Protection Of Information Assets Research Articles

The Visible Employee: Using Workplace Monitoring and Surveillance to Protect Information Assets without Compromising Employee Privacy or Trust

The Visible Employee: Using Workplace Monitoring and Surveillance to Protect Information Assets without Compromising Employee Privacy or Trust

Security professionals need to improve people (and business) management skills before IT skills

In today's business world, the highest levels of management accept and understand the potential impact of data breaches, including loss of business, damage to the corporate image, diminished shareholder value, and lawsuits. The long battle to push information security up the priority agenda has been won. Gone are the days when information security was considered a nuisance. However, many have yet to recognise that protecting information assets is more about people management than IT management. This is particularly true today in a world where it is becoming the exception rather than then norm that new systems, programs, even products are rolled out without due consideration for information security.

The role of security policy in protecting information assets

The role of security policy in protecting information assets

Teaching the undergraduate CS Information Security Course

This paper presents a lab based approach to teaching the undergraduate CS Information Security course. Given the magnitude of real and potential loses associated with security breaches, employers increasingly expect graduates of CS programs to have an understanding of information security concepts. The infrastructure requirements for the course includes setting up a secure laboratory environment to accommodate the development of viruses and worms. The labs and lectures are intended to instruct students in the inspection and protection of information assets, and detection of and reaction to threats to information assets.

Strategic Decision Support For Information Protection: A Facilitation Framework For Small And Medium Enterprises

Information security seriously concerns Corporate America but the soaring cost on protecting information assets raises equal concerns. These concerns appear to be more threatening to the small and medium enterprises (SMEs) as the percentage of their IT budgets spent on information security protection sharply surpasses those percentages budgeted by large enterprises. In light of these concerns, we propose an integrated and attainable framework that could heuristically promote strategic decision thinking on protecting information assets for the SMEs. In comparison to other approaches that aim at reaching an optimal decision through complex mathematical models, our framework requires no such computations. The goal of our approach is to help a SME reach such decisions with a framework that takes business, technological and managerial issues into account. The proposed framework fosters strategic thinking of security issues with simple and practical steps to achieve a balanced, consistent, and efficient protection with total involvement from all stakeholders of the information assets that need to be protected.

The Development of Access Control Policies for Information Technology Systems

The identification of the major information technology (IT) access control policies is required to direct “best practice” approaches within the IT security program of an organisation. In demonstrating the need for security access control policies in the IT security program, it highlights the significant shift away from centralised mainframes towards distributed networked computing environments. The study showed that the traditional and proven security control mechanisms used in the mainframe environments were not applicable to distributed systems, and as a result, a number of inherent risks were identified with the new technologies. Because of the critical nature of the information assets of organisations, then appropriate risk management strategies should be afforded through access control policies to the IT systems. The changing technology has rendered mainframe centralised security solutions as ineffective in providing controls on distributed network systems This investigation revealed that the need for policies for access control of an information system from corporate governance guidelines and risk management strategies were required to protect information assets of an organisation. The paper proposes a high level approach to implementing security policies through information security responsibilities, management accountability policy, and other baseline access control security policies individual and distributed systems.

Management Responsibility in Protecting Information Assets: An Australian Perspective

Information is a vital and valuable asset of all modern businesses. The law has treated information, in most common law jurisdictions, as not being property. Consequently, it is not possible at common law to steal information. In Australia, the Federal Government has recently brought into force a suite of legislation that has the purpose of deterring hackers who unlawfully try to gain access to a computers located in Australia. Further there have been a number of recent judicial determinations that now impose a positive duty upon management (Directors and Officers of a corporation) to implement reasonable steps to prevent a crime from being effected against the corporation. This positive duty includes the protection of information assets of the corporation from hacker attacks and loss of information and its value. Hence computer security is now a board issue in Australia and not just an IT issue.

How to Select a Firewall

The concept of creating a firewall as a basic means of protect-ing information assets was introduced by William Cheswick and Steven Bellovin in their 1994 book, Firewalls and Internet Security: Repelling the Wily Hacker. They described a firewall as a logical IS security mechanism that was designed to protect information: this was done by keeping potential intruders out of information by erecting a barrier to it.

Information warfare and the information systems security professional

When a government agency or business computer system is attacked, the response to such an attack will be based on the attacker. Will the attacker be a hacker, phreaker, cracker, just someone breaking in for fun? Will the attacker be an employee of a business competitor, in the case of an attack on a business system, or will it be a terrorist, or a government agency-sponsored attack for economic reasons? Will the attacker be a foreign soldier attacking the system as a prelude to war? These questions require serious consideration when information systems are being attacked, because it dictates the response. Would you attack a country because of what a terrorist or economic spy did to a business or government system? To complicate the matter, what if the terrorist was in a third country but only made it look like he/she was coming from your potential adversary? How do you know? The key to the future is in information systems security for defence and information warfare weapons. As with nuclear weapons used as a form of deterrent, in the future, information weapons systems will be the basis of the information warfare deterrent. Each nation must begin now to prepare for 21st Century warfare by establishing a programme to ensure the protection of information assets in the 21st Century. Remember, it is bad enough being attacked, but it is worse to be attacked and not know it until it is too late!

The employee's role in protecting information assets

The employee's role in protecting information assets