ISO/IEC 27001 bilgi güvenliği yönetim sistemi açısından türkiye' de hukuk bürolarında bilgi güvenliği yönetimi

---

Thesis Type: Postgraduate

Institution Of The Thesis: Gazi University, Bilişim Enstitüsü, Adli Bilişim, Turkey

Approval Date: 2019

Thesis Language: Turkish

Student: BERKER KILIÇ

Supervisor: NURSEL YALÇIN

Open Archive Collection: AVESIS Open Access Collection

Abstract:

In terms of information security, the fields of communication, energy, banking/finance, critical public services, transportation and water management are regarded as critical infrastructures. However, due to the fact that lawyers have a resposibility for the secrecy of personal data in the capacity of being resposible for processing of private qualified personal data and in charge of the data, today it is possible to be considered the field of law as a critical one as well. In this study, the semantic differences between Human Resources of Law Offices, the Equipment of Information Technologies and the infrastructures of Information Technologies Communication and the sub objectives of ISO/IEC 27001 Information Security Management System are determined, the adjustment levels related to ISO/IEC 27001 Information Security Management System with law offices are measured by developing a generalizable equality in range of 0-100. In the study, the self evaluation survey which is developed in paralel with the objective and sub objectives of ISO/IEC 27001 Information Security Management System is used. It is applied to 452 law offices from different cities, the obtained results are evaluated in terms of the features of Human Resources of Law Offices, the Equipment of Information Technologies and Information Technologies Communication. Two different methods are followed in the evaluation process. The semantic differences between Human Resources of the Law Office, the Equipment of Information Technologies and the feautures of Information Technologies Communication and 35 sub objectives of ISO/IEC 27001 Information Security Management System are analyzed. It is seen that the datas don't indicate a normal dispersion with Kolmogorov-Smirnov ve Shapiro-Wilk normality tests. The semantic differences are analyzed by applying Kruskal Wallis test for the feautures having sub groups more than two and Mann Whitney test for the ones having two sub groups. On the other hand, a regression analysis is performed with the 14 objectives of ISO/IEC 27001 Information Security Management System of law offices and an equality is developed for obtaining the points of Information Security Management System of law offices. By using obtained semantic differences and the points of Information Security, two models named as strengthening and supplementary model are developed for increasing the adjustments to the criteria of ISO/IEC 27001 Information Security Management System for law offices. It is seen that the adjustments of 452 participant law offices to ISO/IEC 27001 Information Security Management System are rather low by taking only 10,381 points in range of 0-100. Nevertheless, it is seen that these points can be increased by applying strengthening and supplementary model focused on the sub objectives of ISO/IEC Information Security Management System, by which the semantic differences between Human Resources of the Law Offices, the Equipment of Information Technologies and the feautures of Information Technologies Communication are detected.