Guidelines for the Security of Information Systems & Networks

Who is intercepting your information?

The exploitation of information systems and network vulnerabilities has made security a significant issue. This responsibility to protect the integrity of sensitive information exchanged rapidly and globally is thus referred to as the new "culture of security."

Continuous Measurement

Securing information is complicated by the relentless threat aura of unauthorized access and unanticipated system breakdowns. To counter this dynamic threat, decide on your acceptable level of risk and continuously monitor the efficacy of your security system against that benchmark.

Factor in Security During IS Development Process

Instead of something separate, factor security needs into the information systems development life cycle, integrating it into the highest executive levels of capital and re-investment planning. Identify the security gap and assess their costs and advantages at the "enterprise" level of institutional re-investment and at the "system" level.

Secure Servers

Servers are a favorite target for hackers because they process and store confidential personnel and operational information. Develop a security plan for each server prior to installation, well before it becomes a production machine. This plan should include the server's operational and support personnel requirements and their associated security risks.

Secure Wireless Networks

The amended IEEE 802.11i specification introduces the Robust Security Network to improve the standard for wireless local area networks. An RSN includes wireless endpoint stations, access points, the institution's legacy infrastructure authentication servers, which validate access to communication services. The AS server makes the RSN "robust." The amendment also recommends specific protocols and encryption algorithms to maintain information confidentiality and integrity across a WLAN.

References

• Federal Trade Commission: OECD Issues Guidelines for the Security of Information Systems and Networks: Towards a Culture of Security
• NIST: Information Security: Information Security Continuous Monitoring for Federal Information Systems and Organizations
• NIST: Integrating IT Security into the Capital Planning and Investment Control Process
• NIST: Guide to General Server Security
• NIST: Establishing Wireless Robust Security Networks

Resources

• OECD: Information Security and Privacy
• NIST: Special Publications (800 Series)