Action Design of Information Systems Security Governance for Bank Using COBIT 4.1 and Control Standard of ISO 27001

Abstract:

The aim of the study is to design remediation information systems security governance at Bank. This study provided proposed solutions to solve the existing gaps between the current condition and the expected information systems of the bank's security governance. A case study of a commercial bank is used in this study. There are 7 process frameworks of COBIT 4.1 used to measure the maturity level of information systems security governance. Of these processes, appropriate controls within the framework of COBIT 4.1 and ISO27001 are undertaken. As a result, the security of governance information systems is increasing. In conclusion, there is a need of reliable information systems security governance to achieve the intended business goals.

• Periodical: Advanced Materials Research (Volume 905)
• Pages: 663-668
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.905.663
• Online since: April 2014
• Authors: Idris Gautama So*, N.J. Setiadi, B. Papak, Rudy Aryanto
• Keywords: COBIT 4.1, Information Systems Security Governance, ISO 27000

References

[1] Tim Informasi Hukum, Direktorat Hukum, Peraturan Bank Indonesia No. 9/15/PBI/2007 Penerapan Manajemen Risiko Dalam Penggunaan Teknologi Informasi oleh Bank Umum dan Lampiran, http: /www. bi. go. id/web/id/Peraturan/Perbankan/PBI9_17_2007. htm , retrieved on 16th of August (2012).

DOI: 10.30997/jn.v1i2.235

[2] M. Syafrizal, ISO 17799 : Standar sistem manajemen keamanan, Proceeding of Seminar Nasional Teknologi, Yogyakarta, 24 Nopember (2007).

[3] A. Saputra, Ini dia 9 kasus kejahatan perbankan diawal tahun, 2011. http: /finance. detik. com/read/2011/05/02/193638/1630794/5/ini-dia-9-kasus-kejahatan-perbankan-di-awal-tahun , retrieved on 27 September (2012).

[4] Y. Purwanto & Shaufiah, Audit Teknologi Informasi Dengan COBIT 4. 1 Dan Is Risk Assessment (Studi Kasus Bagian Pusat Pengolahan Data PTS XYZ) (KNS&I10-049, Konferensi Nasional Sistem dan Informatika 2010; Bali, November 13, 2010).

DOI: 10.26905/jtmi.v4i2.2205

[5] IT Governance Institute, COBIT 4. 1, IT Governance Institute, USA, 2007. http: /www. isaca. org/Knowledge-Center/cobit/Pages/Downloads. aspx, Retrieved on 23/09/12.

[6] H. Tanuwijaya & R. Sarno, Comparation of COBIT Maturity Model and Structural Equation Model for Measuring the Alignment between University Academic Regulations and Information Technology Goals, IJCSNS International Journal of Computer Science and Network Security, VOL. 80 10 No. 6, June (2010).

[7] S. Schler, L. Will & M. Shafer, COBIT and Sarbanes Oxley Act, Galileo Press, Boston, (2007).

[8] Sanyoto, Audit Sistem Informasi; Pendekatan COBIT, Ed. Revisi, Jakarta: Mitra Wacana, (2007).

[9] Information System Auditing Resources (ISAR), Comparison between COBIT, ITIL, and ISO27001, 2008. http: /www. securityprocedure. com/comparison-between-cobit-itil-and-iso-27001 , Retrieved on 3rd Oktober (2012).

[10] S. Keller, A. Powell, B. Horstmann, C. Predmore, & M. Crawford, Information Security Threats and Practices in Small Business, Information System Management, (2005).

DOI: 10.1201/1078/45099.22.2.20050301/87273.2

[11] P. M. Summer, Information Security Threats : A Comparative Analysis of Impact, Probability, and Preparedness, Information System Management, (2007).

[12] M. Dey, Information Security Management – A Practical Approach. IEEE, (2007).

[13] ISO/IEC 27001 : 2005, Information Technology – Security Techniques – Information Security Management System - Requierments, 2005. http: /www. iso. org/iso/catalogue_detail?csnumber=42103 , retrieved on 23 September (2012).

DOI: 10.3403/30310928

[14] S. Arikunto, Prosedur Penelitian Suatu Pendekatan Praktek, Jakarta: Rineka Cipta, (2009).

[15] Sugiyono, Metode penelitian Kuantitatif, Kualitatif dan R & D, Alfabeta, Bandung, (2012).

[16] S. Hadi, Metodologi Research, Jilid 1, 2 UGM, (1986).

[17] S. Stainback & W. Stainback, Understanding & Conducting Qualitative Research, Kendall/Hunt Publishing Company, Dubuque, Iowa, (1998).

[18] K.G. Esterberg, Qualitative Methods in social Reserch, Mc Graw Hill, New York, (2002).

[19] A. Sudijono, Pengantar Evaluasi Pendidikan, Jakarta: Rajawali Press, (2009).

[20] B. Tuttle & S. D. Vandervelde, An Empirical Examination of COBIT as an internal control framework for information technology, International journal of Accounting Information System 8, (2007).

DOI: 10.1016/j.accinf.2007.09.001

[21] Tribun News Batam, BI Terima Laporan 1. 009 Laporan Kejahatan Perbankan, http: /batam. tribunnews. com/2012/07/11/bi-terima-1. 009-laporan-kejahatan-perbankan, Retrieved on 27 september (2012).

[22] A. Setiawan, Evaluasi Penerapan Teknologi Informasi Di Perguruan Tinggi Swasta Yogyakarta Dengan Menggunakan Model COBIT Framework, Seminar Nasional Aplikasi Teknologi Informasi 2008 (SNATI 2008) ISSN: 1907-5022 Yogyakarta, 21 Juni (2008).

DOI: 10.31227/osf.io/t2rma

[23] Noerlina & D. C Cory, Pengkajian Tata Kelola Teknologi Informasi Menggunakan Panduan Managemen COBIT, Jurnal Piranti Warta Vol. 11 No. 1 Januari 2008: 15-27.

[24] A. Narkubo & A. Achmadi, Metodologi Penelitian Edisi I. Jakarta : PT Bumi Aksara, (2002).

[25] R. Sheikhpour & N. Modiri, An Approach to Map COBIT Processes to ISO/IEC 27001 Information Security Management Controls, International Journal of Security and Its Applications Vol. 6, No. 2, April, (2012).

[26] U. Sekaran, Reserch Methods For Business, A Skill Building Approach, Secon Edition, John Willey & Sons, Inc. New York, (1992).