The Project, now in Congress, establishes the principles, rights and duties of web users.
National Congress will soon appreciate the bill on the Internet, also called Marco Civil Internet, which provides the principles, rights and duties in using the World Wide Web.
The scope of the project includes users, companies and the government as well.
For two years, between 2009 and 2011, and before it was formally established as a project of law by the Ministry of Justice, the issue was discussed by civil society organizations. In the process, it received more than 2000 contributions and 100 thousand accesses by Internet.
This project reinforces the constitutional principles as free speech, privacy and secrecy of communications, human rights, and the broad right of access to the internet for everyone.
It also establishes that the person, and the person only, will be held responsible for the content posted anywhere on the net is becoming liable for any damage caused, and exempting the provider or intermediary (websites, blogs, portals and social networks) from that liability. The service provider will only respond if it breaks a prior judicial decision determining the removal of content.
Another important point concerns the storage of data, and determines that the provider must store for a year the records of users' connection (IP of the computer - and time and date of access). Such data can only be obtained by court order, and this one year term of custody of records could be extended upon demand, be it by the police authority supporting the judiciary.
Net neutrality is another fundamental point, which requires ISPs to give undifferentiated treatment to all packets of data traffic on their networks. They may not favor certain Web sites over others, while providing them, for example, a faster access (faster band).
The state also confirms its role, reducing inequalities in Internet access and encouraging the use of the network as a tool for transparency and democracy. The project, however, does not cover issues such as copyright, cybercrime, and e-commerce.
To become law, the project must be approved by the House of Representatives and the Senate.
Hopefully it will be through and ready for the President´s approval by the end of the year.
Affichage des articles dont le libellé est information security. Afficher tous les articles
Affichage des articles dont le libellé est information security. Afficher tous les articles
mercredi 14 septembre 2011
vendredi 23 avril 2010
Information Security Team
It is known that CI professionals, watchers of all calibers, lobbyists and advocators are after valuable information within and without their companies.
Once the information is taken for granted and becomes part of the immaterial assets of the company, it is absolutely necessary to set up policies to protect the good handling of it and its protection.
Who will do it?
A team specifically dedicated to the Information security.
Next questions comes up, how to set such a team? Who will lead it?
Some aspects to take into consideration when setting up a department of information security must be taken into account.
Knowledge in information security is contained in different models currently available: among them we have those of ISO / IEC series 27000 (information security).
The knowledge relating to Management of System Information Security (ISO 27001) and the Code of Practice for the Management of Information Security (ISO 27002) should be disseminated throughout the organization. However, at the time of structuring a department of information security, companies find themselves in a worrying scenario.
1 - The information security analyst should have a high technical knowledge. I'm not referring to the certifications, I'm talking about practical knowledge and experience in the subject.
2 - Some companies insist on promoting someone internal to the IT Department to the position of Manager of Information Security. The professional would actually have a very different profile compared to that necessary to take responsibility.
As an example, I will describe the profile found among those who are promoted to the position of Manager of Information Security described on the above paragraph:
• He has experience in broader subjects such as database and software development, using security features of the very basic information.
• He does not have a history of participation in lectures / events or trainings on information security.
• He is not acquainted with international standards of information security (e.g. ISO 27002) and does not follow the bulletins about new threats on the Internet.
• He performs reading only on books related to database technologies and languages of software development.
• He has a degree on technology in database, MBA in Information Technology and certifications from Microsoft and Oracle.
- You could guess what was his role in the company? That's right! He was responsible for managing the database. Now he is the Manager of Information Security. He has lots of ground to cover up to reach the necessary profile.
3 - Some companies create a department of information security management to access computing environment. It creates users, changes passwords, sets permissions on directories etc... All this to comply with regulations or audits.
4 - Creating a department of information security subordinated to the area of Information Technology is the most common mistake organizations make.
The security area should be aligned to the legal department and audit on the organization chart. The area of information security subordinated to the director of IT functions more as technical support rather than an area responsible for the whole Management of System Information Security.
Success factors
The success of your company is not connected to the technological arsenal. There are some factors that should be considered when deciding to create a team of information security and implement a Management of System Information Security - MSIS. The first factor is to obtain approval from the organization's managers to launch the project of implementation of the MSIS.
At this stage the project team presents the priorities, objectives and scope for deploying the MSIS. It should also discuss a change in the company's organizational structure, including responsibilities, to meet the project objectives and business needs.
