ENTERPRISE INFORMATION SYSTEMS ASSURANCE AND SYSTEM SECURITY
TABLE OF CONTENTS SECTION I SECURITY POLICY AND MANAGEMENT CHAPTER I A MODEL OF INFORMATION SECURITY GOVERNANCE FOR E BUSINESS 2 CHAPTER II IT SECURITY GOVERNANCE AND CENTRALIZED SECURITY CONTROLS 17 CHAPTER III A CASE STUDY OF EFFECTIVELY IMPLEMENTED INFORMATION SYSTEMS SECURITY POLICY 26 CHAPTER IV MALWARE AND ANTIVIRUS DEPLOYMENT FOR ENTERPRISE SECURITY 43 1 SECTION II SECURITY IMPLICATIONS FOR BUSINESS CHAPTER V THE IMPACT OF THE SARBANES OXLEY SOX ACT ON INFORMATION SECURITY GOVERNANCE 63 CHAPTER VI A SECURITY BLUEPRINT FOR E BUSINESS APPLICATIONS 90 CHAPTER VII SECURITY MANAGEMENT FOR AN E ENTERPRISE 96 CHAPTER VIII IMPLEMENTING IT SECURITY FOR SMALL AND MEDIUM ENTERPRISES 113 CHAPTER IX E COMMERCE SECURITY 132 CHAPTER X THE SURVIVABILITY PRINCIPLE IT ENABLED DISPERSAL OF ORGANIZATIONAL CAPITAL 149 SECTION III SECURITY ENGINEERING CHAPTER XI SECURITY ENGINEERING IT IS ALL ABOUT CONTROL AND ASSURANCE OBJECTIVES 169 CHAPTER XII HIGH ASSURANCE PRODUCTS IN IT SECURITY 183 62 168 SECTION I SECURITY POLICY AND MANAGEMENT 1 CHAPTER I A MODEL OF INFORMATION SECURITY GOVERNANCE FOR E BUSINESS ABSTRACT THIS CHAPTER IDENTIFIES VARIOUS LEVELS OF GOVERNANCE FOLLOWED BY A FOCUS ON THE ROLE OF INFORMATION TECHNOLOGY IT GOVERNANCE WITH REFERENCE TO INFORMATION SECURITY FOR TODAY S ELECTRONIC BUSINESS E BUSINESS ENVIRONMENT IT OUTLINES LEVELS OF ENTERPRISE CORPORATE AND BUSINESS GOVERNANCE IN RELATION TO IT GOVERNANCE BEFORE INTEGRATING THE LATTER WITH E BUSINESS SECURITY MANAGEMENT E BUSINESS HAS MADE ORGANISATIONS EVEN MORE RELIANT ON THE APPLICATION OF IT WHILE EXPLOITING ITS CAPABILITIES FOR GENERATING BUSINESS ADVANTAGES THE EMERGENCE OF AND DEPENDENCE ON NEW TECHNOLOGIES LIKE THE INTERNET HAVE INCREASED EXPOSURE OF BUSINESSES TO TECHNOLOGY ORIGINATED THREATS AND HAVE CREATED NEW REQUIREMENTS FOR SECURITY MANAGEMENT AND GOVERNANCE PREVIOUS IT GOVERNANCE FRAMEWORKS SUCH AS THOSE PROVIDED BY THE IT GOVERNANCE INSTITUTE STANDARDS AUSTRALIA AND THE NATIONAL CYBER SECURITY PARTNERSHIP HAVE NOT GIVEN THE CONNECTION BETWEEN IT GOVERNANCE AND E BUSINESS SECURITY SUFFICIENT ATTENTION THE PROPOSED MODEL ACHIEVES THE NECESSARY INTEGRATION THROUGH RISK MANAGEMENT IN WHICH THE TENSIONS BETWEEN THREAT REDUCTION AND VALUE GENERATION ACTIVITIES HAVE TO BE BALANCED 2 INTRODUCTION GOVERNANCE HAS GAINED INCREASING ATTENTION IN RECENT YEARS PRIMARILY DUE TO THE FAILURES OF WELL KNOWN CORPORATIONS SUCH AS ENRON THE EXPECTATIONS FOR IMPROVED CORPORATE GOVERNANCE HAVE BECOME VERY NOTICEABLE ESPECIALLY IN THE UNITED STATES WHERE THE SARBANES OXLEY SOX ACT OF 2002 AIMS TO RESTORE INVESTOR CONFIDENCE IN U S MARKETS BY