Abstract
Information security is an important part of academic information system, including Muhammadiyah University of Sukabumi (UMMI). Information security is conducted to protect UMMI assets, especially data and information. Data and information has become an important asset in an organization, because it relates to the image of the organization. At this time academic information system at UMMI is built online, causing various threats that may occur. Threats can arise side in or outside. If the threat occurs then the information security aspect will be disrupted and enable the disruption of business process on academic information system of UMMI. The likelihood of this threat is called risk. To minimize losses from risks, risk management should be done well. The risk management method used in risk management in academic information system of UMMI is ISO 27005. The selection of this method to facilitate the development in the next stage of information security management system on UMMI Academic Information System using ISO 27000 series. Data collection is done by interview and discussion. The risk management process under ISO 27005 includes four main steps: scope determination, risk assessment, risk treatment and risk acceptance. The result of the risk assessment found 73 possible threat scenarios divided into 3 risk levels, ie 2 low risk, 64 medium risk and 7 high risk. Out of 73 threat scenarios, 47 are made to risk treatment planning. Results of the risk treatment plan, 19 modified risks, 1 risk transferred and 27 risks avoided. This risk treatment plan is a recommendation for the leadership of UMMI to conduct risk management .
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have