1. Read the text below and fill in the gaps in the following sentences.

1) Information security management recognizes the most vulnerable spots in an organization and builds ……………….

2) The only strategy is to engineer………………that achieves a suitable balance between risks and protection against them.

3) The information an organization holds will be…………………………using various media.

4) ………………………………..is the process by which the value of each of an organization’s information assets is assessed and, if appropriate, protected on an ongoing basis.

The Notion of Information Security Management

Information security management is the process by which the value of each of an organization’s information assets is assessed and, if appropriate, protected on an ongoing basis. The information an organization holds will be stored, used and transmitted using various media, some of which will be tangible – paper, for example – and some intangible – such as the ideas in employees' minds. Preserving the value of information is mainly a question of protecting the media in which it is contained.

Building an information security management system (as we present it in this unit) is achieved through the systematic assessment of the systems, technologies and media used for information assets, the appraisal of the costs of security breaches, and the development and deployment of countermeasures to threats. Put simply, information security management recognizes the most vulnerable spots in an organization and builds armor-plating to protect them.

The diversity of the media used for an organization’s information assets is just one of the difficulties to be overcome in building an information security management system. Among other difficulties are the following:

- Effective information security measures often run counter to the mission of an organization. For instance, the safest way to secure a computer and the information on it is to allow no access to it at all!

- The requirement to respect the needs of the users of the organization’s information, so that they can continue to do their jobs properly.

We can deduce that no single solution can address all possible security concerns. The only strategy is to engineer a fit-for-purpose solution that achieves a suitable balance between risks and protection against them.

As with all management systems, the engineering of a fit-for-purpose information security management system is achieved through hard work. Part of the hard work is, of course, an understanding of the technologies involved – we provide the necessary details in this unit. Other major tasks are identifying the needs of the different stakeholders and ensuring coverage of every procedure and policy that involves the development, transformation or dissemination of sensitive information.

Thus, information security management is a development activity analogous to the development of software, and we shall present in this way throughout this unit.

2. Say if the following statements are True or False.

1) Building an information security management system is achieved through the non-systematic assessment of the systems, technologies and media used for information assets.

2) The diversity of the media used for an organization’s information assets is a single difficulty to overcome in building an information security management system.

3) The safest way to secure a computer and its information is to allow no access to it.

4) Information security management is similar to the development of software.

Vocabulary

3. Find English equivalents of the following phrases in the text.

1) оценка

2) противоречить

3) система управления

4) информационный актив

5) заинтересованная сторона

6) нематериальный

7) распространение

8) критичная информация

4. Match the words 1-7 with the definitions a-g.

1) appraisal a) to prevail over; surmount

2) security measures b) an assessment or estimation of the worth,

value, or quality of a person or thing

3) armor-plating c) something that is good enough to do the job

4) to overcome d) programs, routines, and symbolic languages

that control the functioning of the hardware

and direct its operation

5) fit-for-purpose e) activities taken as a precaution against theft

or espionage or sabotage

6) transformation f) arrangement of objects used for protection

7) software g) a change or alteration