Content of this thesis is a methodology for creating ISMS Security Manual. Implementation of the proposal is supported by theoretical knowledge in the introductory part of this work. Practical process design methodology is conditional on the structure of the international standard ISO/IEC 27001:2005.

The aim of this master‘s thesis is the description of the information security implementation into a specific small business. The theoretical part of the paper summarizes the information of related standards and methods. The analytical part describes the process, information and ICT enviroment of a particular organization. The third part of this thesis focuses on a risk analysis and choosing and deployment the relevant controls and their objectives for ISMS implementation.

The master´s thesis is aimed at Proposal for the information security management system implementation in the company. It introduces with basic concepts of information security and provides general procedures for information security management system. As part of the work was carried out a risk analysis company and proposed measures to reduce risk. Work is mainly drawn from the series of standards ISO/IEC 27000.

This Master’s thesis is focused on the implementation of information security management system in the enterprise according to the standard ISO/IEC 27 001. The first part contains theoretical background of the information security, the second part focuses on current state analysis and the third part deals with suggestions for improvement current information security.

The master’s thesis is aimed at proposing an implementation of information security management system in a company. It covers basic theoretical background and concepts of information system security and describes standards of ČSN ISO/IEC 27000. Specific provisioning of ISMS is then proposed based on the theoretical background and analysis of current state.

No description available.

Information security in the form of IT governance is part of corporate governance. Corporate governance requires that structures and processes are in place with appropriate checks and balances to enable directors to discharge their responsibilities. Accordingly, information security must be treated in the same way as all the other components of corporate governance. This includes making information security a core part of executive and board responsibilities. Critically, corporate governance requires proper checks and balances to be established in an organisation; consequently, these must be in place for all information security implementations. In order to achieve this, it is important to have the involvement of three key role players, namely information security professionals, ICT security auditors and regulatory officials (from now on these will be referred to collectively as the ‘role players’). These three role players must ensure that any information security controls implemented are properly checked and evaluated against the organisation’s strategic objectives and regulatory requirements. While maintaining their individual independence, the three role players must work together to achieve their individual goals with a view to, as a collective, contributing positively to the overall information security of an organisation. Working together requires that each role player must clearly understand its individual role, as well the role of the other players at different points in an information security programme. In a nutshell, the role players must be aligned such that their involvement will deliver maximum value to the organisation. This alignment must be based on a common framework which is understood and accepted by all three role players. This study proposes a South African Information Security Alignment (SAISA) framework to ensure the alignment of the role players in the implementation and evaluation of information security controls. The structure of the SAISA framework is based on that of the COBIT 4.1 (Control Objectives for Information and Related Technology). Hence, the SAISA framework comprises four domains, namely, Plan and Organise Information Security (PO-IS), Acquire and Implement Information Security (AI-IS), Deliver and Support Information Security (DS-IS) and Monitor and Evaluate Information Security (ME-IS). The SAISA framework brings together the three role players with a view to assisting them to understand their respective roles, as well as those of the other role players, as they implement and evaluate information security controls. The framework is intended to improve cooperation among the role players by ensuring that they view each other as partners in this process. Through the life cycle structure it adopts, the SAISA framework provides an effective and efficient tool for rolling out an information security programme in an organisation / Computer Science / M. Sc. (Computer Science)

Internetuppkopplade apparater blir allt vanligare att se i våra hem. Samlingsordet för dessa enheter är Internet of Things (IOT). Med införande av IoT i våra hem skapas fler accesspunkter till internet, vilket även skapar en större attackyta. I kombinationmed den ständigt växande cyberkriminalliteten och införandet av IoT i våra hem ökar risken för att utsättas för en attack. Tidigare forskning inom området gällande konsumenters informationssäkerhetsmedvetenhet visar att konsumenterna har låg medvetenhet och bristande kunskaper för de hot som tillkommer vid integrationen av en IoT-enhet ihemmet. Det finns även tidigare forskning som undersökt vilka faktorer som påverkar individernas inställning till att anta ny teknologi. Mycket av den tidigare forskningen inom området har fokuserat på de tekniska aspekterna och fokuset har inte varit på konsumenternas informationssäkerhetsmedvetenhet och deras inställning till den ökande integrationen av IoT. Den här studien syftade till att undersöka svenska konsumenters informationssäkerhetsmedvetenhet och deras inställning till den ökande integrationen av IoT. Studien avsåg att undersöka hur medvetna konsumenterna är för de informationssäkerhetsrisker som tillkommer vid integreringen av IoT i hemmet i kombination med att undersöka deras syn på den ökade integrationen av IoT ivardagen. Studien har fokuserat på två olika enheter. Dessa enheter genererar data via ljudupptagning samt videoinspelning. En kvantitativ metod med en enkätundersökning tillämpades för att se ifall den låga kunskapen hos respondenter fanns, men även för att lättare nå ut till fler respondenter. För att förstå konsumenternas beteende utformades enkätfrågorna utifrån den allmänt tillämpade beteendemodellen Theory of planned behavior (TPB). Studien fann att majoriteten av respondenterna hade en låg medvetenhet för de risker som tillkommer med integreringen av IoT-enheter, samt låga kunskap för de säkerhetsåtgärder som går att implementera. Trots den låga medvetenheten för riskerna visade det sig att respondenterna hade en mycket positiv inställning till den ökade integrationen av IoT och att de funderar på att införskaffa fler IoT-enheter. / Internet-connected devices are becoming more common to see in our homes. The collective word for these devices is Internet of Things (IoT). With the introduction of IoT in our homes, more access points to the internet are created, which also creates alarger attack area. Combined with the ever-growing cybercrime and the introduction of IoT in our homes, the risk of being attacked increases. Previous research in the field of consumer information security awareness shows that consumers have low awareness, and lack of knowledge about the threats posed by the integration of an IoT device in the home. Previous research has examined the factors that influence individuals attitudes towards adopting new technology. Much of the previous research in the field has focused on the technical aspects and the focus has not been on consumers information security awareness and their attitude to the increasing integration of IoT. This study aimed to examine Swedish consumers' information security awareness and their attitude towards the increasing integration of IoT. The study aimed to examine how aware consumers are of the information security risks that arise from the integration of IoT in the home in combination with examining their stand on the increased integration of IoT in their everyday life. The study has focused on two specific IoT-devices. These devices generate data via audio recording and video recording. A quantitative method with a survey was applied to examine how aware the consumers where of the information security risks, but also to be able to include more respondents in the study. To understand consumer behavior, the questionnaires were designed based on the generally applied behavioral model Theory of plannedbehavior (TPB).The study found that the majority of respondents had a low awareness of the risks involved with the integration of IoT devices, as well as low knowledge of the security measures that can be implemented. Despite the low awareness of the risks, it turnedout that the respondents had a very positive attitude towards the increased integrationof IoT, and that they also are considering acquiring more IoT devices.

