• Join over 1.2 million students every month
  • Accelerate your learning by 29%
  • Unlimited access from just £6.99 per month

Defining the scope of the Information Security Management System (ISMS) in a company

Extracts from this document...

Introduction

Learning Task 2

Part 1

Submitted work:

Defining the scope of the Information Security Management System (ISMS) in a company depends on the company itself.

Organisationthe Company is a small business with 10 employees which produces printed goods (T-Shirts and other items capable of taking logos, printed text or photos). The company also undertakes other printing work such as business cards, flyers.

Locationthe Company have permanent premises from which they operate from but also operate and take orders on-line. The website is hosted by an external host.

Assets the company has two computers and printers to produce the printed goods. The company also has materials such as stationary (paper, pens) and materials to produce designs on (T-Shirts).

Technology Outlook Express is used for mail communication. The company must use a range of multimedia software to produce printed goods. The company has two computers one of which is High Spec used for accounting and ordering and the other for the printers.

Information security management system is a set of policies connected with information security management and information security risks. The expressions came from ISO 27001.

“The principle behind ISMS

...read more.

Middle

Assess impact rating of assetsIdentify threatsIdentify and prioritise threats and threat agentsAssess likelihood for vulnerabilitiesCalculate relative risk factor for assets

From the above the company will determine whether it is cost beneficial to place for example a lock on the stationary room, if the lock cost more than the stationary then it can indeed be seen as useless reason being that the stationary can be replaced if stolen this would be a cheaper alternative to buying a lock. But a lock could act as a deterrent to stop the theft in the first place.

Web hosting as the site is not hosted by the company is it secure and safe, is it vulnerable to attack from the web hosting side. Secure passwords should be used which use a combination keyboard keys, it is also vital to see what security measures the hosting company has in place. If a hacker gets control of the company’s website then secure card details are at risk.

Online sales are being processed through the website are the credit/debit card details and customer details safe and are they being encrypted e.g. SSL, where are the details being saved and who has access to them. Is the website secure e.g. VeriSign secure SSL or MacAfee hacker tested?

Are there any validations on computerized processes that are completed by employees to reduce human error, e.g. a form would only allow alphabetical letters and not allow numbers in certain text boxes such as ‘Name’ to avoid errors, or have drop down combo boxes for dates.

Data protection is also vital as data should be protected either by access control, encryption and passwords. Only allowing the accounts department access to employee payrolls would increase data protection as the risk of data theft, loss and corruption occurring is reduced. As well as that the company needing to check whether the customer data is secure and employee data is secures as well as it being backed up regularly.

Access Control

Identification

  • Obtaining the identity of the person requesting access to a logical or physical area. So if an employee wants to login to a workstation they need to identify themselves with a username.

Authentication

  • Confirming the identity of the person seeking access to a logical or physical area. This links in with identification the user enters a password to authenticate that it is he/she that wants to login; otherwise anyone can login to a workstation with another. Users should have their own usernames and passwords.

Authorization

  • Determining which actions that a person can perform in that physical or logical area. This is where access control comes into play; authorization is a very big factor in controlling what users can access and what they cannot access.  A user (who does not work for the finance department) should not be able to access to financial accounts as this should only be accessed by the finance department, if access was granted the employee could change his pay or others. Access control also narrows down the chances of risks occurring. Each user should have access control on their accounts limiting them to the functions they need to do their job.

Accountability

  • Documenting the activities of the authorized individual and systems. This is like a web browser which remembers each webpage visited, monitoring software such as Net Support can be used to log what users are accessing and modifying. Everything should be logged to deter employees from wrong doing.
...read more.

Conclusion

Premises

The premises should have locks on doors, CCTV and alarmed so that the data on the computers inside the premises is secure and reasonable steps have been taken to secure it

Conclusion:

Overall to comply with ISO 27001 the company needs to start looking at risks starting within the company itself, the employees are the most likely risk, steps should be taken to implement access control to the current system. The external system should be secured by means IDPS, if that is not possible a firewall should be put in place to secure the system and configured for the company’s requirements. The website should be secured if not already even if this means moving to a different host, loosing customer data to hackers could mean a drop in sales as customers will not believe their data is safe within the company, the company being sued under the Data Protection Act 1998.  

References:

Websites

http://security.practitioner.com/introduction/infosec_4_4.htm

http://en.wikipedia.org/wiki/ISO/IEC_27001

Books

Implementing ISO27001 in a Windows Environment By Brian Honan

Information Security Based on ISO 27001/ISO 27002: A Management Guide By Alan Calder

...read more.

This student written piece of work is one of many that can be found in our University Degree Information Systems section.

Found what you're looking for?

  • Start learning 29% faster today
  • 150,000+ documents available
  • Just £6.99 a month

Not the one? Search for your essay title...
  • Join over 1.2 million students every month
  • Accelerate your learning by 29%
  • Unlimited access from just £6.99 per month

See related essaysSee related essays

Related University Degree Information Systems essays

  1. This research is about Management of network operating system at Natural Forest Resources management ...

    for the period of four month i.e. from October 2007 to January 2008. The study was concentrated on the followings: o How to manage the network to develop the organization. o Also on how to manage network operating system in the organization.

  2. Systems Life Cycle. The main disadvantage of the traditional waterfall method is with the ...

    has standardised the symbols used in a DFD, making it a popular tool used within this methodology. A DFD represents the following four entities with the following symbols2: * Data flows - the movement of data within the system * Data stores - data that is stored and not moving

  1. The purpose of this paper is to provide an analysis of Cisco Systems primary ...

    Many companies currently compete in the networking arena or computer hardware but do not focus on Cisco's core market and networking equipment. Several of these companies like Siemens or Dell are large and would have the resources required to shift focus.

  2. Knowledge Management

    Refer to figure 1. Nonaka and Takeuchi (1995) state that there are two ways to expand and strengthen knowledge. The first way an organisation can create knowledge is through the interactions between explicit knowledge and tacit knowledge. The second way is moving knowledge from the individual level, group level, organisational level and inter-organisational level.

  1. Network Proposal. Androsia Superior Fabrics has solicited the services of ML-DD IT Consultants ...

    The network performance variables include: o Network throughput o User response times o Line utilization o Monitoring and tuning the network for performance o Collecting performance data * Security Management will be accomplished by controlling access to network resources

  2. Creating a shopping website with Project management

    the group assumed the project would be completed on time otherwise a F0 grade would be given, this assumption was important, missing this deadline would mean that the project counted zero. As well as the above the group assumed risks that could affect the project and acted to ensure these risks did not magnify into a serious problem.

  1. Facebook and its Multimedia elements

    SOCIAL PLUGINS Social plugins are the simplest way to get started with facebook in a major piece of software, as an operating system, an operating environment, or a database, under which various smallerapplication programs can be designed to run. The plugins are inserted social features that can be organised into your site with a line of HTML code.

  2. Organisational Information Systems. In this assignment I have chosen the accounting department, I ...

    Low training cost for the company to train a user 2. Simple operation of the software 3. Cost effective expansion of the business 4. Instant installation process 1. Can be costly at the start Intacct This software is more based for online businesses and it also specializes in financial management and accounting applications.

  • Over 160,000 pieces
    of student written work
  • Annotated by
    experienced teachers
  • Ideas and feedback to
    improve your own work