How to Proceed to Formulate Policy

of Information Security

Advanced Computer Security (44165)

Week 4
TEAM D Members
232d8639 HAN, Si Thu - - - - - - - - - - - - - - - - - - 2-7
231d8715 KAWAGUCHI, Souta - - - - - - - - - - - - 8-9
233d8678 FIKRI, Achmad Akmal - - - - - - - - - - 13-15
234d 8638 OO, Patamyar - - - - - - - - - - - - - - - - 10-12
231d8651 RAHIM, Afwan - - - - - - - - - - - - - - - 15-17

1
 How to proceed to formulate policy that addresses
information security
1. Start with an assessment. Often, organizations will want to begin with a
risk assessment
2. Consider applicable laws and guidelines
3. Include all appropriate elements. ...
4. Learn from others
5. Develop an implementation and communication plan
6. Conduct regular security training

2
Goal setting and how to proceed that information
security measures

All information security measures try to address at least one of three

goals:
• Protect the confidentiality of data
• Preserve the integrity of data
• Promote the availability of data for authorized use

3
Integrity Models
Integrity models keep data pure and trustworthy by protecting system data
from intentional or accidental changes. Integrity models have three goals:
• Prevent unauthorized users from making modifications to data or
programs
• Prevent authorized users from making improper or unauthorized
modifications
• Maintain internal and external consistency of data and programs

4
Baseline of information security:
It will continue to ensure a baseline of information security.
● Measures to script kiddies
● Establishment of a confidentiality(to prevent internal attacks from outside the
organization to first)
Reasonable measures to:

It then performs the necessary and sufficient measures.

● Maintaining Availability
● Level of confidentiality up(to prevent leakage to the outside from the
organization))

5
 Technical measures for information security
Audit
Audit to monitor refers to the entire hierarchy the other five, and whether you are using as the rule information systems or user,
whether there is a misconfiguration in the server itself or PC security appliance information was introduced to record the audit trail
refers to the appliance or service. Various logs (aggregate of the log message firewall, file server, such as word processing and
spreadsheet program, analysis), the diagnosis of vulnerability in a system, and monitoring intrusion detection (IDS), e-mail, such
as verifying the consistency of the data file contains.

Encryption
It refers to using technology such as encryption VPN IPsec, the file, the appliance and its services as a measure against security
breaches.

Privilege Definition or Single Sign On

Authorization refers to the appliance and services to management and operation of system access privileges that are defined for
the (affiliation and identification) of individual attributes. For the user is authenticated, to provide services that are specific to each
user. Specifically, etc. (SSO) is equivalent to this single sign-on.

Authentication
When accessing the network and servers, etc., refers to the appliance and services to confirm the identity. According to the needs
of users, advances in technology in the current digital certificate, biometric authentication to one-time path, from one-time path
from a fixed password.

6
Access Control
When accessing the network and servers, etc., refers to the appliance and services to confirm the identity. According to
the needs of users, advances in technology in the current digital certificate, biometric authentication to one-time path,
from one-time path from a fixed password.

Data Protection / Integrity

It refers to the services required and their firewall appliance at the connection point of the Internet and the organization.
In recent years and is not possible access control of inter-VLAN (L3 switch not only connecting point organization and
the Internet, the introduction of a firewall is progressing in between each department and each department, to prevent
worms from denial of service attacks is difficult).

7
Actual implementation of technical
measures for information security

8
Management of information security
measures
Management of information security, you must not just a matter of administrative and
technical personnel of information security, including work by all users. For this reason, it is
necessary to clarify the operations of the business of the person who used in conjunction
with the technical administrator.
Technical administrator Business of the person
・Computer management ・Computer management
・ID and password managements ・Password management
・Consideration, introduction, and operation of ・Utilization of E-mail
security tools ・Utilization of the network
・Vulnerability research ・Anti virus
・Auditing tools
・Operational management Establishment
・Information gathering

9
 Case Study in Development of Information Security Policy

The Ministry of Education, Culture, Sports, and Science had made a direct request for
information security measures due to concerns about cyberattacks on government
websites, including the former Science and Technology Agency's website where
attacks occurred from January 24, 2001, to 2002.
The request includes two documents:
1.Guidelines for Information Security Policy
2.Information Security Policy for the Ministry of Education, Culture, Sports, and
Science

10
Case Study in Development of Information Security Policy

Contents of the documents include

1. •Promotion of information security measures: This likely involves strategies and
actions aimed at improving information security within the ministry and affiliated
organizations.
2. •Information security awareness and use of information systems administrator:
This could be about raising awareness among staff and administrators
regarding information security best practices and guidelines for using
information systems securely.

