|
|
Impact of regulations ISO 27001 and SOX on information security management in enterprises
Bystrianska, Lucia ; Bruckner, Tomáš (advisor) ; Tomčová, Zuzana (referee)
The master thesis has analytical character and focuses on information security issues in enterprises. The mail goal of this thesis is to evaluate the impact of implemented standard ISO/IEC 27001 and regulation by American law SOX to overall information security. In order to preform the analysis, two medium-sized companies from the segment of services were selected: the first one with ISO/IEC 27001 certification and the second one regulated by SOX. The structure of the thesis contributes gradually with its steps to meet the goal. The first three chapters provide a theoretical basis for the analysis of information security. They contain a summary of key processes and tools essential for ensuring the information security and are based on the best practices included within the latest standards and methodologies and on practical experience. These chapters provide the basis for an evaluation guidance including criteria groups and defined variants of implemented security, which is described in the fourth chapter. The analysis of information security and the impact of regulations is part of the fifth chapter of this document. The sixth chapter contains final assessment and comparison of the impact, which the regulations have on information security of the selected companies. The final chapter summarizes and evaluates the results achieved with regards to the goal.
|
|
|
Evaluation of preparedness of a business for an implementation of ISO 27001 using Gap analysis
Zrcek, Tomáš ; Čermák, Igor (advisor) ; Šašek, Jaroslav (referee)
The aim of the thesis is to evaluate the preparedness of an information security management system (ISMS) in a logistic company JASA s.r.o. for a certification by standard ISO/IEC 27001:2013. This enterprise oscillates between small and medium enterprise. It has already implemented the certificate on quality management ISO 9001:2008. For this reason, in the thesis there are presented advantages for a company that already has implemented one of ISO standards and decides to implement another. First of all, the present state of information security management system in Jasa s.r.o was compared to other businesses functioning in the Czech and European market. Then the company control environment was evaluated accordingly to the requirements of standard ISO/IEC 27001:2013. Furthermore, a scheme was created in order to evaluate specific controls based on the impact risk that could arise in case of ignoring the suggested recommendations. In the last part, the controls were evaluated accordingly to difficulty, so that the company can find cheap and fast solutions with adequate impact. The main contribution of the thesis is the evaluation of the approach to solve information security in one of many enterprises that are afraid or are starting to notice the increasing amount of security threats. This approach may be chosen by other companies that decide to go the similar way.
|
|
|
Safety and risk analysis in practice
Hlahůlek, Jakub ; Luc, Ladislav (advisor) ; Mildeová, Stanislava (referee)
The aim of this work is getting acquainted with the safety of the companie's assets. To practicly verify the information methods of security management on companies implemented through adequate standards. Then perform risk analysis on a specific company and assess the most serious risks. In conclusion propose safety measures to prevent risks which have been analyzed in cooperation with the owner of this company.
|
|
|
The security level of PaaS
Vinc, Michal ; Gála, Libor (advisor) ; Burkoň, Lukáš (referee)
This bachelor thesis deals with a Cloud Computing model, with Platform as a Service in particular presented from a security point of view. The aim of the thesis was to identify risks that are result of Platform as a Service utilization as a constituent of Cloud Computing and on the basis of a questionnaire survey to elicit how those are perceived by Czech clients utilizing such service. First part describes the current stage of knowledge in the area discussed, the Cloud Computing model and the Platform as a Service. Second part aims at information security management, at identification of critical fields in the Platform as a Service, and at characterization of such critical fields. Final part presents findings from the questionnaire survey and assessment of risks as perceived by the customers of Platform as a Service in the Czech Republic. This work contributes to the evaluation of risks perceived by the customers of Platform as a Service in the Czech Republic.
