studies/Applications Motorola company
· Six Sigma Methodologies
· Six Sigma’s Role in Information Technology
Conclusion
· Reference
Introduction
It’s hard to imagine what businesses would do without technology. With most commercial interactions (and transactions) riding on multiple internal and external electronic environments—and ever-mounting mandates for demonstrating accountability—organizations have more incentive than ever to keep core business data safe and secure. What are companies doing to protect their data, and are these efforts successful? My project provides a clearer understanding of the state of data protection across many different industries, and compares the characteristics, strategic and tactical Actions for improving results. Due to the under-reported nature of the issue—no organization wants to be featured on the front-page of the business press for losing customer data—the findings and numbers are enlightening, compelling, and hopefully will act as a diagnostic framework for taking action that will help to reduce data loss, customer loss, revenue loss and hence improve results.
Nowadays, protection of information became more crucial issue than two, three decades ago. The mass circulation of information allows people to find all the necessary information through internet. Therefore, protection of sensitive information such personal, financial, customers and employee information are becoming more difficult especially for big companies where from Customer Lists, to Merger and Acquisition information, emails and electronic documents companies hold most valuable and sensitive data. In high competitive world, companies are trying be most innovative in order to be profitable and sustain which come being different by creating unique products. Nevertheless, to make it so companies should protect their internal privacy this can be attack as well by external for example hackers as internal by employees and customers. In world of information overflow, each can easily gather electronic documents of most valuable and sensitive information some are trying to be benefit from selling stolen information. According to the Privacy Rights Clearinghouse (PRC) from February 15 2005 to January 19 2007 453 separate incident of data lost was recorded where almost 100 million sensitive, personally identifiable information was unprotected and stolen or lost. Based on information of stolen or lost data which was made public, it becomes clear that different industries are faced and have experienced with sensitive data lost where some companies affected more than others due to kind of industry and size of organization. In the list of organizations, which was announced as data lose, were widely known companies where trust hood is playing a big role. Thus, protecting the sensitive electronic information is a huge challenge, which can be improved by leveraging Six Sigma program by eliminating defect in order to meet customer and employees satisfaction. This report will help understand Six Sigma theory, Six Sigma tools that are available, and the ways in which Six Sigma can be applied to IT.
Read More : http://citebm.business.uiuc.edu/TWC%20Class/Project_reports_Spring2007/Information%20Trust%20and%20Compliance/kaskyrbe/kaskyrbe.pdf
Wednesday, September 5, 2007
E-Governance Information Security Standard
Draft document, Version 01, 12 Oct 2006
0. Introduction
0.1 General
This Standard has been prepared to provide a model for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an Information Security Management System (ISMS). The adoption of an ISMS should be a strategic decision for an organization. The design and implementation of an organization’s ISMS is influenced by their needs and objectives, security requirements, the processes employed and the size and structure of the organization. These and their supporting systems are expected to change over time. It is expected that an ISMS implementation will be scaled in accordance with the needs of the organization, e.g. a simple situation requires a simple ISMS solution.
This Standard can be used in order to assess conformance by interested internal and external parties.
0.2 Process approach
This Standard promotes the adoption of a process approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization's ISMS.
An organization must identify and manage many activities in order to function effectively. Any activity using resources and managed in order to enable the transformation of inputs into outputs can be considered to be a process. Often the output from one process directly forms the input to the following process.
The application of a system of processes within an organization, together with the identification and interactions of these processes, and their management, can be referred to as a “process approach”.
View All Information : E-Governance Information Security Standard
0. Introduction
0.1 General
This Standard has been prepared to provide a model for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an Information Security Management System (ISMS). The adoption of an ISMS should be a strategic decision for an organization. The design and implementation of an organization’s ISMS is influenced by their needs and objectives, security requirements, the processes employed and the size and structure of the organization. These and their supporting systems are expected to change over time. It is expected that an ISMS implementation will be scaled in accordance with the needs of the organization, e.g. a simple situation requires a simple ISMS solution.
This Standard can be used in order to assess conformance by interested internal and external parties.
0.2 Process approach
This Standard promotes the adoption of a process approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization's ISMS.
