p. 374

1 - 3 Information Security Management

Information security management refers to the actions of analyzing and evaluating diverse risks pertaining to information assets (e.g., physical assets, software assets, intangible information assets), and planning and implementing appropriate security measures. This subsection discusses information security management, information security evaluation and certification scheme, and risk management in companies and other organizations.

1-3-1 Information Security Management

Information security management refers to the actions of clearly defining an organization’s perspective to consider information security, and actually implementing and managing it.

(1) Information security policy

Information security policy clearly defines an organization’s perspective to consider information security. Information security policy is systematically organized and managed as follows:

Fundamental information security policy clarifies the information assets to be protected by the organization and the reasons for their protection, and describes approaches (ideas and principles) to information security in a document. Information security measures criteria defines the organization’s unified behavior and decision-making criteria that should be observed with regard to information security, on the basis of its fundamental information security policy. Information security measures procedures is a set of the specific implementation · 1 question

p. 375

procedures for information security measures. They define specific security measures (security controls) for each specific target (e.g., hardware products, software products), from the standpoint of information security management functions (prevention, detection, minimization, and restoration). In particular, it is important to define in advance any response measures for situations that would present difficulties for business continuity.

Within companies and other organizations, a variety of security rules and regulations must be created on the basis of their information security policies. The following list shows some typical rules and regulations. In general, approval for these rules and regulations comes from top management.

Among these rules and regulations, privacy policies (personal information protection policies) have been regarded as important in recent years. Privacy policies (personal information protection policies) are policies related to activities for the protection of information (i.e., personal information) identifying individuals, such as name and date of birth. Personal information protection is implemented on the basis of these policies, as a part of a systematically integrated compliance program (i.e., a plan for compliance with laws and regulations by the company).

p. 376

(2) ISMS (Information Security Management System)

ISMS (Information Security Management System) refers to a management system for the proper operational management of the organization’s information assets overall, and for securing and maintaining the security of these. ISMS is built upon BS7799-1 and BS7799-2 of the British Standards Institution, and at present is standardized as the ISO 27000 family.

ISMS provides a model for responsible persons (management team) and staff members in an organization so that they can build and operate an effective information security management system. Responsible persons must have commitment to (i.e., must have an official involvement in, and give approval to) the establishment, implementation, operation, monitoring, review, maintenance, and improvement of ISMS. ISMS is operated according to the PDCA cycle (Plan, Do, Check, Act) indicated below.

p. 377

In Japan, the ISMS conformity assessment system of the JIPDEC (Japan Institute for Promotion of Digital Economy and Community) is available for evaluation and certification of ISMS by a third party. In order to acquire ISMS certification, the application documents must be prepared and submitted to an organization (i.e., an ISMS certification body or registration body) accredited by JIPDEC. The ISMS certification body evaluates the ISMS of certification applicants by using ISO/IEC 27001 (JIS Q 27001) control objectives and controls as criteria.

p. 378