Securing Information Systems

SECURING INFORMATION SYSTEMS
It includes policies, procedures and technical measures used to prevent

unauthorized access, alteration, theft and physical damage to information system.
ESTABLISHING A FRAME WORK FOR

SECURITY AND CONTROL
RISK ASSESSSMENT:
Level of risk to the firm if certain activity is not properly controlled
INCLUDES:
 Determination of value of information assets.
 Points of vulnerability.
 Probability of occurrence of a problem.
 Potential for damage.
Assessment of risk helps system builders to focus on points that have greatest
potential for loss and to minimize the potential loss.
SECURITY POLICY:
Security policies are statements ranking information risks, identifying goals and
give mechanism for achieving these goals.
TASKS OF SECURITY GROUP:

 Training users.
 Giving awareness about security threats.
 Maintaining tools to implement security.
The security group is headed by CHIEF SECURITY OFFICER.
ACCEPTABLE USE POLICY:

Policy that defines acceptable uses of firms information resources and computing
equipments. These equipments include desktop and laptop computers, wireless
devices, telephones and the internet. A good policy defines unacceptable and
acceptable actions for every user.
AUTHORIZATION POLICY:
Authorization policies are policies that determine different access levels of
information for different levels of users.
AUTHORIZATION MANAGEMENT SYSTEMS:
They explain when and how users are permitted to access certain parts of
corporate database.
This system knows exactly what information each user is permitted to access.
Some users can update information but cannot read the updated information; others
cannot update but can read the updated information.
ENSURING BUSINESS CONTINUITY:
Firms need to ensure that their systems and applications are always available.
ONLINE TRANSACTION PROCESSING:

Changes in databases occur instantly as online transactions are processed by
computers.
FAULT TOLERANT COMPUTER SYSTEMS:
Contain redundant hardware software and power supply that provide uninterrupted
service.
Such computers use software that detect hardware failure and automatically switch
to a backup device.
Repairing of such computer components can be done without disruption to the
system.
DOWN TIME:
Periods of time in which a system is not operational
HIGH AVAILABILITY COMPUTING:

High availability computing helps to recover quickly from a system crash.
It’s a requirement of firms with heavy electronic commerce transactions.
High availability computing Require:
 Backup servers.
 High storage.
 Disaster recovery and business plans.
FAULT TOLERANCE COMPUTER SYSTEMS:

Fault tolerance computer systems provide continuous availability and also
eliminate recovery time.
RECOVERY ORIENTED COMPUTING:

Recovery oriented computing is an approach to design computers that recover
quickly, and allocate the sources of faults and then correct mistakes.
DISASTER RECOVERY PLANNING:

Disaster recovery plans focus primarily on technical issues involved in keeping
systems running.
It consists of plans for the restoration of computing and communication services
after they have been disrupted by events like earthquake, terrorist attacks etc.
BUSINESS CONTINUITY PLANNING:

Business continuity planning make plans to restore business operations after
strikes. Such plans identify critical business processes and determine plans for
handling functions if systems go down.
SECURITY OUTSOURCING:
Many companies lack resources to provide secure high computing environment

such firms hire managed security service providers to monitor network activity and
to perform vulnerability testing.
AUDITING:
An audit examines the firms overall security environment and controls individual
information systems.
Security audits review technologies, procedures, documentation, training, and

personnel.
An audit can stimulate an attack to test the response of the technology.
Audit lists and ranks all weaknesses and estimate the probability of their
occurrence.
……………………………………………………………………………………….

Securing Information Systems

Uploaded by

Copyright:

Available Formats

Securing Information Systems

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Securing Information Systems

Uploaded by

Copyright:

Available Formats

SECURING INFORMATION SYSTEMS

It includes policies, procedures and technical measures used to prevent

ESTABLISHING A FRAME WORK FOR

TASKS OF SECURITY GROUP:

The security group is headed by CHIEF SECURITY OFFICER.

ACCEPTABLE USE POLICY:

ENSURING BUSINESS CONTINUITY:

ONLINE TRANSACTION PROCESSING:

FAULT TOLERANT COMPUTER SYSTEMS:

HIGH AVAILABILITY COMPUTING:

It’s a requirement of firms with heavy electronic commerce transactions.

High availability computing Require:

FAULT TOLERANCE COMPUTER SYSTEMS:

RECOVERY ORIENTED COMPUTING:

DISASTER RECOVERY PLANNING:

BUSINESS CONTINUITY PLANNING:

Many companies lack resources to provide secure high computing environment

Security audits review technologies, procedures, documentation, training, and

An audit can stimulate an attack to test the response of the technology.

You might also like