Information security management standards: Problems and solutions

International information security management guidelines play a key role in managing and certifying organizational IS. We analyzed BS7799, BS ISO/IEC17799: 2000, GASPP/GAISP, and the SSE-CMM to determine and compare how these guidelines are validated, and how widely they can be applied. First, we found that BS7799, BS ISO/IEC17799: 2000, GASPP/GAISP and the SSE-CMM were generic or universal in scope; consequently they do not pay enough attention to the differences between organizations and the fact that their security requirements are different. Second, we noted that these guidelines were validated by appeal to common practice and authority and that this was not a sound basis for important international information security guidelines. To address these shortcomings, we believe that information security management guidelines should be seen as a library of material on information security management for practitioners.     

Information security management standards: Compliance, governance and risk management

Managing information security as opposed to the IT security is an area that is now eventually coming of age. For many years the focus has been mainly on IT security and with the implementation of such security left to the IT department and technical experts. Early in the 90s things started to change with the first draft of an information security management standard BS 7799 focusing in on security related to people, processes, information as well as IT. Since then there has been many developments taking us to where we are today with these early security management standards being transformed in international standards published by ISO/IEC. These standards are being used by hundreds of thousands of organisations using these standards worldwide. Based on the authors previously copyrighted writings, this article explores what these standards have got to offer organisations, what benefits are to be gained and how such standards have helped with compliance. In particular it focuses in on the insider threat as an example of one of the growing problems that organisations need to deal with and how these international standards are useful in helping to solve the insider threat problem.     

Information security analysis system

The analysis system is a collection, configuration and integration of software programs that reside on multiple interconnected computer platforms The software, less computer operating systems, is a combination of sensor, analysis, data conversion, and visualization programs The hardware platforms consist of several different types of interconnected computers, which share the software programs, data files, and visualization programs via a Local Area Network (LAN) This collection and integration of software and the migration to a single computer platform results in an approach to LAN/WAN monitoring in either a passive and/or active mode. The architecture permits digital data input from external sensors for analysis, display and correlation with data and displays derived from four major software concept groups These are: Virus Computer Code Detection; Analysis of Computer Source and Executable Code,. Dynamic Monitoring of Data Communication Networks; 3-D Visualization and Animation of Data     

基于区块链的数据安全管理系统

数据作为21世纪最重要的资源财富,能为人们创造巨大的商业价值,而数据共享能使收益最大化.针对数据共享存在的隐私泄露、第三方信任危机、数据确权等问题,提出一种基于区块链场景的数据安全管理系统.利用区块链共识协议实现去中心化的数据共享,隐私安全是数据共享的关键,采用签密和基于LWE的BGN加密方案解决隐私泄露问题,采用区块...     

Cyber-physical system homeostatic security management

Characteristic features of security management for the cyber-physical system (CPS) have been distinguished. Existing approaches to the CPS security management have been systematized and their limited use in the CPS has been shown. An homeostatic approach to security management based on the CPS functional stability preservation has been proposed. A structure of homeostat for controlling the CPS has been described. A homeostatic model has been developed using logical predicates. The criteria for assessing the functional stability of the CPS have been proposed. The results of experimental studies showing the applicability of the proposed criteria have been presented.     

策略化的安全策略集中管理模型研究

分析了现存安全策略集中管理模型,提出了一种更为灵活的策略化的安全集中管理模型,并就此模型实现的关键技术做论述。最后就本模型和既有模型作出对比。     

Information security management: An entangled research challenge

In May 2009 the Information Security Group, Royal Holloway, became host to a medical sociologist from St. George’s Hospital, University of London, under EPSRC’s discipline hopping scheme. As part of this knowledge transfer activity, a sociotechnical study group was formed comprising computer scientists, mathematicians, organisational researchers and a sociologist. The focus of this group is to consider different avenues of sociotechnical research in information security. This article briefly outlines some of the areas of research where sociotechnical studies might contribute to information security management.     

