Best Practices for Information Security
Information Security best practices are described by a number of generally accepted sources. Several of those sources are identified below. These sites are maintained by the sponsoring organization, not WPI.
- Information Security Handbook: A Guide for Managers
- American Institute of Certified Public Accountants (AICPA)
- Association for College and University Policy Administrators (ACUPA)
- Best of Breed conference presentation by Pat Spacely.
- American National Standards Institute (ANSI)
- BSI (British Standard Institute), identified eleven steps to implement an ISO-compliant Information Security Management System. The key steps for compliance are purchasing the ISO standard; developing and implementing livable and compliant policies, standards, guidelines and procedures; communicating and training, and utilizing appropriate defined processes to respond to a breach.
- The Center for Democracy and Technology (CDT) provides a chart identifying the legal standards for government access to papers, records, and communications. http://www.cdt.org/wiretap/govaccess/accesschart.shtml
- The Control Objectives for Information and related Technology (COBIT) is a set of best practices (framework) for Information Technology (IT) management created by the Information Systems Audit and Control Association (ISACA), and the IT Governance Institute (ITGI) in 1992. COBIT provides managers, auditors, and IT users with a set of generally accepted measures, indicators, processes and best practices to assist them in maximizing the benefits derived through the use of information technology and developing appropriate IT governance and control in a company.
- COBIT wiki: http://en.wikipedia.org/wiki/COBIT
- COBIT is available from the (ISACA) at http://www.isaca.org/Template.cfm?Section=COBIT6&Template=/TaggedPage/TaggedPageDisplay.cfm&TPLID=55&ContentID=31519
- COSO (Committee of Sponsoring Organization of the Treadway Commission) is a voluntary private sector organization dedicated to improving the quality of financial reporting through business ethics, effective internal controls, and governance. Publications are available through the American Institute of Certified Public Accountants (www.aicpa.org).
- Disaster Recovery Institute, International
- Educational Center for Applied Research (ECAR), the research branch of EDUCAUSE
- Information Security Glossary used by ECAR
- EDUCAUSE is a nonprofit association whose mission is to advance higher education by promoting the intelligent use of information technology.
- "Effective IT Security Practices and Solutions Guide: Balancing the Need for Security and Open, Collaborative Networking"
- Information Security Assessment Tool for Higher Education
- Federal Trade Commission (FTC)
- Defend Against Identity Theft
- Protecting Personal Information: A Guide for Business
- Defend Against Identity Theft
- International Standards Organization (ISO)
- The ISO 27000 series are the Information Security Standards.
- ISO 17799 was renamed to ISO 27002.
- ISO 17799 wiki with a link to the ISO 27002 wiki.
- IT Compliance Institute - 10 Top forum
- ISACA's information security (IS) auditing and IS control standards are followed by practitioners worldwide. Its research pinpoints professional issues challenging its constituents. Its Certified Information Systems Auditor (CISA) certification is recognized globally and has been earned by more than 55,000 professionals since inception. The Certified Information Security Manager (CISM) certification uniquely targets the information security management audience and has been earned by more than 7,000 professionals. It publishes a leading technical journal in the information control field, the Information Systems Control Journal.
- IT Governance Institute aims to benefit enterprises by assisting enterprise leaders in their responsibility to make IT successful in supporting the enterprise's mission and goals. By conducting original research on IT governance and related topics, ITGI helps enterprise leaders understand and have the tools to ensure effective governance over IT within their enterprise.
- National Institute of Standards and Technology (NIST) Computer Resource Center
- Special Publications in the 800 series present documents of general interest to the computer security community.
- Security for Telecommuting and Broadband Communications
- Research and Education Network Information Sharing and Analysis Center (REN-ISAC) is an integral part of higher education's strategy to improve network security through information collection, analysis, dissemination, early warning, and response. REN-ISAC services and products are specifically designed to support the unique environment and needs of organizations connected to served higher education and research networks, and supports efforts to protect the national cyber infrastructure by participating in the formal U.S. ISAC structure. REN-ISAC is hosted by Indiana University and with the support and cooperation of Internet2, Louisiana State University, EDUCAUSE, and contributors (such as WPI).
- SANS Institute
- SANS Policy Templates
- SANS Policy Primer
- The Information Technology Division endorsed this page on January 22, 2008.
- The faculty Committee on IT Policy endorsed this page on February 19, 2008.
Last modified: Feb 14, 2012, 18:56 EST