1. Prepare
a project plan merupakan perncanaan proyek untuk tinjauan keamanan. meliputi;
a. Tujuan
Review
b. Ruang
Lingkup (Scope) Review
c. Tugas
yang harus dipenuhi
d. Organisasi
dari Tim Proyek
e. Sumber
Anggaran (Pendanaan) dan
f. Jadwal
untuk Menyelesaikan Tugas
2. Identify
assets atau identifikasi kekayaan, meliputi beberapa kategori asset, yaitu;
a. Personnel
(end users, analyst, programmers, operators, clerks, Guards)
b. Hardware
(Mainfarme, minicomputer, microcomputer, disk, printer,
communication
lines, concentrator, terminal)
c. Fasilitas
(Furniture, office space, computer rrom, tape storage rack)
d. Dokumentasi
(System and program doc.,database doc.,standards plans,
insurance
policies, contracts)
e. Persediaan
(Negotiable instrument, preprinted forms, paper, tapes, cassettes)
f. Data/Informasi
(Master files, transaction files, archival files)
g. Software
Aplikasi (Debtors, creditors, payroll, bill-of-materials, sales, inventory)
h. Sistem
Software (Compilers, utilities, DBMS, OS, Communication Software,
Spreadsheets)
3. Value
assets atau penilaian kekayaan. Parker
Merupakan
cara penilaian atas kekayaan yang hilang (lost), waktu periode untuk
perhitungan atas hilangnya kekayaan, dan umur asset.
4. Identity
threats atau identifikasi ancaman-ancaman,
Sumber ancaman External :
1. Nature
/ Acts of God
2. H/W
Suppliers
3. S/W
Suppliers
4. Contractors
5. Other
Resource Suppliers
6. Competitors
(sabotage, espionage, lawsuits, financial distress through fair or unfair
competition)
7. Debt
and Equity Holders
8. Unions
(strikes, sabotage,harassment)
9. Governments
10. Environmentalist
(Harassment (gangguan), unfavorable publicity)
11. Criminals/hackers
(theft, sabotage, espionage, extortion)
Sumber ancaman Internal :
1. Management,
contoh kesalahan dalam penyediaan sumber daya, perencanaan dan control yang
tidak cukup.
2. Employee,
contoh Errors, Theft (pencurian), Fraud (penipuan), sabotase,
extortion
(pemerasan), improper use of service (penggunaan layanan yg tidak sah)
3. Unreliable
system, contoh Kesalahan H/W, kesalahan S/W, kesalahan fasilitas.
5. Assess
likehood or threats atau penilaian kemungkinan ancaman.
6. analysize
exposure.
Tahap analisis ekspose terdiri dari 4 tugas yaitu :
1. Identification
of the controls in place
2. Assessment
of the reliability of the controls in place
3. Evaluation
of the likelihood that a threat incident will be successful
4. Assess
the resulting loss if the threat is successful
7. Ajust
Contols
8. Prepare
Security Report