Analiza prijetnji i rizika cyber sigurnosti Republike Hrvatske: ranjivost informacijske infrastrukture

master's thesis

• Title (english): Analysis of the threats and risks of the cyber security of the Republic of Croatia: vulnerability of information infrastructure
• Author: Ana-Maria Kezerić
• Mentor: Ružica Jakešević (mentor)
• Committee member: Ružica Jakešević (predsjednik povjerenstva)
• Committee member: Gordana Vilović (član povjerenstva)
• Granter: University of Zagreb; The Faculty of Political Science; Zagreb
• Defense date and country: 2017-09-25, Croatia
• Scientific / art field, discipline and subdiscipline: SOCIAL SCIENCES; Information and Communication Sciences; Journalism

Abstract

Cilj istraţivanja bio je utvrditi koje su organizacijske i tehničke slabosti tvrtki iz sektora kritičnih infrastruktura koje bi posredno ili neposredno mogle utjecati na nacionalnu sigurnost Republike Hrvatske. Rad se sastoji od analize regulativnog i institucionalnog okvira vezanog uz tematiku i trenutno stanje na području informacijske i cyber sigurnosti te gap analize (analize rascjepa, jaza) ISO/IEC 27001: 2013 standarda informacijske sigurnosti u tri javno-zdravstvene ustanove i jednoj energetskoj kompaniji. Premda se rezultati zbog ograničenosti uzroka ne mogu generalizirati na kompletni zdravstveni i energetski sustav, narušavanje sigurnosti i jedne bolnice moţe rezultirati gubljenjem tisuće osobnih podataka i kaosom u cijelom sustavu. Analiza je pokazala da se zbog manjka financijskih sredstava i podkapacitiranosti u analiziranim zdravstvenim institucijama koriste zastarjeli softveri, a osoblje nije dovoljno osviješteno o pitanjima informacijske sigurnosti te ne postoji sistematična politika koja bi na internoj razini regulirala tu tematiku. Za razliku od zdravstvenih ustanova koje u većoj mjeri nisu usklaĎene sa međunarodno prihvaćenim standardima informacijske sigurnosti, energetska tvrtka u svakodnevnom poslovanju vodi se svim propisanim kontrolama iz ISO standarda.

Abstract (english)

The object of the research was identifying the organizational and technical defficiencies of critical infrastructure companies which could, directly or indirectly,have an effect on the Republic of Croatia's national security.The thesis consists of an analysis of the regulatory and institutional framework related to the subject and the current circumstances in information and cyber security, and an ISO IEC 27001: 2013 gap analysis of information security standards of three state healthcare institutions and one energy company. Although the results cannot be applied to the entire healthcare or energy systems due to a restricted sample, a breach in security of one hospital alone may cause loss of personal data of thousands and result in chaos in the entire system. The analysis has shown that analyzed healthcare institutions use outdated software due to lack of resources and undercapacity, and that the
86
staff are not sufficiently familiar with information security issues.A systemic policy which would regulate the issue internally is also non-existent.Unlike healthcare institutions, which are largely inconsistent with internationally acclaimed information security standards, the energy company administers all ISO-standard prescribed controls in its day-to-day operations.

• Keywords: nacionalna sigurnost; informacijska sigurnost; cyber prijetnje; ISO standardi; zdravstvene ustanove; energetske tvrtke; kritična infrastruktura
• Keywords (english): national security; information security; cyber threats; ISO standards; healthcare
• Language: croatian
• URN:NBN: urn:nbn:hr:114:721646
• Study programme: Title: Journalism; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra novinarstva (magistar/magistra novinarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Open access
• Created on: 2017-10-26 10:20:37