Information security

Graduate School of Information Security Korea University Seoul 136-701, Korea Tel +82 (2) 3290-4895 E-Mail khi - korea.ac.kr... 

Graduate School of Information Security Korea University Seoul 136-701, Korea... 

Subhamoy Maitra received his Bachelor of Electronics and Telecommunication Engineering degree in the year 1992 from Jadavpur University, Kolkata and Master of Technology in Computer Science in the year 1996 from Indian Statistical Institute, Kolkata. He has completed Ph D from Indian Statistical Institute in 2001. Currently he is an Associate Professor at Indian Statistical Institute. His research interest is in Cryptology and Information Security. 

Fridrich J., Goljan M., Soukal D. (2006). Wet paper codes with improved embedding efficiency. IEEE Trans, on Information Security and Forensics, 1(1), 1 02-110. 

Does the software satisfy site-specific and any applicable regnlatory information security requirements (e.g., 21 CFR part 11) ... 

Datapro Research. Datapro Reports on Information Security. Del-ran, NJ McGraw-Hill, 1989. 

Information Technology) security development and evaluation according to Common Criteria (ISO/IEC 15408) family of standards. The main goal of developing the tool is to make these activities easier. The tool is based on the enhanced concept of generics, advanced functionality, compliant to ISO/IEC DTR 15446 and the recent information security management standards, and on the risk analysis as well. 

The features improving compatibility with information security management standards were implied basing on experiences in software development compliant to BS-7799-2 standard (SecFrame [24]). 

Improved Compliance with Information Security Management Systems and Other Useful Features... 

The following tool features can be useful to deploy more easily the certified against CC security-related products, by the organization compliant to information security management standards, like ISO/IEC 17799, BS-7799-2, ISO/IEC 13335 ... 

Krueger B. Application of the Common Criteria to Information Security Management Systems—A study, 5th International CC Conference, Berlin, September 2004. 

Key action line 1 National policy on information security and cross-border co-operation... 

Support for research and development in security, aiming at threat and vulnerability reduction, should be a key element in the national R D support program and should be linked to the broader strategy for improved network and information security. Likewise, the national standardization organizations should accelerate their work on interoperability, certification, electronic signatures, further development and deployment of IPv6 and IPSec, and should also review and promote the use of all relevant security standards, including but not limited to the Common Criteria for Information Systems Assurance. 

Commission of the European Communities, 2001, Communication from the Commission to the Council, the European Parliament, the European Economic and Social Committee and the Committee of the Regions, Network and information security Proposal for a European policy approach, COM(2001) 298 final, http //www.europa.int/ information society/eeurope/news library/pdf files/netsec en.pdf... 

Council of the European Union, 2001, Resolution of 6 December 2001 on a common approach and specific actions in the area of network and information security, http //www.europa.int/information society/eeurope/news library/ pdf files/netsecres en.pdf... 

As information security is concerned, there is a need to concurrently bear in mind information assurance, technical ICT security (systems and components), cybercrime, infowar, but also aspects of privacy, trust and confidence, and information assurance. This variety of definitions further jeopardizes the communication among analysts and both policy and business decision makers. In any case, multi-disciplinary approaches, although recognized as urgently needed, still remain a remote aspiration. 

Common Criteria for Information Security Evaluation, Part 1 Introduction and General Model, Part 2 Functional Security Requirements, Part 3 Security Assurance Requirements, version 2.2, January 2004... 

ISO/IEC, International Standard ISO/IEC 17799 2000 Code of Practice for Information Security Management, 2000... 

Price Waterhouse Cooper s Information Security Breaches Survey 2002 for the UK Dept, of Trade and Industry states that 44% of UK businesses have suffered at least one malicious security breach in the past year, nearly twice as many as in the 2000 survey 3. 

Secure e-Mail and the FDA ESG. e-Mail is in widespread use within CDER and industry. Secure e-mail between CDER and industry is useful for informal communications when confidential information may be included in the message (for example, trade secrets or patient information). Secure e-mails should not be used for formal regulatory submissions (for example, NDAs, INDs, amendments, and supplements). 

Europe issued its own directive on electronic signatures in 1999." Although originally developed for e-commerce, it is also applicable to GDP and GMP apphcations. The MCA is clarifying the scope of its use for GCP and GLP apphcations, and at least a minimum degree of applicability is certain. European regulatory authorities refer to ISO 17799 on information security management" and reference to advice on the admissibility of electronic records." ... 

Information security management (including virus checking)... 

Written security procedures establish the accountability, audit trails, and the separation of duties necessary to safeguard a computerized system. Refer to the operational support product for related information. Security procedures may include the following ... 

It is recommended that both client company and service provider appoint Regulatory Compliance Officers and Information Security Officers accountable for maintaining a state of regulatory compliance and secure operations. 

L. Janczewski and F. X. Shi. 2002. Development of information security baselines for healthcare information systems in New Zealand. Computers and Society 21(2) 172-192. 

The platform should support the inspection activities of the regulatory authorities, test results, treatment advice, rectification, analysis summarizing cycle monitoring and management, to provide strong information security management work. 

Information security is an important issue that is being dealt with in a variety of ways. At one extreme some companies have discouraged integration as a means of maintaining information security. Others allow access only on a demonstrated need-to-know basis and do not allow access from terminals at home. At the other end of the spectrum are companies that allow full database access for all research employees as well as access from home. The balance between the need to share research information and the need to provide security is a difficult one at which to arrive. As chemical information systems become more powerful and companies become more securityconscious this balance will need to be adjusted in the direction of greater security control. 

---