The output of this phase is the approval and commitment of managers to implement the Management of System Information Security.
The second factor is the development of diagnosis and analysis on the level of maturity. During this phase, we map the current situation of the organization and present a list of needed improvements in the processes of information security to set up a link between the organization's strategic planning and implementation of security systems.
The third aspect is the creation of an Interdepartmental Committee for the development of policy and standards for information security, including support of the board and / or senior management, based on guidelines from the Information Security Governance, business needs and regulations.
With the support of the CEO
The creation of a team of information security and the defining of their responsibilities depend mainly on the guidelines established by the board and / or directors. These guidelines should be documented in the policy of Information Security Governance.
Governance of Information Security will clarify for managers the company's strategic objectives in relation to information security. Down the line it will present a list of legal requirements / regulations and contractual requirements involving information security applicable to the business.
The combination of these three factors will help your company in creating a team of information security and implementation of a Management System Information Security.
Sources: ISO/IEC 27001,27002; ABNT
Once the information is taken for granted and becomes part of the immaterial assets of the company, it is absolutely necessary to set up policies to protect the good handling of it and its protection.
Who will do it?
A team specifically dedicated to the Information security.
Next questions comes up, how to set such a team? Who will lead it?
Some aspects to take into consideration when setting up a department of information security must be taken into account.
Knowledge in information security is contained in different models currently available: among them we have those of ISO / IEC series 27000 (information security).
The knowledge relating to Management of System Information Security (ISO 27001) and the Code of Practice for the Management of Information Security (ISO 27002) should be disseminated throughout the organization. However, at the time of structuring a department of information security, companies find themselves in a worrying scenario.
1 - The information security analyst should have a high technical knowledge. I'm not referring to the certifications, I'm talking about practical knowledge and experience in the subject.
2 - Some companies insist on promoting someone internal to the IT Department to the position of Manager of Information Security. The professional would actually have a very different profile compared to that necessary to take responsibility.
As an example, I will describe the profile found among those who are promoted to the position of Manager of Information Security described on the above paragraph:
• He has experience in broader subjects such as database and software development, using security features of the very basic information.
• He does not have a history of participation in lectures / events or trainings on information security.
• He is not acquainted with international standards of information security (e.g. ISO 27002) and does not follow the bulletins about new threats on the Internet.
• He performs reading only on books related to database technologies and languages of software development.
• He has a degree on technology in database, MBA in Information Technology and certifications from Microsoft and Oracle.
- You could guess what was his role in the company? That's right! He was responsible for managing the database. Now he is the Manager of Information Security. He has lots of ground to cover up to reach the necessary profile.
3 - Some companies create a department of information security management to access computing environment. It creates users, changes passwords, sets permissions on directories etc... All this to comply with regulations or audits.
4 - Creating a department of information security subordinated to the area of Information Technology is the most common mistake organizations make.
The security area should be aligned to the legal department and audit on the organization chart. The area of information security subordinated to the director of IT functions more as technical support rather than an area responsible for the whole Management of System Information Security.
Success factors
The success of your company is not connected to the technological arsenal. There are some factors that should be considered when deciding to create a team of information security and implement a Management of System Information Security - MSIS. The first factor is to obtain approval from the organization's managers to launch the project of implementation of the MSIS.
At this stage the project team presents the priorities, objectives and scope for deploying the MSIS. It should also discuss a change in the company's organizational structure, including responsibilities, to meet the project objectives and business needs.
The output of this phase is the approval and commitment of managers to implement the Management of System Information Security.
The second factor is the development of diagnosis and analysis on the level of maturity. During this phase, we map the current situation of the organization and present a list of needed improvements in the processes of information security to set up a link between the organization's strategic planning and implementation of security systems.
The third aspect is the creation of an Interdepartmental Committee for the development of policy and standards for information security, including support of the board and / or senior management, based on guidelines from the Information Security Governance, business needs and regulations.
With the support of the CEO
The creation of a team of information security and the defining of their responsibilities depend mainly on the guidelines established by the board and / or directors. These guidelines should be documented in the policy of Information Security Governance.
Governance of Information Security will clarify for managers the company's strategic objectives in relation to information security. Down the line it will present a list of legal requirements / regulations and contractual requirements involving information security applicable to the business.
The combination of these three factors will help your company in creating a team of information security and implementation of a Management System Information Security.
Sources: ISO/IEC 27001,27002; ABNT
Inscription à :
Articles (Atom)
