Hasil Pencarian  ::  Simpan CSV :: Kembali

"ABSTRAKInformasi merupakan aset vital bagi suatu organisasi, oleh karena itu maka diperlukan suatu mekanisme yang terstruktur untuk melindungi informasi yang dimiliki suatu organisasi. Perguruan tinggi merupakan salah satu sektor yang berisiko sangat tinggi terhadap keamanan informasinya. Perguruan tinggi dihadapkan pada tantangan menyeimbangkan antara kultur keterbukaan informasi dengan penjaminan perlindungan aset informasinya. Universitas XYZ merupakan salah satu perguruan tinggi yang memiliki aset informasi yang perlu dilindungi. Berdasarkan hasil wawancara dapat diketahui bahwa telah terjadi beberapa masalah yang menyangkut insiden keamanan informasi yang menimbulkan kerugian berupa kerugian finansial, kerugian operasional dan kerugian reputasi atau citra Universitas XYZ.Penelitian ini bertujuan untuk mengidentifikasi aset, risiko dan memberikan kontrol keamanan informasi yang sesuai dengan keadaan di Direktorat Akademik Universitas XYZ. Kontrol keamanan informasi yang digunakan berbasis ISO 27001:2013. Penelitian ini merupakan penelitian studi kasus dengan metode penelitian semi kuantitatif. Penelitian ini membahas mengenai serangkaian kegiatan manajemen risiko dan menerapkan kontrol keamanan informasi yang tepat yang terdapat pada ISO 27001:2013.Hasil penelitian ini adalah rancangan kebijakan keamanaan informasi bagi Direktorat Akademik Universitas XYZ. Rancangan kebijakan keamanan informasi digunakan sebagai acuan dalam meminimalisir risiko keamanan informasi.

---

ABSTRACT

Information is a vital assets for organization, therefor a structured mechanism is needed to protect organization information assets. Higher education is one of the highest sector that have high risk in their information security area. Higher education are faced with the challenge of balancing between the culture of information opennes and protection of information assets. XYZ University also have information assets that needs to be protected. Based on interview, there are several information security incidents causing financial, reputation and operational loss for XYZ University.

This research aims to identify assets, risk, and appropriate information security control suitable for XYZ University Academic Directorate. Information security control based on ISO 27001:2013. This is a case study research with a semi quantitative method. This research discuss about a set of risk management activity and implement appropriate information security control based on ISO 27001:2013.

Result of this research is an information security policy design suitable for Academic Directorate University of XYZ. Information security policy is used as a reference to minimize the risk of information security."

"Organisasi perlu menerapkan suatu keamanan informasi yang baik agar proses bisnis organisasi bisa berjalan tanpa ada ancaman. Aset TI merupakan hal yang harus dilindungi dikarenakan berpengaruh dengan proses bisnis organisasi. PT XYZ bergerak dibidang manage service untuk network dan juga cloud. Apabila terjadi kendala pada operasional organisasi dapat mengganggu Service Level Agreement (SLA) dengan pelanggan dan proses bisnis internal. Oleh karena itu, dibutuhkan manajemen risiko keamanan informasi yang tepat dan akurat. Permasalahan pada PT XYZ tidak pernah melakukan pembaharuan terhadap manajemen risiko sudah lebih dari tiga tahun, yang mana organisasi belum mengetahui jika terdapat risiko baru yang mengancam operasional. Operation risk atau risiko operasional akan diteliti dikarenakan operation risk akan berdampak kepada SLA pelanggan dan juga proses bisnis PT XYZ. Sudah ada dua kejadian serangan yang terjadi seperti DDOS Attack dan Ransomware pada aset organisasi beberapa waktu lalu. Maka dari itu dalam suatu organisasi diharuskan mempunyai manajemen keamanan informasi untuk dapat mengontrol segala risiko yang ada agar tidak menimbulkan kerugian pada organisasi. Untuk kerangka kerja dari keamanan informasi menggunakan kontrol dari ISO/IEC 27001:2013 sebagai acuannya. Tujuan dari penelitian ini adalah memberikan rekomendasi usulan ruang untuk berkembang pada organisasi khususnya pada operation risk PT XYZ. Dengan hasil evaluasi kondisi manajemen risiko keamanan informasi menggunakan standar ISO/IEC 27001:2013, didapatkan analisis kesenjangan dengan keamanan informasi pada organisasi sebesar 83,91% atau sebagian besar tercapai. Selanjutnya untuk rekomendasi ruang untuk berkembang menggunakan 10 rekomendasi kontrol dalam bentuk Statement of Applicability (SOA) dan usulan 10 pemilihan kontrol risiko pada risiko yang masih berstatus mitigasi pada operation risk.

