Information Security Management Process

Information Security Management process is the centre for all security issues inside the organisation. Its mission is to produce the policy for information security. Such policy covers all issues regarding the uses or misuses of IT services and respective systems. Today’s IT environment covers many services and technological solutions. Hence it is difficult for one document, i.e. policy to cover all the necessary issues. The information security policy could be the core document which comprises specific documents that regulate the particular areas. For instance, each of these areas can have a stand-alone policy: BYOD, access to the IT systems, passwords, clean desk, supplier, backup, etc.

If there is no information security process in place,

IT systems security and procedures play a huge role in Information Security Management. Following are some of the important concepts of ISM as shown in Fig. 2.2.1:

• Information assurance – It is the management of all risks which concerns the information. It includes identifying and taking defensive measures to address the basic ‘CIA’ trio of concerns in respect of information and information handling systems. They are Confidentiality, Integrity and Availability, even though in practice there are other concerns. Information assurance also includes planning and setting upof measures to observe, detect and react to the Information Security breaches, and also to restore the information and information systems when

An instance of a security failure concerning the information availability might be the prevention of authorized persons who can access the corporate data because of an internet based DOS (denial of service) attack. Another example might be the inability to run a payroll program because of an accidental deletion of the staff data file. Two levels of security objectives are to be met in availability: availability of information and usable when needed, and systems that provide information which can resist attacks and recover from failures.

• Integrity – Integrity is an assurance that the information has not been modified or tampered in storage or transmission by someone other than authorized persons or processes. Integrity covers any form of unauthorized change; it can deliberate or otherwise. A suitable example might be the modification of data which is stored in a computer by the action of a computer virus. Security objectives are met when information is completely accurate and also protected against unauthorized