Under Covid-19-pandemin har organisationer med hjälp av digitaliseringen genomgått en omställning från kontorsarbete till hemarbete i en större utsträckning än tidigare. Förflyttningen av personal till hemmet och nya kommunikationskanaler har lett till en ökad hotbild gentemot organisationer och dess medarbetare som arbetar med känslig information. Höga krav ställs därför på en god informationssäkerhetsnivå inom organisationer, vilket kräver ett systematiskt styrningsarbete av informationssäkerhet. En nyckelfaktor i efterlevnaden av organisationers regler för informationssäkerhet är tydlig kommunikation och utbildning i syfte att öka medvetenheten och förmågan hos medarbetarna i organisationen. Genom en kvalitativ ansats beskriver denna fallstudie hur olika medarbetare som arbetar hemifrån kan uppleva informationssäkerhet och hur en organisation kan arbeta med styrning av informationssäkerhet i samband med att medarbetarna arbetar hemifrån. Studien presenterar också likheter och skillnader som finns mellan dessa två perspektiv. Vi har genomfört åtta intervjuer med olika personer från en fallorganisation som har flyttat större delen av sin arbetsstyrka från arbetsplatsen till hemmet.  Studiens resultat är att efterlevnaden av informationssäkerhet är beroende av en organisations kultur och personalens säkerhetsmedvetande. Motivationsfaktorer för att följa regler för informationssäkerhet har i fallet följt delarna i Protection Motivation Theory och Fogg Behavior Model. Vi ser också att borttagandet av sociala kontakter och påminnelser försvårar för medarbetare att arbeta på ett informationssäkert sätt och för organisationen att påverka sina medarbetare. Vidare är också avsaknaden av kontroll vid utbildning och kommunikation en faktor som är organisationen inte har åtkomst till, detta är ett problem då det försvårar för en organisation att bygga en bild över medarbetarnas kompetens. Insatser för att öka medvetenheten om informationssäkerhet bör ske löpande och det ska vara enkelt för medarbetaren att göra rätt och hitta väsentlig information. / During the Covid-19 pandemic, organisations have shifted from office work to work at home to a greater extent than before with the help of digitalisation. The shift of staff to the home and new communication channels have led to an increased threat to organisations and their employees working with sensitive information. High standards of information security are required within organisations, which calls for great governance efforts regarding information security. Clear communication and training to increase the awareness and capability of employees in the organisation is a key factor in ensuring compliance with the organisation's information security rules. Through a qualitative approach, this case study describes how different employees working from home experience information security efforts and how an organisation can work on information security governance. The study also presents similarities and differences that exist between these two perspectives. We conducted eight interviews with different people from different parts of an organisation that has moved most of its workforce from the workplace to their home.  The findings of the study are that compliance with information security is dependent on an organisation's culture and the security awareness and ability of its staff. Motivational factors for information security compliance in the case followed the elements of Protection Motivation Theory and Fogg's Behavior Model. We also see that the removal of social contacts and reminders makes it more difficult for employees to work in an information-secure manner and for the organization to influence its employees. Furthermore, the lack of control in training and communication is also a factor that is not accessible to the organisation, this is a problem as it makes it difficult for an organisation to build a picture of the competence of its employees. Efforts to raise awareness of information security should be ongoing and it should be easy for employees to do the right thing and find essential information.

With society turning more digitalized, digital crime is reaching higher levels affecting companies and individuals alike. At the same time researchers identify human error and negligence from employees to be the largest reason for companies to being hacked or suffer from cybercrime. At the same time less resources are invested in education within information security compared to expensive firewalls and cyber defenses. The purpose of this thesis is to compare how students at Uppsala University within information systems improve their attitude and behavior towards information security after they have attended at least one course within the subject. This was done by dividing the students into two groups, one (group 1) who had not studied information security and one (group 2) that had. The study used a survey based research method expressed in an online survey. The survey was based on the Knowledge-Attitude- Behavior model which has been used in information security research before with the questionnaire format HAIS-Q. The questionnaire in question was used in this thesis as well, although slightly altered. The result showed that group 2 had better attitude towards information handling as well as a more secure behavior when facing password management. At the same time group 2 achieved a higher mean value in attitude and behavior compared to group 1, although this difference was not statistically significant.