Protection of Information Assets I. Joko Dewanto 1

Tujuan Pembelajaran  Pendahuluan perkuliahan  Silabus, SAP, GBPP, Perencanaan Perkuliahan

Protection of Information Assets Effective information security arrangement is the foundation for protecting assets and privacy. The security objective of information assets could be enlisted as under:  Information integrity (Integritas informasi)  Confidentiality of sensitive data. (kerahasiaan data yang sensitif)  Adherence to piracy or copy right arrangement. (kebutuhan terhadap pembajak dan hak cipta)  Continued availability of data. (lanjutan ketersediaan data)  Conformity to applicable laws. (konfirmasi terhadap hukum yang berlaku)

Chapter  Establishing Information Security Policy  Identifying Critical Assets and Conducting A Vulnerability Assessment  Tools and Practices for Critical Information Asset Protection  Protection Information Assets Security Management (ISO/IEC 17799:2000) & Certified Risk Analysis Methodology Management (CRAMM )

Chapter Continuous  Importance of Information Security Management  Legal Access  Network Infrastructure Security  Auditing Information Security Management  Auditing Network Security  Environmental Exposures and Controls  Physical Access Exposures and Controls  Mobile Computing

Key concepts you will need to understand  The processes of design, implementation, and monitoring of security (gap analysis baseline, tool selection)  Encryption techniques (DES, RSA)  Public key infrastructure (PKI) components (certification authorities, registration authorities)  Digital signature techniques  Physical security practices  Techniques to identify, authenticate, and restrict users to authorized functions and data (dynamic passwords, challenge/response, menus, profiles)  Security software (single sign-on, intrusion-detection systems [IDS], automated permission, network address translation)  Security testing and assessment tools (penetration testing, vulnerability scanning)

Key concepts you will need to understand  Network and Internet security (SSL, SET, VPN, tunneling)  Voice communications security  Attack/fraud methods and techniques (hacking, spoofing, Trojan horses, denial of service, spamming)  Sources of information regarding threats, standards, evaluation criteria, and practices in regard to information security  Security monitoring, detection, and escalation processes and techniques (audit trails, intrusion detection, computer emergency response team)  Viruses and detection  Environmental protection practices and devices (fire suppression, cooling syste