在PKI体系下进行电子政务信息的安全管理

首先介绍了电子政务网络的结构,其次分析了PKI体系,最后提出了利用PKI技术,在电子政务网中的内网、外网、以及通过internet访问内网时如何实现信息的安全管理。     

矿用移动安全管理系统设计

针对煤矿现有应用系统的主要功能局限在PC端的问题,提出了一种基于Android操作系统的矿用移动安全管理系统设计方案,重点阐述了其主要架构、功能设计和数据库设计。该系统可以很好地接入人员定位、监测监控、视频监控、OA办公等系统。试运行结果表明,该系统运行稳定,功能完善,操作简便,极大地方便了企业办公,符合用户需求。     

医院信息系统中的网络安全与管理

在医院信息化规模不断扩大的同时,网络安全与管理逐渐成为网络工程师关注的热点。医院信息系统的正常运行是保证医院医疗业务正常开展的关键。只有建立完善的安全体系,才能保证网络提供的各项业务信息安全、可靠和准确。     

浅谈公共就业信息系统的安全管理

在信息技术高度发达的今天,越来越多的部门需要利用网络传输与管理信息,互联网已经成为政府、企事业单位快速获取和传输信息的渠道,给人们的政治、经济和生活带来很多方便,但也为入侵者提供了方便之门,信息安全问题也显现出来.     

浅谈计算机信息系统安全的管理

面对飞速发展的信息产业,信息安全不容忽视,特别是办公信息系统安全更不容忽视。本文首先阐述了计算机信息系统安全管理的必要性,其次,分析了计算机信息系统安全的属性,同时,就如何加强计算机信息系统安全的管理提出了自己的看法和建议,具有一定的参考价值。     

探讨机场安防综合监控管理系统

机场安防综合监控管理系统是机场安全的重要保障,是机场能够正常运行的重要技术支撑。近年来我国国内某些机场出现了爆炸、混乱等伤及乘客生命安全的事故,如果机场具有完善的机场安防综合监控管理系统,那tl,此类问题大可以避免发生。本文将时机场安防综合监控管理系统进行详细研究,提出机场安防的几个要点,并对几个主要的安防子系统进行具体研究,     

通风安全仪器仪表管理系统设计

针对现有煤矿企业通风安全仪器仪表管理存在设备履历不完整、缺乏维修体制等问题,设计了通风安全仪器仪表管理系统。以自救器管理为例,介绍了系统的整体设计、采集节点的硬件设计、服务器管理软件设计等。该系统实现了对通风安全仪器仪表和领用人员的有效管理,使纸质资料电子化,履历信息系统化,设备维护方式更为合理,并且在采购、仓储、使用这3个方面达到了无缝衔接。     

Technology standards pros aid homeland security

On 15 November 2001, the executive board of the International Committee for Information Technology Standards approved a new CD-based geographic information standard. Security experts consider this standard to be integral to homeland security because military facilities and commercial airports will use it in key functions such as site and environmental planning. Two weeks later, the INCITS executive board announced the formation of a new technical committee, MI, devoted to biometrics standards. In this case, standards professionals and other subject matter experts will directly support the US Patriot Act through their work. These two examples show how de jure standards work through a streamlined process that enables emerging technologies to solve urgent problems. They belie a popular notion that market-driven, relevant standards must come from consortia formed on the fly     

多级分布式网络安全管理系统研究

对多级分布式的大型网络进行集中安全管理,可以有效提高网络的安全防御能力和安全管理效率,成为网络安全研究的一个迫切问题。阐述一种多级分布式安全管理系统(MD-SMSMultilevelandDistributedSecurityManagementSystem),首先描述其体系结构,然后讨论设备建模和应急处理等问题,最后以Worm_Sasser蠕虫为例,分析其网络协同防御能力。     

计算机桌面安全防护系统安全管理功能设计

为解决计算机桌面的安全防护问题,在实现安全防护基本功能的基础上,设计了系统安全管理功能,用于对系统各角色进行管理.根据计算机桌面安全防护系统总体设计需求,在借鉴公钥基础设施(PKI)管理模式的基础上,结合电子钥匙设计了具备用户权限分配,证书生成管理、身份认证协议,加密算法选择和会话密钥协商等功能的安全管理功能模块.经过测试和分析结果表明,设计的安全管理功能较好解决计算机桌面安全防护系统的安全管理问题.     

信息安全管理系统的组卷算法研究

针对信息安全系统对问卷的要求,分析了组卷的约束条件,建立了组卷的数学模型,并提出了改进的遗传算法求解纽卷问题的新方法。实验结果表明,所提出的新算法相对于传统算法更加有效,组卷成功率高,具有较好的性能和实用性。