Analysis and Design of Information Security Management System Based on ISO 27001: 2013 Using ANNEX Control (Case Study: District of Government of Bandung City)

Abstract

The Department of Communication and Information (Diskominfo) of the Bandung City Government is an agency that has the responsibility of carrying out several parts of the Regional Government in the field of communication and informatics. Based on the composition of the regional service organization Bandung City Diskominfo has five fields and two UPTs which are part of the Bandung City Diskominfo. Bandung City Diskominfo in implementing work programs has IT as a supporter of business processes in government agencies. Based on the results of research conducted that IT management in Bandung City Government Diskominfo found several clauses that were still unfulfilled in this Diskominfo impact on the management of government information security institutions that can affect the performance of Bandung City Government. Therefore, there is a need for standardization that needs to be implemented as a guide that examines the direction in safeguarding information or assets that are considered sensitive to an organization. With the existence of these problems pushed to design information security recommendations based on ISO 27001: 2013 standards at Diskominfo. Also makes the design of IT information security systems that are focused on the control of Annex Information Security Policies, Human Resource Security, Operational Security, Communication Security and Asset Management so that business IT processes can run in accordance with the objectives of the organization. The results of this study are expected to help in securing IT information at the Bandung Diskominfo City and can also improve the goals of an organization.

Manajemen Risiko Sistem Informasi Menggunakan ISO 31000 dan Standar Pengendalian ISO/EIC 27001 di Tripio Purwokerto

“…Dalam proses pengendalian risiko dapat mengacu menggunakan ISO/IEC 27001 [16] [17]. ISO/EIC 27001 merupakan standar Internasional yang dipersiapkan untuk mengimplementasikan, membangun, memonitor, mengoperasikan serta merawat sistem manajemen keamanan informasi (SMKI) [17] ISO/EIC 27001 menjadi standar manajemen keamanan informasi oleh organisasi secara luas, menyediakan panduan tertentu yang paling komprehensif untuk mena jemen keamanan informasi di organisasi [19]. Standar ini tidak tergantung pada produk IT, membutuhkan penggunaan pendekatan manajemen berbasis risiko, dan dirancang untuk memastikan bahwa kontrol keamanan yang dipilih mampu untuk melindungi aset informasi dari berbagai risiko [3] [20].…”

Untitled

“…Belakangan, seorang manajer yang menghadapi absensi karyawan dalam organisasinya dapat menggunakan informasi tersebut untuk menentukan jika faktor-faktor tersebut relevan dengan kondisi kerja di perusahaannya. Dengan demikian, penelitian yang dilakukan dengan maksud menerapkan hasil temuan untuk memecahkan masalah-masalah khusus yang saat ini sedang dialami dalam organisasi disebut penelitian terapan [12][13][14].…”

Security on Charity Crowdfunding Services using KAMI Index 4.1

“…Therefore, it is necessary to carry out an assessment related to how information security is implemented in an organization. Several assessment tools can be used related to information security in educational institutions and public service organizations, for example by using ISO 27001:2013 [12], COBIT, a combination of COBIT 4.1 [13], ITIL V.3 [14], ISO 27001 [15] and KAMI Index.…”

“…Tawar, et al: Security on Charity Crowdfunding Services using KAMI Index 4.1 (pp [15][16][17][18][19]. …”