---

Organizations must be able to implement a good information security so that the organization can run its business processes without any threats. IT assets are things that must be protected because they affect the organization's business processes. PT XYZ is engaged in managing services for the network and the cloud services. If there are operational problems, the organization cannot monitor links that are down, it will disrupt the Service Level Agreement (SLA) with user and internal business processes. Therefore, appropriate and accurate information security risk management is needed. The problem is that PT XYZ has never updated its risk management for more than three years, which is where the organization does not know if there are new risks that threaten operations. Operation risk or operational risk will be investigated because operation risk has an impact on pelanggan SLA and also organization’s business processes. There have been two incidents of attacks such as DDOS Attack and Ransomware on organizational assets some time ago. Therefore, an organization is required to have information security management to be able to control all existing risks so as not to cause harm to the organization. For the framework of information security using the objective control of ISO/IEC 27001:2013 as a reference. The purpose of this study is to provide recommendations for space proposals to develop in the organization, especially in the operation risk of PT XYZ. With the results of the evaluation of the condition of information security risk management using the ISO/IEC 27001:2013 standard, it was found that a gap analysis with information security in the organization was 83.91% or most of it was achieved. Then for recommendations for space to develop, use 10 objective controls in the form of a Statement of Applicability (SOA) and a proposed 10 selection of risk controls on risks that are still in the status of mitigation on operation risk."

"Inisiatif optimalisasi pemanfaatan Teknologi Informasi dan Komunikasi (TIK) merupakan salah satu bentuk inisiatif strategis dari Sekretariat Presiden (Setpres) yang tertuang dalam rencana strategis Setpres 2020-2024. Setpres dalam menjalankan kegiatan operasional maupun administrasi menetapkan konsep zero mistake, sehingga dalam melaksanakan pekerjaan diharuskan untuk teliti dan berhati-hati agar dapat meminimalisir munculnya risiko kesalahan dan timbulnya persepsi yang buruk terhadap kinerja Setpres. Layanan Setpres dituntut agar dapat memberikan data dan informasi yang aman dan handal dalam proses pengambilan keputusan. Namun pada kenyataannya pengelolaan aset dan risiko pada pusat data belum dikelola dengan baik dan bersifat spontanitas saja. Oleh karenanya dengan penelitian ini diharapkan pengelolaan risiko dan penanganan terkait keamanan informasi pada pusat data Setpres dapat dikelola dengan baik. Penelitian ini menggunakan metode kualitatif dimana proses pengumpulan data primer menggunakan wawancara, diskusi atau rapat dan melalui observasi serta dilengkapi dengan data sekunder. Kerangka kerja yang digunakan dalam proses manajemen risiko keamanan informasi penelitian ini adalah ISO/IEC 27005:2018 dan menggunakan panduan dari NIST SP 800-30 Rev.1 dalam proses penilaian risiko, kemudian menggunakan ISO/IEC 27002:2013 untuk memberikan rekomendasi kontrol penanganan risikonya. Penelitian ini menghasilkan 119 skenario risiko dimana 97 diantaranya perlu dimitigasi dan 22 risiko dapat diterima. Risiko yang dimitigasi 75 risiko ditangani dengan memodifikasi risiko, 22 dengan berbagi risiko, dan 22 risiko diterima. Rancangan manajemen risiko keamanan informasi pusat data Setpres ini diharapkan dapat bermanfaat bagi organisasi Setpres dalam mengelola risiko keamanan informasi pusat data maupun unit kerja lain di lingkungan Kementerian Sekretariat Negara dan juga pihak atau peneliti lain yang berkaitan dengan manajemen risiko keamanan informasi.

