Study On The Information Security Management System For CCB

The banking industry informationization of our country has been developed for over twenty years, and Information Technology (IT) has become the basic platform and necessary means for the effective operating and the kernel competition capability improving of all the business banks. Meanwhile, with the increasing relying on the information technology and the quick development of new services (such as the network bank and the customized bank), information systems become more and more complicated. With the flooding of different kinds of network attack, the banking industry is facing more and more serious information security challenges.China Construction Bank (CCB) has realized the importance of the information security to its steady operating and healthy development, and some basic work in the information security management have been done (such as including the IT risk into comprehensive risk management system). But some limitations are still exist in the information security management, such as no unified planning, doing work partly and without good order, etc, and these limitations have a bad influence to the effect of the information security management work. The objective of this thesis is just to address this problem. In this thesis, a systematic, comprehensive, dynamic and coherent information security assurance system is proposed. Through the construction of such a system, the risk control capability of CCB to the urgent security events and extern security threats can be effectively improved, so that the kernel competition capability can be improved and the reaching of the CCB's strategic object can be promoted.This thesis consists five chapters. The main international and domestic information security standards are introduced in the first chapter. In the second chapter, the current information security status of the banking industry and CCB is investigated, and the common problems of the whole banking industry and the individual problems of CCB are analyzed. Then the solution for CCB which is constructing the information security management system is proposed. In the third chapter, the meaning of this security management system is explained. The designing principle is defined based on the practical factors of CCB. The five-layer architecture design is also described. The forth chapter defined the detailed construction solution of the information security management system for CCB. This chapter and the third chapter are the key parts of this thesis. Finally, in the fifth chapter, the significance, innovation and the shortage of this work are concluded, and the future development of the information security management system is previewed.The innovations of this thesis are mainly focused on two aspects. The first aspect is that, based on the investigation of the international information security practical standards and the analysis of the IT risks exist in the different layers of the CCB's overall work, a comprehensive five-layer information security management architecture is proposed, including the standards and policies layer, management platform layer, operating platform layer, technology platform layer and the file system layer. The second aspect is that, with the guidance of the five-layer architecture, the detailed construction solution is defined based on the CCB's development strategy, informationization level and current information security status. And the critical factors should be focused in the construction are proposed. The study method and content of this thesis has important theory guiding and practical referring role for the information security management of CCB and other business banks which are similar to CCB in the scale, construction, operating style and developing level aspects.