Hasil Pencarian  ::  Simpan CSV :: Kembali

"This book constitutes the refereed proceedings of the 17th European Symposium on Computer Security, ESORICS 2012, held in Pisa, Italy, in September 2012. The 50 papers included in the book were carefully reviewed and selected from 248 papers. The articles are organized in topical sections on security and data protection in real systems, formal models for cryptography and access control, security and privacy in mobile and wireless networks, counteracting man-in-the-middle attacks, network security, users privacy and anonymity, location privacy, voting protocols and anonymous communication, private computation in cloud systems, formal security models, identity based encryption and group signature, authentication, encryption key and password security, malware and phishing, and software security."

"PT XYZ bergerak pada bisnis jasa pialang asuransi. Pada pelaksanaan proses bisnisnya telah terjadi beberapa kali pencurian data. Selain itu dari audit yang dilakukan oleh Departemen Keuangan menunjukan bahwa dibutuhkan evaluasi terhadap keamanan informasi perusahaan. Evaluasi kondisi Manajemen Keamanan Informasi pada penelitian ini dilakukan dari sisi tata kelola TI untuk melihat kondisi Manajemen Keamanan Informasi dari sisi strategis perusahaan.Penelitian ini menggunakan kerangka kerja ISO 27001 dan COBIT untuk mengevaluasi kondisi manajemen keamanan informasi perusahaan. Sementara itu untuk mengevaluasi kondisi strategis pencapaian manajemen keamanan informasi digunakan IT BSC. Hasil akhir yang didapatkan adalah kondisi terkini Manajemen Keamanan Informasi.

---

PT XYZ is a corporation that runs insurance brokerage business. On the implementation of business processes there was data fraud occured several times . In addition, from an audit conducted by the Ministry of Finance shows that it’s necessary to made an evaluation of coorporation’s information security. Evaluation of Information Security Management conditions in this research was carried out from the side of IT governance to evaluate the information security management of the company's strategic.

This research use the framework of ISO 27001 and COBIT to evaluate the condition of coorporation’s information security management. Meanwhile, to evaluate the condition of the achievement of the strategic information security management IT BSC was used. The final result that obtained is the current state of information security management."

"Sertifikasi di lingkungan Direktorat XYZ sebagai salah satu aktivitas utama di lingkungan Direktorat XYZ tidak lepas dari peran SI/TI untuk mendukung layanan sertifikasi secara optimal, yang pada akhirnya dapat memberikan layanan optimal sertifikasi. Agar dapat memberikan layanan prima sertifikasi, diperlukan adanya data yang berkualitas, yang dapat memenuhi kriteria, reliabilitas, integritas, dan ketersediaannya.COBIT 4.1 dan SNI ISO/IEC 27001:2009 merupakan kerangka kerja tata kelola TI dan standar keamanan informasi yang merupakan praktik terbaik. Pengkombinasian keduanya dalam penyusunan kebijakan tata kelola TI digunakan dalam penelitian sebagai dasar dalam penyusunan rancangan kebijakan dan prosedur pengelolaan data, dengan harapan dapat menghasilkan kebijakan dan prosedur yang komprehensif dan memberikan manfaat pengelolaan keamanan informasi bagi organisasi yang menerapkan keduanya.Metode yang digunakan dalam penelitian ini adalah observasi, kuisioner dan wawancara berdasarkan COBIT 4.1 dan SNI ISO/IEC 27001:2009. Selain itu, digunakan metode Delphi untuk validasi rancangan kebijakan dan prosedur. Berdasarkan hasil penilaian dan analisis risiko, dipilih kontrol-kontrol yang dapat diterapkan untuk meningkatkan keamanan informasi. Kontrol-kontrol tersebut dimasukkan dalam rancangan kebijakan dan prosedur keamanan informasi. Berdasarkan hasil kuisioner dan wawancara, dilakukan identifikasi dan analisis hasil pengukuran kematangan, analisis kesenjangan tingkat kinerja dan tingkat kematangan, analisis hasil penilaian risiko, identifikasi dan analisis dampak, identifikasi dan analisis kelemahan kontrol. Berdasarkan COBIT 4.1 dipilih proses-proses yang menghasilkan masukan (input) dalam proses pengelolaan data dan memastikan keamanan sistem sebagai aktivitas dan proses dalam rancangan kebijakan dan prosedur pengelolaan data.Hasil pengukuran kinerja berdasarkan COBIT 4.1 menunjukkan bahwa kinerja DS5 dann DS11 masih kurang. Sedangkan hasil pengukuran kematangan menunjukkan proses pengelolaan data dan memastikan keamanan sistem berada pada tingkat 2 (dua), dengan harapan tingkat kematangan berada pada tingkat 4 (empat). Berdasar hasil penilaian kematangan disusun rekomendasi tindakan perbaikan untuk peningkatan kematangan, antara lain penyusunan kebijakan dan prosedur pengelolaan data dengan memperhatikan aspek keamanan sistem serta tim/kelompok kerja yang bertugas mengevaluasi dan mengawasi pelaksanaan kebijakan dan prosedur. Pengendalian dalam kebijakan dan prosedur keamanan informasi sesuai dengan ISO/IEC 27001:2005 meliputi pengendalian: organisasi keamanan informasi,pengelolaan aset informasi, keamanan SDM, keamanan fisik dan lingkungan, pengelolaan komunikasi dan operasional, pengaturan akses, keamanan informasi dalam pengadaan dan pemeliharaan sistem informasi, pengelolaan gangguan keamanan informasi, keamanan informasi dalam pengelolaan kealngsungan kegiatan, dan kepatuhan.Dalam rancangan kebijakan dan prosedur pengelolaan data dengan memperhatikan aspek keamanan informasi, COBIT 4.1 digunakan sebagai payung kebijakan tata kelola TI khususnya pada pengelolaan data; sedangkan dan ISO/IEC 27001:2005 digunakan sebagai acuan dalam penyusunan kebijakan keamanan informasi. Keduanya saling melengkapi menghasilkan kebijakan dan prosedur yang komprehensif mencakup people, process, dan technology untuk mencapai kerahasiaan, ketersediaan, dan integritas informasi. Kerahasiaan, ketersediaan, dan integritas data dan informasi dicapai melalui aktivitas dan proses serta kontrol yang sesuai untuk diterapkan.