11
•In early August 2001, the Director of the University Computer Center at Kumamoto University, Professor Nakamura,
instructed a more detailed investigation following a report on the lecture contents related to information security.
•On April 1, 2002, Kumamoto University abolished its Information Processing Center and established the Information
Technology Center.
•On October 4, 2002, Professor Takai from the University of Toyama distributed a document titled "(proposed) security
policy formulation and its implementation in the University" at a conference, which involved contacting Computer
Centers and academic and research exchanges.
•Information security officers at universities published the "concept of information security policy at the University" in
HTML/PDF format from the National Institute of Informatics (NII) on March 29, 2002.
•At the time, the information security policy aimed to comply with the ISO17799 standard based on the BS7799. While
the policy was designed to align with ISO17799, it needed to be customized to fit the unique security needs of university
information policy.
The concept of aligning information security policies with international standards like ISO17799 is important and has
evolved into a conformity assessment system known as "Information Security Management System (ISMS)" by the Japan
Information Processing Development Corporation (JIPDEC).

12
Goal of Information Security Policy
• In terms of information assets and their classification based on
severity (include budget)
• The prevention of unauthorized access to information assets
(encryption technology and access control measures are
implemented to protect against information disclosure)
• Prevent unauthorized individuals both within and outside the
organization from compromising the integrity and security of
information assets (to discourage both internal and external
individuals from compromising information asset)
• Gather information regarding the support for information security
(as new techniques and vulnerabilities continuously emerge)

13
Subject and Scope of Information and
Security Policy
Involve determining the targets and extent of protection
• Related Parties (Faculty, Students, Scholars, etc)
It is necessary to ensure that faculty, students, and invited scholars who participate in
conferences and lectures comply with the security policy. This helps prevent unauthorized
access, tampering, and disclosure of information.
• System Administrators (administrators of laboratories and PCs)
Those responsible for operating information assets must adhere to the information security
policy in its entirety
• External Equipment Connected to the Network
Consideration should be given to devices brought from outside the network, such as notebook
PCs, as they may introduce viruses or worms that can compromise information security.
• Information Systems
Given that information systems, such as web and email servers, operate continuously
throughout the year, they are highly vulnerable to information leakage, tampering, and Denial
of Service (DoS) attacks. Therefore, it is crucial to implement appropriate technologies and
practices to protect these systems

14
A Policy that Addresses Information
Security Measures
• Organisation and Structure
Outline the organizational structure necessary to address information security measures (CISO,
CERT, departments responsible for information security, system administrators, DMZ administrators)
• Classification and Management of Information
Describe the method of the disposition of assets of public and private information
• Physical and Personnel Security
Ensure safe operation of equipment and information networks (secure location, human security,
system administrators)
• Technical Security
Secure connections between the internal and external networks (Guidelines and Regulations).
Include rules for the installation, configuration, and design of network equipment, as well as the
permitted range of network services
• Evaluation and Review
Need to be consistently updated due to the rapid advancements in technology and security

15
Creating a Draft of the Information
Security Policy
University promotion committee information (Technical Committee of
the University Information Committee) was held on September 17, 2002,
has been discussed "in the Kumamoto University Information Security
Policy (draft)" about.The points will be as follows:
1. The goal:Prevent information security breaches.
2. Target and scope:Faculty, students and scholars come and
outsourcing organization, etc.
3. Prevention Guidelines:Classification and management of information.
4. Future Plans and Challenges:Create and procedures,The operation of
information security policy, etc.

16
Fixing and Approval of the Draft of the
Information Security Policy
Fix "Kumamoto University Information Security Policy" based on the
opinion from the Information Promotion Committee and the author
information Promotion Committee.
"Kumamoto University Information Security Policy" was approved by
describing the fundamental part so as to avoid the description of concrete
content.
→A detailed description of the content is decided by another
"implementation procedure".
→The full-scale approach at this point was not unique information security
measures of the university.

17
Thank you for your your attention!
Any Question!

18