基于ISO27001的北京XX企业信息安全管理体系的建立与实施

发布时间：2018-03-28 13:36

本文选题：ISO27001　切入点：信息安全　出处：《山东大学》2015年硕士论文

【摘要】：随着互联网技术发展风起云涌,依托于信息技术的国民经济正方兴未艾,依赖于互联网经济的中小企业也如雨后春笋般蓬勃发展。信息已成为了当今社会主流的发展资源,信息安全变成了企业赖以运行的基础保障之一。如今,在这个信息传播高度发达的时代,对于一个企业来说,信息,尤其是敏感信息很大程度上决定了企业的兴衰甚至是生死存亡,它已悄然地变为了一项企业的重要资产。数据是现代企业关键业务发展的支撑和基础,不仅包括企业财务数据、计算机产生的数据,还包括企业文化、品牌、知识产权、雇员信息、顾客信息等,像其它重要的商业资产那样,信息资产具有重要的价值,因此需要进行妥善管理和保护。本文描述了北京XX企业信息安全管理体系的规划和实施过程。运用"PDCA"过程方法论,基于ISO/IEC270011国际标准,建立了适合公司发展战略的信息安全管理体系(Information Security Management System)(简称ISMS),将北京XX企业信息管理置于不断安全的良性循环中；本文对ISO/IEC27001标准、风险管理、"PDCA"过程方法论、信息安全管理体系的很多案例做了大量的研究,依据标准调研了北京XX企业的信息安全管理现状,并对差距进行有效的分析,依据企业信息资产的特点设计了定性和定量相结合的风险评估方法,设计了企业的信息安全管理体系框架,编写了可覆盖11个安全域,39个控制目标的信息安全管理的程序文件,制订了有效信息安全管理的有效策略,对公司员工进行连续的信息安全意识培训等,并在组织ISMS体系实施过程中,采用相应的技术手段来配合：购买了防火墙、UPS、交换机、域控服务器以及自主研发了NAS存储服务器等设备,使得信息资产所面临的风险降至可接受范围之内。组织信息安全管理体系成功的实施运行,更好的促进企业的信息资产安全,有效地保护了信息数据的安全传输、存储、控制,建立健全公司的信息安全保障体系,使公司业务能够可持续的发展运行。企业的信息安全管理体系取得了IS027001认证,保护了公司的竞争力、提高了公司员工的信息安全意识、维护了公司在客户心中的信誉、增强了公司发展的凝聚力。本文为中小企业成功的建设和实施信息安全管理体系提供了一个典型的案例。
[Abstract]:Along with the development of Internet technology raging like a storm relying on information technology, the national economy is just unfolding, depend on the Internet economy of small and medium-sized enterprises such as bamboo shoots after a spring rain rapid development has become the development of resource information. The mainstream of today's society, information security has become one of the enterprises rely on basic guarantee operation. Now, in this highly developed era of information dissemination, for an enterprise, information, especially the sensitive information largely determines the rise and fall of the enterprise and is of vital importance, it has quietly become an important asset for an enterprise. The data is the key business support and basis for the development of modern enterprises, including not only the financial data of the enterprise, the computer generated data, including corporate culture, brand, intellectual property rights, employee information, customer information, like other important business assets, has the important value of information assets Therefore, the need for proper management and protection. This article describes the Beijing XX enterprise information security management system planning and implementation process. Using the "PDCA" process methodology, ISO/IEC270011 based on international standards, establish the information security management system for the company's development strategy (Information Security Management System) (ISMS), the virtuous cycle of information management in Beijing XX enterprises continue to secure the ISO/IEC27001; standard, risk management, the "PDCA" process and methodology, many cases of information security management system has done a lot of research, based on the investigation of the standard of information security management status of Beijing XX enterprises, and carry out effective analysis on risk assessment methods based on the characteristics of gap. The design of enterprise information assets both qualitative and quantitative, design the framework of enterprise information security management system, compile the covering 11 security The domain of information security management, the 39 control objectives of the program file, formulate effective strategies for effective information security management, information security awareness training for the employees of the company, and in the organization of ISMS system in the implementation process, the use of appropriate technical means to buy: firewall, UPS, switches, domain control independent research and development of NAS server and storage server equipment, makes the risk of information assets to the acceptable range. The implementation of operation organization of information security management system successfully, and better promote the information safety of enterprise assets, effectively protect the safety of information transmission, data storage, control, establish and improve information security system the company, the company can develop sustainable operation. Information security management system of enterprises and achieved IS027001 certification, to protect the company's competitiveness, improve the public The information security consciousness of the staff has maintained the company's reputation in the customer's mind and enhanced the cohesion of the company's development. This article provides a typical case for the successful construction and implementation of information security management system for small and medium-sized enterprises.

【学位授予单位】：山东大学
【学位级别】：硕士
【学位授予年份】：2015
【分类号】：TP309

【相似文献】