Security Standards for Data Processing

Index viii ## Security Standards for Data Processing protecting human life cannot be subject to a cost /benefit analysis. The third major theme is that no set of standards can be imposed without consideration of local conditions. The requirements of each installation depend on a wide variety of factors ranging from its size and geographical location, to the potential value of the company's data should it fall into the wrong hands. This fact has been kept in mind throughout the book, so that the value of any particular procedure or rule is discussed in relation to these variable factors. The primary aim of the book is to help company management (including data processing management) evaluate the security problems in their own installations, and then develop and implement the necessary security standards. With this purpose in mind, the book has been designed for two types of readers: the senior manager, who will be primarily interested in appraising risks, costs and the approach to problem solutions; and the line manager, systems analyst or senior programmer who is given the task of preparing, implementing and monitoring security procedures. The first group will find that the first section of the book treats the relevant material in narrative form. For the second group additional technical detail has been included in a series of appendices. The interested reader is referred to these appendices at the appropriate points in the text. Front Matter....Pages i-ix Introduction: The Risks....Pages 1-8 Risk/Cost/Benefit Analysis....Pages 9-17 The Security Officer....Pages 18-21 Getting Help with Security Problems....Pages 22-30 Personnel....Pages 31-37 The Structure of the Installation....Pages 38-44 Access Control....Pages 45-54 System Checks and Controls....Pages 55-63 Control of Documentation....Pages 64-69 Data Preparation and Data Control....Pages 70-74 File Control....Pages 75-81 The Program Library....Pages 82-88 Computer Room Procedures....Pages 89-93 Fire Detection and Prevention....Pages 94-101 Other ‘Acts of God’....Pages 102-108 Recovering from Disaster....Pages 109-114 Special Considerations for On-line and Real-time Systems....Pages 115-121 The Security Review....Pages 122-128 Establishing Security Standards....Pages 129-137 Fostering Security Awareness....Pages 138-143 Back Matter....Pages 144-186