Evaluation of information safety as an element of improving the organization’s safety management

Abstract

Abstract. The article discusses the problem of risk management in the context of safety of an organization's information assets. Assuming system of information risk management as a basic element of organization management in the aspect of information safety of modern organizations, this document focuses on methods and techniques of qualitative risk estimates. Basic standards and good practice from areas of risk management and ensuring information safety in the organization were recalled.

The security system for maintenance of the required information security level

“…The desired property of the security system shall be deemed to mean a possibility of ensuring the acceptable security system for the security attributes assigned to the information resources of the security system [5][6]. It is assumed that the set of such resources ∈ shall change discreetly over time.…”

Multi-faceted methodology of the risk analysis and management referring to the IT system supporting the processing of documents at different levels of sensitivity

“…1) the following attributes in the field of information security: access to sensitive documents, confidentiality of the processed data, integrity of documents, fulfillment of security requirements included in the security policy, losses understood as a costs incurred due to the loss of security attributes [7,8,[35][36][37]; 2) the following elements in the field as resulting from the legal norms regulating such security issues: appointment of a representative to protect classified information, creation of a security division in the organization to perform tasks related to the processing of sensitive documents in the organization, adaptation of the office facilities to the requirements on creation, processing, acceptance, assignment, delivery and protection of sensitive documents according to the provisions of law; organization of a secret office, organization of a special location (place, facility) for the processing of sensitive data, including ICT systems for executing and processing sensitive documents; 3) the following documents in the field of basic quality and security documents: risk analysis reports, security policy, ICT security plan, special security requirements for the ICT system, safe use procedures and business continuity plan; 4) the following attributes/measures in the field of the sensitive information security processing process: importance of the Office and its Clients, fulfillment of the requirements included in the quality policy; 5) the following attributes in the field of security of business continuity: fulfillment of the requirements included in the business continuity management policy, financial effects of suspension/interruption of the process, nonfinancial effects of suspension/interruption of the process, costs and time of the process unavailability; 6) In other fields: flexibility of the process of sensitive data processing, costs and time of the process of sensitive data processing, efficiency of the change management process, efficiency of the management process architecture related to the processing of sensitive data, reliability. Last but not least, it should be stressed that the risk of sensitive documents may result from such an allegedly prosaic reason as wrongly designed user interface in the ICT system.…”

Network model of risk analysis in the technical structures

“…A universal measure can usually be financial for an organization that is the owner of a system under test. At that point, however, we need to set the risk for all the resources and collect the total financial impact because, as shown above, even a single threat can affect many collections of resources [13,14].…”