An organization must identify and manage many activities in order to function effectively. Any activity using resources and managed in order to enable the transformation of inputs into outputs can be considered to be a process. Often the output from one process directly forms the input to the following process.
The application of a system of processes within an organization, together with the identification and interactions of these processes, and their management, can be referred to as a “process approach”.
View All Information : E-Governance Information Security Standard
HIPAA Security for Wireless Networks (Ebook)
By NetMotion Wireless for ITtoolbox Wireless
Securing data in a health care setting is a daunting task. Although most facilities contain up-to-date
medical technology, many have antiquated communication networks lacking the security and
encryption required to protect patient information. The physical structures of hospitals make it
difficult or even impossible to add wiring for adequate networking, which is why many IT departments
have opted for a wireless network. Implementing a wireless LAN can be both more costeffective
and less problematic then implementing a wireline network, but they are not without their
challenges. Security risks exist and connectivity is a concern while roaming through buildings that
contain elevators, radiology room shielding, or other physical structures that “break” wireless
network sessions.
Under the mandated provisions of the Health Insurance Portability & Accountability Act (HIPAA),
IT managers now have a timeline for implementing government-legislated security and privacy
measures to protect patient data. Although HIPAA may seem burdensome, it benefits caregiver
organizations by creating a proactive measure for managing and maintaining reasonable security
safeguards and protecting patient data from unauthorized users.
View all information : http://wireless.ittoolbox.com/pub/MM020102.pdf
Securing data in a health care setting is a daunting task. Although most facilities contain up-to-date
medical technology, many have antiquated communication networks lacking the security and
encryption required to protect patient information. The physical structures of hospitals make it
difficult or even impossible to add wiring for adequate networking, which is why many IT departments
have opted for a wireless network. Implementing a wireless LAN can be both more costeffective
and less problematic then implementing a wireline network, but they are not without their
challenges. Security risks exist and connectivity is a concern while roaming through buildings that
contain elevators, radiology room shielding, or other physical structures that “break” wireless
network sessions.
Under the mandated provisions of the Health Insurance Portability & Accountability Act (HIPAA),
IT managers now have a timeline for implementing government-legislated security and privacy
measures to protect patient data. Although HIPAA may seem burdensome, it benefits caregiver
organizations by creating a proactive measure for managing and maintaining reasonable security
safeguards and protecting patient data from unauthorized users.
View all information : http://wireless.ittoolbox.com/pub/MM020102.pdf
Friday, August 31, 2007
Implementing an Information Security Management System in an Internal Web Development Environment (Ebook)
Implementing an Information Security Management System in an Internal Web Development Environment
GIAC ISO-17799 Certification (G7799)
Practical Assignment –Version 1.1
SANS 2004 (Orlando, FL)
Joseph McComb
October 28th, 2004
File Type : PDF
Page : 88 Page
Source : http://www.giac.org/certified_professionals/practicals/g7799/0019.php
I. The System Defined .............................................................................................................................3
The Company .....................................................................................................................................3
The Origin of the Environment ..............................................................................................................6
The Current Environment .....................................................................................................................7
Current Web Applications and Sites in the Environment .....................................................................10
Current State of Security ....................................................................................................................12
Scope of Information Security Management System (ISMS) ...............................................................15
II. Planning the Implementation of the Information Security Management System (ISMS).......................15
Management Structure .......................................................................................................................15
The Asset Inventory ...........................................................................................................................18
Policies .............................................................................................................................................21
Risk Identification and Analysis Process.............................................................................................23
Plans for Risk Management................................................................................................................24
III. Implementation (the “Do” phase).......................................................................................................33
Correcting the Problems Identified in the Risk Management Plan .......................................................33
Statements Of Applicability.................................................................................................................43
IV. Check –System Auditing..................................................................................................................44
V. Continuous Improvement (“Act” Phase).............................................................................................51
Improving the System Through Lessons Learned from Incident Handling ...........................................51
Improving the System through Auditing ..............................................................................................51
Bibliography..........................................................................................................................................52
Appendix A –Extended Asset Classification ..........................................................................................53
Appendix B –Policies...........................................................................................................................62
Policy –System and Application Access Control (section 9.1 of the ISO 17799 standard)...................62
Policy –Business Continuity Planning (section 11.1 of the ISO 17799 standard) ................................63
Policy –Security Engineering in the Systems Development Life Cycle (section 10.1 of the ISO 17799
standard)...........................................................................................................................................64
Appendix C –Fault Tree Analysis ..........................................................................................................65
Appendix D –Flagged System Events .................................................................................................657
