This paper presents the theoretical issues of data security in information systems, a practical implementation of the Clark-Wilson model on the example of Business Intelligence tool, performing the function of a telecommunications operator sales module, and an evaluation of the increase of security of the system created, using risk analysis.
Introduction
Each day companies accumulate significant volumes of data related to their activities. Efficient processing in compliance with all safety rules may be the key factor in maximizing a company’s value, achieving higher profits, improving competitiveness and meeting the formal requirements imposed by law. In order to cope with these challenges, companies have to invest in complex systems that support them in these activities. One of the solutions are systems based on data warehousing integrated with advanced analysis and reporting Business Intelligence tools, in which one of the paramount issues is the security of the processed data. In general, the information security can be defined as its protection against accidental or deliberate destruction, disclosure or modification [3]. According to this definition, there are three main components of data security: confidentiality, integrity and availability, commonly known as the CIA triad [4]. Confidentiality means that only authorized persons have access to information, data integrity ensures that data is accurate and complete, and availability is responsible for access to resources in compliance with the user’s needs. Further very important aspects in data security are threats and vulnerabilities. The security of a system can be compromised when a threat exploits a vulnerability. Generally, we do not have influence on threats. However, it is possible to eliminate or reduce the vulnerabilities which can be exploited by threats. Ross Anderson, a specialist in the field of security, says that security engineering requires interdisciplinary knowledge in fields such as cryptography and computer security, through resistance to encroachment in equipment and formal methods, to knowledge in the field of applied psychology, methods of organization, audit and law [5].
