Unit-4 (ICS -305)

Information security
Information security (ISec) describes activities that relate to the protection of information and information infrastructure assets against the risks of loss, misuse, disclosure or damage.
Standards that are available to assist organizations implement the appropriate programs and controls to mitigate these risks are for example BS7799/ISO 17799, Information Technology
Infrastructure Library and COBIT.
 Information security management (ISM) describes controls that an organization needs to implement to ensure that it is sensibly managing these risks.
Security Challenges

 The risks to these assets can be calculated by analysis of the following issues:
 Threats to your assets. These are unwanted events that could cause the intentional or accidental loss, damage or misuse of the assets
 Vulnerabilities. How vulnerable (prone or weak) your assets are to attack
 Impact. The magnitude of the potential loss or the seriousness of the event.
Security services

Information Security Governance, Information Security Governance or ISG, is a subset discipline of Corporate Governance focused on information Security systems and their performance and risk management.
 Establish and maintain a framework to provide assurance that information security strategies are aligned with business objectives and consistent with applicable laws and regulations  Develop the information security strategy in support of business strategy and direction.
 Obtain senior management commitment and support
 Ensure that definitions of roles and responsibilities throughout the enterprise include information security governance activities.
 Establish reporting and communication channels that support information security governance activities.
 Identify current and potential legal and regulatory issues affecting information