Revizija informacijskih sustava primjenom norme ISO 27001

master's thesis

• Title (english): Information system auditing using ISO 27001 standard
• Author: Matea Mitrović
• Mentor: Mario Spremić (mentor)
• Committee member: Ivan Strugar (predsjednik povjerenstva)
• Committee member: Boris Tušek (član povjerenstva)
• Granter: University of Zagreb; Faculty of Economics and Business; (Department of Informatics); Zagreb
• Defense date and country: 2022-09-26, Croatia
• Scientific / art field, discipline and subdiscipline: SOCIAL SCIENCES; Economics; Business Informatics

Abstract

U ovom radu, uz pojmovno određenje, opisana je i važnost zaštite informacija i informacijskih sustava, obzirom na sve brojnije hakerske napade, te značaj provedbe revizije informacijskih sustava u poslovanju. Opisani su ciljevi i postupci provedbe revizije informacijskih sustava, te najčešće korišteni standardi i okviri u području revizije informacijskih sustava. Poseban naglasak stavljen je na standard ISO 27001, koji na sveobuhvatan način utvrđuje najvažnija područja informacijske sigurnosti uz procjenu rizika, kao ključni parametar za donošenje odluka i provođenje sigurnosnih mjera. U praktičnom dijelu rada provedeni su postupci testiranje implementiranih kontrola u poduzeću XYZ d.o.o., koji posjeduje certifikat norme ISO/IEC 27001, te su dane preporuke za poboljšanje postojećeg stanja.

Abstract (english)

In addition to conceptual definition, this paper also describes the importance of protecting information and information systems, given the increasing number of hacker attacks, and the significance of auditing information systems in business. The objectives and procedures of information systems audits are described, as well as the most commonly used standards and frameworks in the field of information systems audits. Special emphasis is placed on the ISO 27001 standard, which comprehensively defines the key areas of information security along with risk assessment, as a key parameter for decision-making and the implementation of security measures. In the practical work section, the procedures for testing the implemented controls in the company XYZ d.o.o., which has an ISO/IEC 27001 certificate, were carried out, and recommendations were given for improving the current situation.

• Keywords: informacija; informacijski sustav; revizija informacijskih sustava; sigurnost; incident; rizik; standard; ISO 27001
• Keywords (english): information; information system; audit of information systems; security; incident; risk; standard; ISO 27001
• Language: croatian
• URN:NBN: urn:nbn:hr:148:747277
• Study programme: Title: Business Economics; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra ekonomije (magistar/magistra ekonomije)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Access restricted to students and staff of home institution
• Created on: 2022-09-27 13:54:13