---

The initiative to optimize the use of Information Technology and Communication (ICT) is a form of strategic initiative of Presidential Secretariat (Setpres) which is can be found in the 2020-2024 Presidential Secretariat strategic plan. Setpres in carrying out the operational and administrative activities, Presidential Secretariat sets the concept of zero mistake, so that when doing the activities had to be thorough and careful in order to minimize the risk of errors and the emergence of a bad perception of the performance of the Presidential Secretariat. Presidential Secretariat services were required to provide be safe dan reliable data and information in the process of decision making. However, in the reality data center management of assets and risks was not managed properly, where the risk management and risk treatment were conducted spontaneously. Therefore, with this research risk management and the risk treatment related to the data center information security could be managed properly. This study uses qualitative method that the primary data collection by interviews, discussions or meetings, and observation, also uses the secondary data collection. Framework that is used by this research in the information security risk management process is ISO/IEC 27005:2018, and uses guidelines from NIST SP 800-30 Rev.1 in the risk assessment process, also completed with the ISO/IEC 27002:2013 for the recommendation for the risk controls. This study resulted 119 risk scenarios where 97 of them need to be mitigated and 22 risks are acceptable. Risks that were mitigated, 75 of the risks will be handled by modifying risks, 22 by sharing the risks, and 22 risks were acceptable. The design of data center information security risk management of the Presidential Secretariat was expected to be useful for Setpres Organization itself to manage information security risks and other works units within the Ministry of State Secretariat of the Republic of Indonesia as well as other parties or researchers related to the information security risk management."

"In this era of digital age where considerable business activities are powered by digital and telecommunication technologies, deriving customer loyalty and satisfaction through delivering high quality services, driven by complex and sophisticated Information Technology (IT) systems, is one of the main services objectives of the Bank towards its customers. From customer services perspective, "availability" is a degree of how closed the Bank is to its customers so that they can "consume" the Bank"s services easily and in preference to its competitors. "Reliability" is the degree of how adequate and responsive the Bank is in meeting its customers" needs. "Confidentiality" is the trust the customers have in the Bank in that their confidential information will not fall into the wrong hands.Information Technology is one of the means that Bank uses to achieve quality service objectives. Reliance on IT requires an understanding of the importance of IT Security within the IT environments. As business advantages are derived from the use of IT to deliver quality services, critical IT security issues related to the use of IT should be understood and addressed. Safeguarding and protecting security Information systems and assets are prominent issues that all responsible IT users must address. Information is the most valuable assets of the Bank. Adequate resources must be allocated to carry out the safeguarding of Bank"s information assets through enforcing a defined IT Security Policies, Standards and Procedures.Compliance with international and national standards designed to facilitate the Interchange of data between Banks should be considered by the Bank"s management as part of the strategy for IT Security which helps to enforce and strengthen IT security within an organization."

