MyMIS Chapter 3 BASIC OPERATIONS This chapter discusses fundamental operational components To implement effective Public Sector ICT Security will require strong commitment from the various level of organisations within the government. ICT security as a programme encompasses a wide spectrum of topics such as technology, people, finance, training, policy, risk management, processes and measures taken in total to safeguard the government’s information and communications systems. This chapter explains some fundamental operational components of ICT security that should be imparted to public sector employees. Major areas include information classification, roles and responsibilities, human factors, electronic facilities, document management, storage management, contingencies, incident handling and physical and environmental protection. 3.1 4 classifications of official matters–Rahsia Besar, Rahsia, Sulit and Terhad Information Classification Official matters are graded into four classifications i.e. Rahsia Besar, Rahsia, Sulit and Terhad as stipulated in the Arahan Keselamatan. Information content created digitally follow similar classification. However the protection of digital information requires different handling needs when compared to paper-based information such as encryption, colour coding, labelling, precaution against piggybacking and electronic eavesdropping e.g. tempest (Refer to Table 3.1 and Figure 3.1). Mode Conventional Digital Media Hard copy Digital Information Handling As per Arahan Keselamatan Handling protection (As per Figure 3.1) Table 3.1: Conventional vs. Digital Information Handling Classified Information Rahsia Besar Rahsia Sulit Terhad Medium ➧ Conventional Hard disk Encryption Floppy Colour Coding Labelling Encryption Screen Avoid Tempest and Piggybacking Transmission Encryption Digital Figure 3.1: Copyright MAMPU Action Handling Protection Chapter 3 - 1