Information security: A comprehensive overview for businesses in the proper selection and implementation of a secure information system and policy

Security is often defined as being free from risk or danger - synonymous with safety. So how can information security be such an issue? How can external possession of information cause risk or danger? The answer to these questions becomes quite obvious when one considers the cliche: knowledge is power. This reality holds even more weight and validity when it pertains to proprietary information - like that of a business. Unfortunately, 28% of managers surveyed say their company lacks a written security policy (Security Sense, 2003). This statistic is not acceptable. Security of sensitive information has been significantly compromised by the phenomenon commonly known as the Internet explosion. Millions of organizations, businesses, and individuals go online everyday essentially bringing vast numbers of unsecured computer and information networks into communication with each other. This dynamic environment has obviously benefited the business world in various ways. However, it too has forced organizations to seriously consider, if not establish its information security policy. The realm of information security is still very much a new science if you will. Many hesitate to yet call it a science since there is no existing paradigm pertaining to its application. The objective of this thesis is to provide a guide to entrepreneurs and newcomers concerning information security, as well as make progress in the attempt to establish taxonomy for the proper selection of a secure information system/policy