"[Minyak dan gas bumi (migas) merupakan sumber daya alam yang sangat strategis bagi Indonesia. Karena hingga saat ini sektor migas masih menjadi salah satu tulang punggung perekonomian nasional, sumber penerimaan dan devisa negara, bahan bakar bagi industri, mendorong investasi, penyerapan tenaga kerja, pemenuhan energi domestik dan peningkatan kemampuan sumber daya manusia serta sumber pengembangan ekonomi daerah. Oleh karena itu, pengelolaan data migas yang baik, akurat, lengkap dan aman akan membantu pemerintah dalam pengambilan keputusan dan kebijakan bidang migas. Karena keterbatasan sumber daya manusia, sarana, dan prasarana, hingga saat ini Pusdatin ESDM bekerja sama dengan pihak ketiga dalam pengelolaan data migas. Namun dalam menjalin kerja sama tersebut, Pusdatin ESDM belum memiliki tata kelola keamanan infomasi yang dibutuhkan untuk mendukung keamanan data dan informasi migas.Berdasarkan hal tersebut, jelas bahwa permasalahan di Pusdatin ESDM terkait keamanan informasi pada pengelolaan data migas adalah aspek kerahasiaan, integritas, dan ketersediaan informasi dan data migas belum didukung secara optimal. Sehingga perlu dikembangkan tata kelola keamanan informasi yang sesuai bagi Pusdatin ESDM untuk pengelolaan data migas yang dikelola pihak ketiga.Penelitian ini membahas perancangan tata kelola keamanan informasi untuk pengelolaan data migas yang dikelola oleh pihak ketiga, dengan menggunakan standar keamanan informasi ISO/IEC 27001:2005. Melalui pendekatan penilaian risiko, dipilih sasaran pengendalian dan pengendalian ISO/IEC 27001:2005 yang sesuai untuk pengelolaan data migas. Berdasarkan sasaran pengendalian dan pengendalian terpilih, dikembangkan tata kelola keamanan informasi untuk pengelolaan data migas yang dikelola oleh pihak ketiga. Dalam hal pemetaan peran dan tanggung jawab keamanan informasi, digunakan konsep RACI pada kerangka kerja OMBOK (Outsourcing Management Body of Knowledge).Hasil penelitian ini didapat rancangan tata kelola keamanan informasi yang sesuai bagi Pusdatin ESDM dalam melaksanakan pengelolaan data migas yang hingga saat ini bekerja sama dengan pihak ketiga.;Oil and gas is a natural resource that is very strategic for Indonesia. Nowadays, oil and gas sector remains one of the backbone of the national economy, source of revenue and foreign exchange, fuel for industry, encourage investment, employment, fulfillment of domestic energy and upgrading of human resources, as well as a source of regional economic development. Therefore, good, accurate, complete and safe data management will assist the government in making decisions and policies of oil and gas fields. Due to limited human resources, facilities, and infrastructure, Pusdatin ESDM (Data and Information Technology Center for Energy and Mineral Resource) cooperate with third parties in oil and gas data management. However, Pusdatin ESDM do not have any governance to make sure the security of oil and gas information.It is clear that the information security problem in Pusdatin ESDM for oil and gas data management is the low concern of data confidentiality, integrity, and availability. So it is necessary to develop information security governance suitable for Pusdatin ESDM for oil and gas data management which are managed by third parties.This study discusses the design of information security governance for oil and gas data management, managed by a third party, by using information security standards ISO/IEC 27001:2005. Through a risk assessment approach, control objectives and control of ISO/IEC 27001:2005 which related to the data management of oil and gas are selected. Based on control objectives and control selected, the information security governance for oil and gas data management that are managed by a third party, are developed and created. In the case of mapping the roles and responsibilities of information security, RACI concept of OMBOK (Outsourcing Management Body of Knowledge) framework is used.The results of this study is an information security governance design suitable for Pusdatin ESDM in implementing oil and gas data management managed by third parties., Oil and gas is a natural resource that is very strategic for Indonesia. Nowadays, oil and gas sector remains one of the backbone of the national economy, source of revenue and foreign exchange, fuel for industry, encourage investment, employment, fulfillment of domestic energy and upgrading of human resources, as well as a source of regional economic development. Therefore, good, accurate, complete and safe data management will assist the government in making decisions and policies of oil and gas fields. Due to limited human resources, facilities, and infrastructure, Pusdatin ESDM (Data and Information Technology Center for Energy and Mineral Resource) cooperate with third parties in oil and gas data management. However, Pusdatin ESDM do not have any governance to make sure the security of oil and gas information.It is clear that the information security problem in Pusdatin ESDM for oil and gas data management is the low concern of data confidentiality, integrity, and availability. So it is necessary to develop information security governance suitable for Pusdatin ESDM for oil and gas data management which are managed by third parties.This study discusses the design of information security governance for oil and gas data management, managed by a third party, by using information security standards ISO/IEC 27001:2005. Through a risk assessment approach, control objectives and control of ISO/IEC 27001:2005 which related to the data management of oil and gas are selected. Based on control objectives and control selected, the information security governance for oil and gas data management that are managed by a third party, are developed and created. In the case of mapping the roles and responsibilities of information security, RACI concept of OMBOK (Outsourcing Management Body of Knowledge) framework is used.The results of this study is an information security governance design suitable for Pusdatin ESDM in implementing oil and gas data management managed by third parties.]"

