ESTABLISHMENT OF INFORMATION SECURITY MANAGEMENT SYSTEM IN NLB, D.D.

Diplomska naloga obravnava vzpostavitev sistema upravljanja varovanja informacij (SUVI) v Novi Ljubljanski banki d.d. in merjenje učinkovitosti kontrol. V prvem delu diplomske naloge so podane teoretične osnove s področja varovanja informacij. Opisani so standardi in primeri dobre prakse, ki jih organizacije lahko uporabijo v pomoč pri doseganju učinkovitega varovanja informacij. V drugem delu je predstavljena organizacija Nova Ljubljanska banka d.d. Predstavljena je organiziranost projektnega sistema Nove Ljubljanske banke d.d. in življenjski cikel projektov. V nadaljevanju je opisan projektni pristop k vzpostavitvi in upravljanju SUVI, katerega aktivnosti so razvrščene po posameznih fazah Demingovega kroga, tako da je razvidno, v kateri fazi se Nova Ljubljanska banka d.d. nahaja in katere aktivnosti morajo biti še izvedene. Potem je predstavljen model merjenja učinkovitosti kontrol, s katerim se je ocenjevala skladnost z zahtevami po izobraževanju zaposlenih s področja varovanja informacij. Opisan je sam postopek zasnove modela merjenja učinkovitosti, kjer so opisno in grafično predstavljeni tudi rezultati merjenja.The dissertation deals with establishing of Information security management system (ISMS) and measure the effectiveness of security controls within the organization Nova Ljubljanska banka, d.d. The first part of dissertation consists of the theoretical basis of information security. It describes the standards and best practices, that organizations can use to achieve effective information security. In the second part of dissertation the organization Nova Ljubljanska banka, d.d. is presented. Then the project system organization of Nova Ljubljanska banka, d.d. and the project life cycle are presented. In the next sequel the project-based approach to the establishment and management of the ISMS is presented. To determine the phase in witch Nova Ljubljanska banka, d.d. is and to recognize the activities that needs to be taken, the ISMS\u27s activities are arranged by its corresponding phase of Deming cycle. Then the information security measurement model we used to assess compliance with annual information security awareness training requirement is presented. Here the model\u27s design process is presented and then the results of measurement are descriptively and graphically presented