Appendix E –High Level Plan for Risk Management ..............................................................................81
Appendix F –Extended Audit Checklist..................................................................................................82
Table of Figures
Figure 1. Overview of the Drug Development Stages ...............................................................................5
Figure 2. Diagram of the Web Server Environment...................................................................................8
Figure 3. Overview of the Systems Development Life Cycle...................................................................10
Figure 4. Information Flow in the Data Center Environment ....................................................................11
Figure 5. Information Flow in the Development Environment ..................................................................12
Table of Tables
Table 1. Plan for Risk Management .......................................................................................................26
Table 2. Documentation of System Problems. ........................................................................................33
Table 3. Audit Checklist for User Access Management...........................................................................45
GIAC ISO-17799 Certification (G7799)
Practical Assignment –Version 1.1
SANS 2004 (Orlando, FL)
Joseph McComb
October 28th, 2004
File Type : PDF
Page : 88 Page
Source : http://www.giac.org/certified_professionals/practicals/g7799/0019.php
Table of Contents
Abstract ..................................................................................................................................................3I. The System Defined .............................................................................................................................3
The Company .....................................................................................................................................3
The Origin of the Environment ..............................................................................................................6
The Current Environment .....................................................................................................................7
Current Web Applications and Sites in the Environment .....................................................................10
Current State of Security ....................................................................................................................12
Scope of Information Security Management System (ISMS) ...............................................................15
II. Planning the Implementation of the Information Security Management System (ISMS).......................15
Management Structure .......................................................................................................................15
The Asset Inventory ...........................................................................................................................18
Policies .............................................................................................................................................21
Risk Identification and Analysis Process.............................................................................................23
Plans for Risk Management................................................................................................................24
III. Implementation (the “Do” phase).......................................................................................................33
Correcting the Problems Identified in the Risk Management Plan .......................................................33
Statements Of Applicability.................................................................................................................43
IV. Check –System Auditing..................................................................................................................44
V. Continuous Improvement (“Act” Phase).............................................................................................51
Improving the System Through Lessons Learned from Incident Handling ...........................................51
Improving the System through Auditing ..............................................................................................51
Bibliography..........................................................................................................................................52
Appendix A –Extended Asset Classification ..........................................................................................53
Appendix B –Policies...........................................................................................................................62
Policy –System and Application Access Control (section 9.1 of the ISO 17799 standard)...................62
Policy –Business Continuity Planning (section 11.1 of the ISO 17799 standard) ................................63
Policy –Security Engineering in the Systems Development Life Cycle (section 10.1 of the ISO 17799
standard)...........................................................................................................................................64
Appendix C –Fault Tree Analysis ..........................................................................................................65
Appendix D –Flagged System Events .................................................................................................657
Appendix E –High Level Plan for Risk Management ..............................................................................81
Appendix F –Extended Audit Checklist..................................................................................................82
Table of Figures
Figure 1. Overview of the Drug Development Stages ...............................................................................5
Figure 2. Diagram of the Web Server Environment...................................................................................8
Figure 3. Overview of the Systems Development Life Cycle...................................................................10
Figure 4. Information Flow in the Data Center Environment ....................................................................11
Figure 5. Information Flow in the Development Environment ..................................................................12
Table of Tables
Table 1. Plan for Risk Management .......................................................................................................26
Table 2. Documentation of System Problems. ........................................................................................33
Table 3. Audit Checklist for User Access Management...........................................................................45
Understanding HIPAA Security Implications Of a Wireless LAN Subsystem Using the ISO/IEC 17799 ISMS Standard (Ebook)
Understanding HIPAA Security Implications Of a Wireless LAN Subsystem Using the ISO/IEC 17799 ISMS Standard
By: Frederick Hawkes
File Type : Pdf
Page : 49 Page
Read This Ebook : http://www.giac.org/certified_professionals/practicals/g7799/0012.php
Project Summary ....................................................................................................................4
