Information Security Evaluation

1. Auflage 2011
ISBN: 978-1-4398-7915-3
Verlag: EPFL Press

Buch, Englisch, 300 Seiten, Format (B × H): 172 mm x 257 mm, Gewicht: 517 g

Information systems have become a critical element of every organization’s structure. A malfunction of the information and communication technology (ICT) infrastructure can paralyse the whole organization and have disastrous consequences at many levels. On the other hand, modern businesses and organizations collaborate increasingly with companies, customers, and other stakeholders by technological means. This emphasises the need for a reliable and secure ICT infrastructure for companies whose principal asset and added value is information.

This book proposes a global and systemic multidimensional integrated approach to the holistic evaluation of the information security posture of an organization. The Information Security Assurance Assessment Model (ISAAM) presented in this book is based on, and integrates, a number of information security best practices, standards, methodologies and sources of research expertise, in order to provide a generic model that can be implemented in organizations of all kinds as part of their efforts towards better governing their information security.

This approach will contribute to improving the identification of security requirements, measures and controls. At the same time, it provides a means of enhancing the recognition of evidence related to the assurance, quality and maturity levels of the organization’s security posture, thus driving improved security effectiveness and efficiency. The value added by this evaluation model is that it is easy to implement and operate and that through a coherent system of evaluation it addresses concrete needs in terms of reliance on an efficient and dynamic evaluation tool.

Autoren/Hrsg.

Tashi, Igli

Ghernaouti-Helie, Solange

Fachgebiete

• Mathematik | Informatik EDV | Informatik Technische Informatik Computersicherheit
• Mathematik | Informatik EDV | Informatik Computerkommunikation & -vernetzung Netzwerksicherheit
• Wirtschaftswissenschaften Betriebswirtschaft Wirtschaftsinformatik, SAP, IT-Management
• Mathematik | Informatik EDV | Informatik Daten / Datenbanken Kryptologie, Informationssicherheit

Inhaltsverzeichnis

What is Information Security?

Risk Management versus Security Management

Information Security Assurance: an Assessment Model

Evaluating the Organizational Dimension

Evaluating the Functional Dimension

Evaluating the Human Dimension

Evaluating the Compliance Dimension

Concluding Remarks

Bibliography

Index of Keywords and Concepts

Über Autor(innen)

Tashi, Igli
Igli Tashi holds a Ph.D. in Information Systems and a Master of Advanced Studies in Legal Issues, Crime and ICT Security, both from the University of Lausanne. He is an expert on information security and risk management issues and works currently as a Senior Auditor for PricewaterhouseCoopers SA in Switzerland.

Ghernaouti-Helie, Solange
Solange Ghernaouti-Hélie is a professor in the Faculty of Business and Economics at the University of Lausanne and well-known recognised international expert on cybersecurity and cybercrime-related issues. She has developed an interdisciplinary and integrative security approach for citizens, organisations and states, and she is author of more than twenty books on telecommunications and security issues.

Igli Tashi holds a Ph.D. in Information Systems and a Master of Advanced Studies in Legal Issues, Crime and ICT Security, both from the University of Lausanne. He is an expert on information security and risk management issues and works currently as a Senior Auditor for PricewaterhouseCoopers SA in Switzerland.

Solange Ghernaouti-Hélie is a professor in the Faculty of Business and Economics at the University of Lausanne and well-known recognised international expert on cybersecurity and cybercrime-related issues. She has developed an interdisciplinary and integrative security approach for citizens, organisations and states, and she is author of more than twenty books on telecommunications and security issues.