"Badan Narkotika Nasional (BNN) adalah lembaga pemerintahan yang bertugas untuk Pencegahan dan Pemberantasan Penyalah gunaan dan Peredaran Gelap Narkotika (P4GN). BNN memiliki Pusat Penelitian Data dan Informasi (Puslitdatin) yang bertanggung jawab dalam pengelolaan teknologi informasi dan komunikasi (TIK). Masalah utama yang dihadapi adalah adanya risiko serangan siber yang masuk ke BNN tinggi yang juga diperkuat dengan hasil evaluasi SPBE (Sistem Pemerintahan Berbasis Elektronik) BNN di tahun 2021 berada pada angka indeks 2,21 dari skala 5. Rendahnya indeks SPBE tahun 2021, salah satunya disebabkan karena indikator 21 (Pelaksanaan Manajemen Risiko) masih berada pada level 1. Penelitian ini bertujuan untuk menghasilkan perancangan manajemen risiko keamanan informasi yang dapat mendukung pelaksanaan SPBE pada Badan Narkotika Nasional. Penelitian ini bermanfaat untuk mengetahui identifikasi risiko dalam penilaian risiko keamanan informasi, sehingga dapat memberikan penilaian konsekuensi dan dampak risiko keamanan informasi serta dapat memberikan rekomendasi kontrol terkait pengelolaan risiko (mitigasi risiko) kepada organisasi. Penelitian ini menggunakan metode kualitatif, yang dilakukan dengan wawancara kepada tim teknis TIK di Puslitdatin BNN serta menggunakan teknik analisis tematik. Kerangka kerja manajemen risiko keamanan informasi yang digunakan dalam penelitian ini adalah International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27005:2018, ISO/IEC 27002:2022, dan National Institute of Standards and Technology Special Publication 800-30 Revision 1 (NIST SP 800-30 Rev.1). Aset adalah segala sesuatu yang memiliki nilai bagi Puslitdatin dan karenanya memerlukan perlindungan, sedangkan ancaman adalah peristiwa apa pun yang berpotensi berdampak buruk pada operasi dan aset Puslitdatin melalui perusakan, pengungkapan, atau modifikasi informasi yang tidak sah, dan penolakan atau penghentian layanan. Dari penelitian didapatkan 78 aset yang teridentifikasi berkaitan dengan kegiatan Puslitdatin BNN dan terdapat 570 skenario peristiwa ancaman dari 16 sumber ancaman. Hasil penilaian tingkat risiko menunjukan sebanyak 37 skenario perlu dimitigasi dan 533 skenario diterima oleh Puslitdatin BNN. Pada penanganan risiko keamanan informasi dihasilkan 20 jenis rekomendasi kontrol yang diantaranya yaitu membuat kebijakan keamanan informasi, penerapan kontrol hak akses, penerapan secure authentication, pengadaan genset khusus data center, penerapan manajemen screen and desk policy, dan melakukan enkripsi data/informasi penting. Hasil penelitian ini adalah rancangan dokumen manajemen risiko keamanan informasi BNN.

---

The National Narcotics Board (BNN) is a government agency tasked with the Prevention and Eradication of Narcotics Abuse and Illicit Trafficking (P4GN). BNN has a Data and Information Research Center (Puslitdatin) which is responsible for managing information and communication technology (ICT). The main problem faced is the high risk of cyber attacks entering the BNN which is also reinforced by the evaluation results of the BNN's SPBE (Electronic Based Government System) in 2021 which is at an index number of 2.21 on a scale of 5. The low SPBE index in 2021, one of them because indicator 21 (Implementation of Risk Management) is still at level 1. This study aims to produce an information security risk management design that can support the implementation of SPBE at the National Narcotics Agency. This research is useful for knowing risk identification in information security risk assessment, so that it can provide an assessment of the consequences and impacts of information security risks and can provide control recommendations related to risk management (risk mitigation) to organizations. This study used a qualitative method, which was conducted by interviewing the ICT technical team at the BNN Research and Data Center, and using thematic analysis techniques. The information security risk management framework used in this study is the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27005:2018, ISO/IEC 27002:2022, and National Institute of Standards and Technology Special Publication 800-30 Revision 1 (NIST SP 800-30 Rev.1). Assets are anything that has value to Puslitdatin and therefore requires protection, while threats are any events that have the potential to adversely affect Puslitdatin operations and assets through unauthorized destruction, disclosure or modification of information, and/or denial of service. From the research, it was found that 78 assets were identified as related to Puslitdatin BNN activities and 570 threat event scenarios from 16 threat sources. The results of the risk level assessment show that as many as 37 scenarios need to be mitigated and 533 scenarios are accepted by the BNN Research and Data Center. In handling information security risks, 20 types of control recommendations were produced, including making information security policies, implementing access rights controls, implementing secure authentication, procuring special data center generators, implementing screen and desk management policies, encrypting important data/information, and others. The result of this research is the design of BNN's information security risk management document."