|
|
|
Security policies in public sector
Liška, Pavel ; Veber, Jaromír (advisor) ; Luc, Ladislav (referee)
This bachelor thesis looks into the field of information security. Rules, trend and goals of information security are defined in the security policy, which is the main topic of this thesis. Firstly, there are defined theoretical terms, rules and general facts of this field. Subsequently, there is described current situation of information security and security policies in public sector, particularly in school institutions and municipal authorities. Important part of this thesis, is definition of legislative perspective on security policy in both fields of public sector in this thesis. Declared goal is primarily the determination of the general elements of the policies from the gained documents, which are subsequently compared and the common characteristics and difference are set.
|
|
|
IT risk management in civil service
Ambrož, Ondřej ; Veber, Jaromír (advisor) ; Drtil, Jan (referee)
This bachelor thesis focus on issues of security risk management of information technology. Risk management is a comprehensive proces of which main part is a risk analysis. In this thesis is put the great emphasis on the risk analysis. Firstly, there is briefly introduced the history of risk management and the history of information security. Subsequently, there are fundamental terms defined. Important part of this thesis is definition of the civil service and some of its specifics. In the scope of practical part, there is described current situation of IT in the organization of the civil service and subsequently, there is executed the risk analysis of information security and countermeasures to reduce identified risks are suggested.
|
|
|
Security of information society regard to a human factor
Němec, Petr ; Sigmund, Tomáš (advisor) ; Toman, Prokop (referee)
Bachelor thesis deals with safety of information society where one of the roles is played by human factor and its weaknesses are being tried to exploit by attackers, whose especially used methods of social engineering. Internet holds many dangers and number of targeted attacks on attractive targets rise as well. A new field for these attacks have become a social networks that connect the virtual and the real world. On one side there are users telling everything about their privacy, so high sensitive information that are welcomed source for the fictional identity of attackers. Sharing of these information is closely linked to the netiquette where one of the atributes is intellectual property information. This is an issue I dealt with in the penultimate chapter where I processed the results of the questionnaire. On the basis of the questionnaire I tried to underlay my previous claims in my bachelor thesis.
|
|
|
Implementation of information security
Hübner, Michal ; Chlapek, Dušan (advisor) ; Bruckner, Tomáš (referee)
The work deals with the introduction of a system of information security management system in organizations. The work is divided into two parts. The first part is devoted to the theoretical foundations of information security, that the reader can understand what entails the implementation of information security. In the second part assessed the current status of security measures implemented in enterprises. The goal is to collect available information about security of information into one document. Another objective is to assess the current state of security measures implemented by firms and the subsequent dismantling of the results. The contribution of this work is to create a comprehensive theoretical paper on the introduction of measures to manage security information. Another benefit is the creation of a review of security measures implemented in selected companies.
|
|
|
Security and Protection of Data and Information in Banking Business for Managers
Melichar, Jan ; Pokorný, Pavel (advisor) ; Pertlíček, Michal (referee)
This dissertation describes information as an economic object and focuses on information security with reference to all technical and social aspects and documents the necessity to consider both those areas simultaneously. The dissertation determines information security standards and describes some tools being used for effective data protection and information systems protection. One part of this dissertation is a model design for effective controlling of data and process protection, which can be used by bank managers on process control design especially in transaction processing area. This model is divided into several logical and consequential blocks and provides help to operating managers to design or redesign new or existing processes accordingly. The dissertation clearly highlights related insufficiencies especially those related to data access protection and passwords and one related survey has been performed to prove that
|
|
|
Data Security Audit
Vepřek, Petr ; Benešová, Vlasta (advisor) ; Novotný, Petr (referee)
Cílem práce je zpracovat vybrané okruhy související s ochranou a zabezpečením datové základny podniku a navrhnout metodiku pro provádění auditu systému bezpečnosti datové základny. Práce ozřejmuje význam a přínosy aktivní ochrany datové základny podniku, charakterizuje proces provádění analýzy rizik, diskutuje problematiku zálohování, archivace a obnovy datové základny a specifikuje nástroje a systémy eliminace ztrát, poškození a zneužití informací. V poslední kapitole je navrhnuta metodika zpracování auditu ochrany a zabezpečení datové základny a stručně popsána její aplikace v praxi.
|
guest ::