IMPOSING CODES OF CONDUCT ON CORPORATIONS THE CONCEPT OF CORPORATE GOVERNANCE IS MUCH QUOTED AS THE SYSTEM BY WHICH COMPANIES ARE DIRECTED AND CONTROLLED CADBURY 1992 P 15 THE CORPORATE GOVERNANCE STRUCTURE THEREFORE SPECIFIES THE DISTRIBUTION OF RIGHTS AND RESPONSIBILITIES AMONG DIFFERENT PARTICIPANTS IN THE CORPORA TION SUCH AS THE BOARD OF DIRECTORS AND MANAGEMENT BY DOING THIS IT PROVIDES THE STRUCTURE BY WHICH THE COMPANY OBJECTIVES ARE SET AND THE MEANS OF ATTAINING THOSE OBJECTIVES AND MONITORING PERFORMANCE CORPORATE GOVERNANCE INCLUDES CONCERNS FOR INFORMATION TECHNOLOGY GOVERNANCE BE CAUSE WITHOUT EFFECTIVE INFORMATION MANAGEMENT THOSE CHARGED WITH CORPORATE RESPON SIBILITIES WOULD NOT BE ABLE TO PERFORM EFFECTIVELY EWEEK 2004 MAKE THE CASE FOR IT PROFESSIONALS TO TAKE A LEADING ROLE IN CORPORATE GOVERNANCE SINCE THEY HAVE CONTROL OVER THE PROCESSES UNDERPINNING GOVERNANCE ACTIVITIES THEY MENTION THE EXAMPLE OF THE HUMAN RESOURCE DATABASE PROVIDING INFORMATION ABOUT EMPLOYEES COMPENSATION WHICH IF THE INFORMATION IS PROPERLY MONITORED COULD PROVIDE AN EARLY INDICATION OF MALPRACTICE THIS MEANS THAT IT FUNCTIONS NEED TO BE SECURE SO THAT BUSINESS DATA IS NOT ALTERED BY UNSCRUPULOUS HANDS EWEEK 2004 P 40 WITH BUSINESS INCREASINGLY UTILISING MODERN DIGITAL TECHNOLOGY IN A VARIETY OF WAYS EFFECTIVE INFORMATION SECURITY GOVERNANCE HAS THEREFORE BECOME A KEY PART OF CORPORATE GOVERNANCE IN THIS CHAPTER THE ROLE OF CORPORATE GOVERNANCE IN RELATION TO THE SECURITY OF INFORMATION TECHNOLOGY AND INFORMATION AND COMMUNICATIONS TECHNOLOGY ICT WILL BE EXAMINED CURRENT DEVELOPMENTS AND MODELS SUCH AS THOSE OFFERED BY THE IT GOVERNANCE INSTITUTE AND STANDARDS AUSTRALIA WILL BE OUTLINED AND THE CURRENT LACK OF MODEL DEVELOPMENT IN EXTENDING THE GOVERNANCE CONCEPT TO INFORMATION SECURITY IN TODAY S WORLD OF E BUSINESS WILL BE IDENTIFIED AND DISCUSSED THE PURPOSE OF THE CHAPTER IS THUS TO DEVELOP A MODEL THAT ALIGNS IT GOVERNANCE WITH SECURITY MANAGEMENT IN AN E BUSINESS ENVIRONMENT THROUGH A REVIEW OF EXISTING APPROACHES AND SYNTHESIS OF CONCEPTS AND PRINCIPLES NEED FOR GOVERNANCE THE CASE OF ENRON EXEMPLIFIES THE NEED FOR EFFECTIVE CORPORATE GOVERNANCE ENRON S DOWNFALL WAS BROUGHT ABOUT AS DESCRIBED IN BROAD TERMS BY ZIMMERMAN 2002 IN USA TODAY BY OVERAGGRESSIVE STRATEGIES COMBINED WITH PERSONAL GREED HE BELIEVES THAT THERE WERE TWO MAIN CAUSES FOR THIS FAILURE FIRST BREAKDOWNS CAUSED BY IGNORED OR FLAWED ETHICS AND SECOND BOARD OF DIRECTORS FAILED THEIR GOVERNANCE HE RECOMMENDS THAT IN ORDER TO KEEP THIS FROM HAPPENING AGAIN CORPORATE GOVERNANCE SHOULD NO LONGER BE TREATED AS SOFT STUFF BUT RATHER AS THE HARD STUFF LIKE PRODUCT QUALITY AND CUSTOMER 3