Organization ...........................................................................................................................4
System Description.................................................................................................................6
Current Security Structure.......................................................................................................8
Plan-Do-Check-Act (PDCA) Process ......................................................................................9
ISMS Project Plan (PDCA … Plan)...............................................................................10
Project Scope .......................................................................................................................10
Project Timeline....................................................................................................................11
Organizational Structure and Responsibilities .......................................................................12
Policies, Guidelines, Standards or Procedures Requirements ..............................................14
Risk Identification Process ....................................................................................................16
Risks to the System..............................................................................................................19
Plans for Addressing the Risks .............................................................................................20
Selected ISO17799 Controls.................................................................................................21
ISMS Implementation Plan (PDCA … Do).....................................................................23
Overview..............................................................................................................................23
Creation and Staffing of the Security Management Team.....................................................23
Identification and Processing of Applicable Legislation .........................................................24
Data Protection and Privacy of Personal Information ............................................................25
Information Security Policy Document ..................................................................................25
Information Security Education and Training.........................................................................26
WLAN Access Control ..........................................................................................................27
Statements of Applicability....................................................................................................27
ISO 17799 Section 12.1.4 … Data Protection and Privacy of Personal Information..............28
ISO 17799 Section 12.1.2 … Intellectual Property Rights.....................................................28
ISMS Audit Plan (PDCA … Check)...............................................................................29
ISO 17799 Section 4.1.1 … Management Information Security Forum.................................29
ISO 17799 Section 12.1.1 … Identification of Applicable Legislation.....................................30
ISO 17799 Section 12.1.4 … Data Protection and Privacy of Personal Information..............31
ISO17799 Section 9.4.3 … User Authentication for External Connections............................32
ISO 17799 Section 3.1.1 … Information Security Policy Document.......................................34
By: Frederick Hawkes
File Type : Pdf
Page : 49 Page
Read This Ebook : http://www.giac.org/certified_professionals/practicals/g7799/0012.php
Table of Contents
Define the System ....................................................................................................................4Project Summary ....................................................................................................................4
Organization ...........................................................................................................................4
System Description.................................................................................................................6
Current Security Structure.......................................................................................................8
Plan-Do-Check-Act (PDCA) Process ......................................................................................9
ISMS Project Plan (PDCA … Plan)...............................................................................10
Project Scope .......................................................................................................................10
Project Timeline....................................................................................................................11
Organizational Structure and Responsibilities .......................................................................12
Policies, Guidelines, Standards or Procedures Requirements ..............................................14
Risk Identification Process ....................................................................................................16
Risks to the System..............................................................................................................19
Plans for Addressing the Risks .............................................................................................20
Selected ISO17799 Controls.................................................................................................21
ISMS Implementation Plan (PDCA … Do).....................................................................23
Overview..............................................................................................................................23
Creation and Staffing of the Security Management Team.....................................................23
Identification and Processing of Applicable Legislation .........................................................24
Data Protection and Privacy of Personal Information ............................................................25
Information Security Policy Document ..................................................................................25
Information Security Education and Training.........................................................................26
WLAN Access Control ..........................................................................................................27
Statements of Applicability....................................................................................................27
ISO 17799 Section 12.1.4 … Data Protection and Privacy of Personal Information..............28
ISO 17799 Section 12.1.2 … Intellectual Property Rights.....................................................28
ISMS Audit Plan (PDCA … Check)...............................................................................29
ISO 17799 Section 4.1.1 … Management Information Security Forum.................................29
ISO 17799 Section 12.1.1 … Identification of Applicable Legislation.....................................30
ISO 17799 Section 12.1.4 … Data Protection and Privacy of Personal Information..............31
ISO17799 Section 9.4.3 … User Authentication for External Connections............................32
ISO 17799 Section 3.1.1 … Information Security Policy Document.......................................34
Subscribe to:
Posts (Atom)