"Aplikasi Bukti Potong Elektronik (e-Bupot) merupakan salah satu layanan DJP yang digunakan oleh Wajib Pajak untuk melakukan pemotongan pajak dan melaporkannya secara elektronik. Mulai tahun 2022, akan dilakukan implementasi aplikasi e-Bupot Unifikasi secara nasional untuk menggantikan aplikasi e-Bupot versi sebelumnya. Aplikasi ini mendukung proses bisnis pengelolaan SPT (Surat Pemberitahuan) dan merupakan salah satu sistem elektronik dengan tingkat kritikalitas tinggi berdasarkan Business Impact Analysis yang disusun DJP. Oleh karena itu, sangat penting bagi DJP untuk dapat menjaga keamanan informasi aplikasi e-Bupot Unifikasi dalam hal ketersediaan layanannya serta kerahasiaan dan keutuhan data dan informasi perpajakan yang diolah. Adanya insiden keamanan informasi dapat berpengaruh terhadap operasional pelayananan organisasi yang berpotensi mengakibatkan kerugian secara finansial dan penurunan reputasi. Penelitian ini dilakukan untuk menyusun rancangan manajemen risiko keamanan informasi pada aplikasi e-Bupot Unifikasi. Kerangka kerja yang digunakan dalam penelitian ini berdasarkan pada standar ISO/IEC 27005:2018. Hasil dari penelitian ini adalah rancangan manajemen risiko keamanan informasi atas aplikasi e-Bupot Unifikasi yang terdiri dari skenario risiko dan rencana penanganan risiko. Terdapat 32 skenario risiko yang diidentifikasi dengan14 skenario risiko dilakukan mitigasi dan 18 skenario risiko dapat diterima. Rekomendasi kontrol untuk penanganan risiko mengacu pada standar persyaratan keamanan informasi ISO/IEC 27001:2013 dan panduan penerapannya pada ISO/IEC 27002:2013.

---

The Electronic Withholding Tax Application (e-Bupot) is one of the DGT services used by Taxpayers to make withholding tax slip and report them electronically. Starting in 2022, the e-Bupot Unifikasi application will be implemented nationally to replace the previous version of the e-Bupot application. This application is one of the electronic systems with a high criticality level based on the Business Impact Analysis by DGT to supports the tax return processing business process. Therefore, it is very important for DGT to maintain the information security of the e-Bupot Unifikasi application in terms of the availability of its services as well as the confidentiality and integrity of the processed tax data and information. Information security incidents can have a negative impact on an organization's service operations, potentially leading to financial losses and a damage to reputation. This study was conducted to develop a design of information security risk management for the e-Bupot Unifikasi application. The framework used in this study is based on the ISO/IEC 27005:2018 standard. The result of this study is a design of information security risk management for the e-Bupot Unifikasi application, which includes risk scenarios and risk treatment plans. There are 32 risk scenarios identified with 14 risk scenarios being mitigated and 18 risk scenarios being accepted. Control recommendations for risk treatment plans refer to the information security requirements standard ISO/IEC 27001:2013 and its implementation guide ISO/IEC 27002:2013."

"Ditjen. Imigrasi sebagai pelaksana tugas dan fungsi Kementerian Hukum dan HAM RI di bidang keimigrasian telah memanfaatkan SI/TI yang mengintegrasikan seluruh fungsi keimigrasian baik di dalam maupun luar negeri, yaitu dengan Sistem Informasi Manajemen Keimigrasian (SIMKIM). Lingkup SIMKIM yang meliputi hampir seluruh aspek layanan keimigrasian menyebabkan ketersediaan layanan SIMKIM menjadi sangat penting. Tidak tersedianya layanan SIMKIM menyebabkan proses pelayanan keimigrasian menjadi tidak berjalan. Terjadinya insiden terkait keamanan informasi dalam organisasi serta maraknya kasus serangan siber di instansi pemerintah Indonesia, menuntut kepastian pengamanan SIMKIM untuk melindungi data krusial yang dimiliki. Tingginya ketergantungan Imigrasi terhadap SIMKIM dan dalam rangka menjaga kredibilitas instansi, dibutuhkan suatu perencanaan manajemen risiko keamanan informasi untuk menjamin kerahasiaan, integritas, dan ketersediaan layanan SIMKIM. Dalam menyusun perencanaan manajemen risiko keamanan informasi SIMKIM, penelitian dilakukan dengan menggunakan kerangka kerja ISO/IEC 27005:2018 sebagai kerangka kerja utama dalam proses manajemen risiko, NIST SP 800-30 Rev. 1 sebagai panduan pelaksanaan aktivitas penilaian risiko, dan NIST SP 800-53 Rev. 5 sebagai acuan penentuan rekomendasi. Dari penilaian risiko, diidentifikasi 23 skenario risiko yang perlu dimitigasi oleh organisasi dan 5 skenario risiko yang dapat dialihkan ke pihak ketiga. Penelitian ini menghasilkan dokumen rancangan manajemen risiko keamanan informasi SIMKIM.

