The diploma thesis deals with the design of implementation of information security management system in IT company, deals with metrics for measuring the effectiveness of the system, according to the international standards ISO/IEC 2700x. The thesis solves invested resources in the establishment of the system. The thesis provides a summary of theoretical knowledge of information security management system, analyzes the current situation in the company and propose measures to increase security in the company.

Due to the universal use of technology and its pervasive connection to the world, organisations have become more exposed to frequent and various threats. Therefore, organisations today are giving more attention to information security as it has become a vital and challenging issue. Many researchers have noted that the significance of information security, particularly information security policies and awareness, is growing due to increasing use of IT and computerization. In the last 15 years, the State of Qatar has witnessed remarkable growth and development of its civilization, having embraced information technology as a base for innovation and success. The country has undergone tremendous improvements in the health care, education and transport sectors. Information technology plays a strategic role in building the country's knowledge-based economy. Due to Qatar s increasing use of the internet and connection to the global environment, it needs to adequately address the global threats arising online. As a result, the scope of this research is to investigate information security in Qatar and in particular the National Information Assurance (NIA) policy. There are many solutions for information security some technical and some non-technical such as policies and making users aware of the dangers. This research focusses on enhancing information security through non-technical solutions. The aim of this research is to improve Qatari organisations information security processes by developing a comprehensive Information Security Management framework that is applicable for implementation of the NIA policy, taking into account Qatar's culture and environment. To achieve the aim of this research, different research methodologies, strategies and data collection methods will be used, such as a literature review, surveys, interviews and case studies. The main findings of this research are that there is insufficient information security awareness in organisations in Qatar and a lack of a security culture, and that the current NIA policy has many barriers that need to be addressed. The barriers include a lack of information security awareness, a lack of dedicated information security staff, and a lack of a security culture. These barriers are addressed by the proposed information security management framework, which is based on four strategic goals: empowering Qataris in the field of information security, enhancing information security awareness and culture, activating the Qatar National Information Assurance policy in real life, and enabling Qatar to become a regional leader in information security. The research also provides an information security awareness programme for employees and university students. At the time of writing this thesis, there are already indications that the research will have a positive impact on information security in Qatar. A significant example is that the information security awareness programme for employees has been approved for implementation at the Ministry of Administrative Development Labour and Social Affairs (ADLSA) in Qatar. In addition, the recommendations proposed have been communicated to the responsible organisations in Qatar, and the author has been informed that each organisation has decided to act upon the recommendations made.

Risk management is a process through which organizations are methodically devoted to the risks associated with their activities in order to get the biggest benefit from their business. It is also a rapidly developing field, where there is a variety of different approaches, methods, methodologies and standards in which may be little confusing. Therefore, this work offers a comprehensive and systematic view on the issue of risk analysis and management. Risk analysis is a cornerstone for effective security management of each company used for identification, description and quantification of risks, which should lead to acceptance of suitable measures for risk treatment. That is the reason why it requires a careful and methodical procedure described in this work. The main objective of this work is to analyse different approaches to risk analysis and management and thus highlight the importance of information security and protection of corporate assets. This approaches need to be understood as a different levels of detail of conducted risk analysis which will depend on initial maturity level (according to the CMM -- Capability Maturity Model) of information security process. The theoretical part of this thesis will explain relevant methodologies, techniques and procedure of risk analysis based on the ISO 27005 standard. From this part reader should learn what risk analysis is, what is it used for, how can it be carried out and what standards and methods can be used. The practical part will solve a real risk analysis project, which will demonstrate application of information obtained in the theoretical part.

Made available in DSpace on 2015-04-16T15:23:28Z (GMT). No. of bitstreams: 1 arquivototal.pdf: 2561530 bytes, checksum: a1d41fd6bed806649d21232868b6d22e (MD5) Previous issue date: 2013-03-25 / Coordenação de Aperfeiçoamento de Pessoal de Nível Superior - CAPES / The power of technology has generated computerized systems for implementation of various tasks with their databases linked through powerful networks. The federal government aimed at equipping public service efficiently deployed Sistema de Concessão de Diárias e Passagens (SCDP) that integrates the activities of grant, registration, monitoring, management and control of daily and passages, resulting from trips taken in the interest of administration. This environment full of content and digital interconnected spheres is subject to various types of physical or virtual threats that jeopardize the safety of its users and the information processed. The present study aims at analyzing the perspective of the management of information security, the SCDP accounting department at the Universidade Federal da Paraíba. Investigates the assurance of confidentiality, integrity and availability of information through a risk analysis of the evidence and documents that comprise the system. In the methodological aspect, the research is characterized as a case study, set up as a study of qualitative and quantitative, exploratory and descriptive. Used as instruments to collect data to structured interview that recognized actions of a Security Policy Information (PSI) through the Facilitated Risk Analysis and Assessment Process (FRAAP), and direct observation technique, performed by notes in a field journal. For organizing and analyzing the data, we used content analysis. With these results it was possible to identify aspects of SCDP as the influence on the view of users, the security features and information flow. Regarding the risk analysis carried out, it can be concluded that there are threats in the process of granting and daily tickets, but with the adoption of selected controls can mitigate risk. / O poder da tecnologia tem gerado sistemas informatizados para a execução das mais diversas tarefas, com suas bases de dados interligadas por meio de poderosas redes. O governo federal, visando instrumentalizar eficientemente o serviço público, implantou o Sistema de Concessão de Diárias e Passagens (SCDP), que integra as atividades de concessão, registro, acompanhamento, gestão e controle de diárias e passagens, decorrentes de viagens realizadas com o interesse da administração. Esse meio, repleto de conteúdos e de esferas digitais interligados, está sujeito a diversos tipos de ameaças físicas ou virtuais que comprometem a segurança dos seus usuários e das informações processadas. O presente estudo tem como objetivo geral analisar, sob a ótica da gestão da segurança da informação, o SCDP do Departamento Contábil da Universidade Federal da Paraíba. Procura investigar a garantia de confidencialidade, da integridade e da disponibilidade da informação, através de uma análise de risco nos elementos e nos documentos que integram o sistema. No aspecto metodológico, a pesquisa é caracterizada como um estudo de caso, de caráter qualitativo e quantitativo, exploratório e descritivo. Utiliza como instrumentos de coleta de dados a entrevista estruturada, que permitiu reconhecer ações de uma Política de Segurança da Informação (PSI) por meio do Facilitated Risk Analysis and Assessment Process (FRAAP), e a técnica de observação direta, realizada por meio de anotações em diário de campo. Para organizar e analisar os dados, recorreu-se à análise de conteúdo. Com os resultados obtidos, foi possível identificar aspectos do SCDP como: a influência na visão dos usuários, os elementos de segurança e o fluxo informacional. Em relação à análise de risco efetuada, concluiu-se que existem ameaças no processo de concessão de diárias e de passagens, mas, com a adoção de controles selecionados, é possível mitigar o risco.

This thesis deals with the introduction of information security management system in IT enterprise. It includes theoretical knowledge which are necessary for the understanding of this issue and their application for the analysis of the current state of information security, risk analysis and risk management. Last but not least for the actual implementation of information security management system in the company. The implementation of ISMS was divided into two phases. This thesis details the first phase.