---

Certification in Directorate XYZ as one of the main activities of the Directorate XYZ can’t be separated from the role of IS / IT to support optimal certification services, which in turn can provide excellent service in certification. In order to provide excellent service certification, that is required a high-quality data, which can meet the criteria, reliability, integrity, and availability.

COBIT 4.1 and ISO / IEC 27001:2009 is an IT governance framework and information security standards that are best practices. Combine both in policy making IT governance is used in this research as a basis for drafting policies and procedures of data management, with the hope of producing a comprehensive policy and procedures and provide the benefits of information security management for organizations that implement them. The method used in this study is the observation, questionnaires and interviews based on COBIT 4.1 and ISO / IEC 27001:2009. In addition, the Delphi method was used to validate the design of policies and procedures. Based on the results of risk assessment and analysis, controls that can be applied to improve information security are selected. The controls are incorporated in the draft of information security policies and procedures. Based on the results of questionnaires and interviews, to identify and analyze the results of the measurement of maturity, gap analysis and the maturity level of performance, analysis of the results of risk assessment, identification and impact analysis, identification and analysis of control weaknesses. This selection is based on COBIT 4.1 processes that produce inputs to the data management process and ensure the security of the system as activities and processes in the design of data management policies and procedures.

The results of performance measurements based on COBIT 4.1 shows that the performance of DS5 and DS11 is still lacking. While the results of measurements show the maturity of data management and ensure the security of the system is at the level of 2 (two), in the hope of maturity level is at level 4 (four). Based on maturity assessments prepared recommendations for the improvement of the maturity of remedial actions, including design of policies and procedures for data management by taking into account the security aspects of the system and the team / work group charged with evaluating and overseeing the implementation of policies and procedures. Control the information security policies and procedures in accordance with ISO/IEC 27001:2005 covers control: the organization of information security, asset management information, human resources security, physical and environmental security, communications and operations management, access arrangements, the security of information in the procurement and maintenance of information systems, management of information security threats, business continuity management, and compliance.

In the design of policies and procedures with respect to data management aspects of information security, COBIT 4.1 is used as a reference policy governance of IT especially in data management; while and ISO / IEC 27001:2005 is used as a reference for information security policy. Both complement each other producing a comprehensive policy and procedures covering people, process, and technology to achieve confidentiality, availability, and integrity of information. Confidentiality, availability and integrity of data and information are achieved through the activities and processes and controls that are appropriate to be applied."

"Abstract:"Effective security rules and procedures do not exist for their own sake-they are put in place to protect critical assets, thereby supporting overall business objectives. Recognizing security as a business enabler is the first step in building a successful program.Information Security Fundamentals allows future security professionals to gain a solid understanding of the foundations of the field and the entire range of issues that practitioners must address. This book enables students to understand the key elements that comprise a successful information security program and eventually apply these concepts to their own efforts. The book examines the elements of computer security, employee roles and responsibilities, and common threats. It examines the need for management controls, policies and procedures, and risk analysis, and also presents a comprehensive list of tasks and objectives that make up a typical information protection program.The volume discusses organizationwide policies and their documentation, and legal and business requirements. It explains policy format, focusing on global, topic-specific, and application-specific policies. Following a review of asset classification, the book explores access control, the components of physical security, and the foundations and processes of risk analysis and risk management. Information Security Fundamentals concludes by describing business continuity planning, including preventive controls, recovery strategies, and ways to conduct a business impact analysis""