---

The Directorate General of Immigration as the executor of the duties and functions of the Ministry of Law and Human Rights of Republic of Indonesia in the Immigration sector has utilized IS/IT that integrates all immigration functions both at inside and outside territory of Indonesia, namely the Sistem Informasi Manajemen Keimigrasian (SIMKIM). The scope of SIMKIM which covers almost all aspects of immigration services makes the availability of SIMKIM services very important. The unavailability of SIMKIM services causes the immigration service process to not work. The occurrence of incidents related to information security within the organization as well as the rise of cases of cyber attacks in Indonesian government agencies, demands the certainty of SIMKIM security to protect the crucial data held. Immigration's high dependence on SIMKIM and to maintain the credibility of the agency, an information security risk management plan is needed to ensure the confidentiality, integrity, and availability of SIMKIM services. In preparing the information security risk management plan for SIMKIM, the research uses the ISO/IEC 27005 framework as the main framework in the risk management process, NIST SP 800-30 Rev. 1 as a guide for the implementation of risk assessment activities, and NIST SP 800-53 Rev. 5 as a reference for determining recommendations. From the risk assessment, 23 risk scenarios were identified that need to be mitigated by the organization and 5 risk scenarios that can be transferred to third parties. This research produces a SIMKIM information security risk management design document.

"

"Keberadaan teknologi informasi telah memberikan berbagai kemudahan dan peluang melakukan bisnis secara online, salah satunya adalah industri Software as a Service (SaaS). PT Mitra Cerdas Nusantara (MCN) merupakan salah satu startup yang berfokus pada bisnis SaaS sebagai penyedia solusi integrated school management system bernama Ziad Smart. IT memiliki peran yang vital pada kegiatan operasional Ziad Smart. PT MCN sadar akan hal tersebut dan menerapkan zero security incident pada Ziad Smart. Namun pada kenyataannya, Ziad Smart masih mengalami insiden keamanan karena terdapat celah pada sistem yang mengakibatkan kerugian bagi PT MCN. Hal tersebut menandakan perlunya manajemen risiko keamanan informasi bagi aplikasi Ziad Smart. Tujuan dari penelitian ini adalah untuk memperoleh rancangan manajemen risiko keamanan informasi aplikasi Ziad Smart. Penelitian ini menggunakan metode kualitatif dimana pengumpulan data dilakukan melalui wawancara, observasi, dan tinjauan pustaka. SNI ISO/IEC 27005:2022 digunakan sebagai kerangka dasar perancangan manajemen risiko keamanan informasi, sementara rekomendasi perlakuan risiko menggunakan SNI ISO/IEC 27002:2022. Hasil dari penelitian ini adalah rancangan manajemen risiko keamanan informasi aplikasi Ziad Smart milik PT MCN. Penelitian ini menghasilkan 43 skenario risiko, yaitu: 10 risiko Tinggi, 21 risiko Sedang, dan 12 risiko Rendah. Penelitian ini mengusulkan 13 rekomendasi perlakuan untuk meningkatkan keamanan informasi dari aplikasi Ziad Smart.

---

Information technology presence has created several advantages and opportunities for conducting business online, one of which is the Software as a Service (SaaS) market. PT Mitra Cerdas Nusantara (MCN) is a SaaS-focused startup that provides integrated school management system solution namely Ziad Smart. Ziad Smart relies heavily on information technology for its operations. PT MCN is aware of this and has implemented a zero-security incident policy at Ziad Smart. However, Ziad Smart still experiencing security incidents because of a system flaw that causes loss for PT MCN. This highlights the necessity for information security risk management in the Ziad Smart application. The goal of this research is to provide a design for managing information security risks for the Ziad Smart application. This research employs qualitative approaches, with data collected through interviews, observations, and literature reviews. SNI ISO/IEC 27005:2022 serves as the foundation for establishing information security risk management, while risk treatment guidelines are based on SNI ISO/IEC 27002:2022. This investigation resulted in the formulation of an information security risk management strategy for PT MCN's Ziad Smart application. This study revealed 43 risk scenarios, including 10 high risks, 21 medium risks, and 12 low risks. This research presents 13 control measures to improve the information security of the Ziad Smart application."

"Peraturan Pemerintah Nomor 71 Tahun 2019 tentang Penyelenggaraan Sistem dan Transaksi Elektronik Pasal 12 merupakan peraturan yang mendasari tentang manajemen risiko dalam sistem elektronik. pada Peraturan Badan Siber dan Sandi Negara Nomor 8 Tahun 2020 tentang Sistem Pengamanan Dalam Penyelenggaraan Sistem Elektronik menyebutkan bahwa Sistem Manajemen Pengamanan Informasi (SMPI) adalah pengaturan kewajiban bagi Penyelenggara Sistem Elektronik dalam penerapan manajemen pengamanan informasi berdasarkan asas risiko. Pusat Operasi Keamanan Siber Nasional (Pusopskamsinas) merupakan unit kerja di Badan Siber dan Sandi Negara yang melaksanakan tugas memegang kendali operasi keamanan siber Indonesia. Adanya serangan siber yang semakin besar hingga tercatat pada tahun 2020 terdapat 495.337.202 anomali yang menyerang di jaringan Indonesia, hal ini dibutuhkan keandalan Pusopskamsinas dalam melaksanakan monitoring lalu lintas siber di Indonesia. Dalam penyelenggaraan operasi keamanan siber tentu terdapat kerawanan dan potensi ancaman yang memberikan dampak negatif/risiko terhadap organisasi di mana risiko tersebut dapat dilakukan mitigasi dengan menerapkan manajemen risiko keamanan informasi pada Pusopskamsinas. Salah satu Indikator Sasaran Kegiatan Pusopskamsinas yaitu “Meningkatnya Kualitas Pemonitoran Keamanan Siber atas Serangan dan Ancaman Siber”. Berdasarkan data Laporan Kinerja Pusopskamsinas tahun 2020, diketahui bahwa Pusopskamsinas belum dapat memenuhi target kinerja dari indikator kinerja sasaran dengan capaian nilai 65% dari target capaian 100%. Tidak tercapainya target kinerja dapat berpengaruh terhadap Indikator Kinerja Utama (IKU) organisasi sebagai penentu ukuran tingkat keberhasilan sasaran strategis sehingga diperlukan adanya evaluasi kinerja organisasi. Berdasarkan hasil analisis permasalahan digunakan Business Model for Information Security dari ISACA yaitu Organization, People, Technology, dan Process, salah satu instrumen dari segi organisasi yang belum tersedia adalah dokumen Perencanaan Manajemen Risiko Keamanan Informasi. Penelitian ini merupakan penelitian menggunakan metode kualitatif dengan metode penarikan kesimpulan berupa secara induktif dan merupakan klasifikasi penelitian studi kasus. Pengumpulan data dilakukan melalui observasi, studi dokumen, dan wawancara kepada pejabat, pengelola layanan / tim operasional, serta perwakilan stakeholder. Hasil dari penelitian ini berupa Perencanaan Manajemen Risiko yang sesuai dengan kondisi Pusopskamsinas sehingga dapat membantu pencapaian target kinerja serta meningkatkan pencapaian Rencana Strategis BSSN.

---

Government Regulation Number 71 of 2019 concerning Implementation of Electronic Systems and Transactions Article 12 is an underlying regulation concerning risk management in electronic systems. Regulation of the National Cyber and Crypto Agency Number 8 of 2020 concerning Security Systems in the Operation of Electronic Systems states that the Information Security Management System (ISMS) is a regulation of obligations for Electronic System Operators in implementing information security management based on risk principles. The National Cyber Security Operations Center (Pusopskamsinas) is a work unit in the National Cyber and Crypto Agency that carries out the task of controlling Indonesian cybersecurity operations. The existence of cyber-attacks is getting bigger until it was recorded that in 2020 there were 495,337,202 anomalies attacking the Indonesian network, this required the reliability of Pusopskamsinas in carrying out cyber traffic monitoring in Indonesia. In carrying out cyber security operations, of course there are vulnerabilities and potential threats that have a negative impact / risk on the organization where these risks can be mitigated by implementing information security risk management at Pusopskamsinas. One of the indicators of the Pusopskamsinas activity target is "Increasing the Quality of Cyber Security Monitoring of Cyber Attacks and Threats". Based on data from the 2020 Pusopskamsinas Performance Report, it is known that the Pusopskamsinas has not been able to meet the performance targets of the target performance indicators with a score of 65% of the 100% achievement target. The failure to achieve the performance targets can affect the main performance indicators (IKU) of the organization as a determinant of the level of success of strategic targets so that an evaluation of organizational performance is needed. Based on the results of the problem analysis, ISACA's Business Model for Information Security is used, namely Organization, People, Technology, and Process. One of the instruments in terms of organization that is not yet available is the Information Security Risk Management Planning document. This research is using qualitative methods such as inductive inference and the classification of a case study. Data collected through observation, study of documents and interviews of officials, managers of services / operations team, and stakeholder representatives. The results of this study are in the form of a Risk Management Planning in accordance with the conditions of the Pusopskamsinas so that it can help achieve performance targets and increase the achievement of the BSSN Strategic Plan."