BAB 08 - KEAMANAN INFORMASI

Definisi

Ruang Lingkup Keamanan Informasi

Keamanan informasi BUKAN hanya tentang teknologi. Ia mencakup tiga dimensi yang saling terkait:

1. Dimensi Organisasional

• Kebijakan, prosedur, standar keamanan
• Tata kelola (governance) dan manajemen risiko
• Kepatuhan terhadap regulasi (UU PDP, GDPR, dll)
• Awareness training untuk karyawan
• Struktur organisasi keamanan (CISO, SOC, dll)

2. Dimensi Fisik

• Kontrol akses fisik ke data center
• CCTV, biometrik, security guard
• Proteksi dari bencana alam (gempa, banjir)
• Environmental control (suhu, kelembaban)
• Proteksi dari pencurian perangkat

3. Dimensi Teknis

• Firewall, IDS/IPS, WAF
• Enkripsi, hashing, digital signature
• Access control, authentication
• Backup, disaster recovery
• Monitoring, logging, SIEM

Information Security vs Cyber Security

Sejarah Singkat

CIA Triad (Confidentiality, Integrity, Availability) adalah tiga pilar fundamental keamanan informasi. Setiap kontrol keamanan yang Anda temui di dunia profesional, pada akhirnya bertujuan melindungi salah satu atau beberapa aspek dari CIA Triad.

1. Confidentiality (Kerahasiaan)

Contoh Penerapan:

• Enkripsi: AES, RSA, TLS - data tidak bisa dibaca tanpa kunci
• Access Control: password, biometrik, MFA
• Data Classification: label "Confidential", "Restricted"
• Physical Security: brankas, ruang server terkunci
• Network Security: firewall, VPN, VLAN

Ancaman terhadap Confidentiality:

• Pencurian data (data breach)
• Sniffing jaringan (packet capture)
• Social engineering (phishing)
• Insider threat (karyawan bocorkan data)
• Physical theft (laptop dicuri)

2. Integrity (Keutuhan)

Contoh Penerapan:

• Hash Function: SHA-256, MD5 - deteksi perubahan data
• Digital Signature: RSA, ECDSA - verifikasi keaslian
• Version Control: Git - track perubahan dokumen
• Checksum: CRC, parity bit - deteksi error
• Write Protection: read-only file, immutable storage

Ancaman terhadap Integrity:

• Malware yang mengubah file
• Man-in-the-Middle (MITM) attack
• Unauthorized modification oleh insider
• Transmission error (corruption)
• Ransomware (mengenkripsi = mengubah)

3. Availability (Ketersediaan)

Contoh Penerapan:

• Redundancy: RAID, cluster, failover
• Backup & Recovery: backup rutin, disaster recovery plan
• DDoS Protection: CDN, rate limiting, WAF
• Maintenance: patch management, monitoring
• Physical Protection: UPS, generator, AC

Ancaman terhadap Availability:

• DDoS attack
• Ransomware (mengenkripsi data)
• Hardware failure
• Power outage
• Disaster alam (gempa, banjir)
• Sabotase oleh insider

Trade-off dalam CIA Triad

Dalam praktiknya, sering ada trade-off antara ketiga aspek:

Jika CIA Triad adalah apa yang ingin kita lindungi, maka DAD Triad (Disclosure, Alteration, Destruction) adalah apa yang ingin kita cegah. DAD adalah kebalikan dari CIA - ancaman terhadap ketiga pilar keamanan informasi.

1. Disclosure (Pengungkapan)

Contoh Disclosure:

2. Alteration (Perubahan)

Contoh Alteration:

3. Destruction (Penghancuran)

Contoh Destruction:

Hubungan CIA dan DAD

Kontrol Keamanan untuk Mencegah DAD

Selain CIA Triad, ada konsep penting lain dalam keamanan informasi: AAA (Authentication, Authorization, Accounting) dan Non-Repudiation. Konsep-konsep ini melengkapi CIA dengan fokus pada kontrol akses dan akuntabilitas.

1. Authentication (Autentikasi)

Tiga Faktor Autentikasi:

Multi-Factor Authentication (MFA):

• 2FA: 2 faktor berbeda (password + OTP)
• MFA: 2+ faktor berbeda
• Contoh: Login bank = password + SMS OTP + face ID

2. Authorization (Otorisasi)

Model Authorization:

3. Accounting (Akunting)

Contoh Accounting:

• Log file: /var/log/auth.log, Windows Event Log
• Audit trail: record semua akses ke data sensitif
• SIEM (Security Information and Event Management)
• Usage tracking: bandwidth, storage, API calls
• Billing: chargeback untuk resource usage

Bash - Accounting dengan Log
# Lihat log autentikasi di Linux
$ sudo cat /var/log/auth.log | tail -20

# Lihat siapa yang login sekarang
$ who
rozak    pts/0        2026-09-09 14:32 (192.168.1.100)

# Lihat history login
$ last -10
rozak    pts/0        192.168.1.100    Tue Sep  9 14:32
admin    pts/1        10.0.0.50        Tue Sep  9 13:15

# Audit akses file sensitif
$ sudo auditctl -w /etc/shadow -p wa -k shadow_access
$ sudo ausearch -k shadow_access

# Windows Event Log
C:\> wevtutil qe Security /c:10 /rd:true /f:text

4. Non-Repudiation (Non-Penyangkalan)

Cara Mencapai Non-Repudiation:

• Digital Signature: tanda tangan digital dengan private key
• Certificate Authority: sertifikat digital dari CA terpercaya
• Audit Log: log yang tidak bisa diubah (immutable)
• Timestamp: waktu transaksi yang terverifikasi
• Video Surveillance: rekaman CCTV

Contoh Penerapan:

Hubungan AAA + Non-Repudiation dengan CIA

Keamanan informasi yang efektif membutuhkan keseimbangan antara tiga elemen: People, Process, dan Technology. Ketiganya harus bekerja bersama - jika salah satu lemah, seluruh sistem keamanan rapuh.

1. People (Manusia)

Aspek People:

• Security Awareness: pelatihan berkala untuk karyawan
• Background Check: verifikasi latar belakang karyawan
• Security Culture: membangun budaya keamanan di organisasi
• Insider Threat Management: deteksi ancaman dari dalam
• Roles & Responsibilities: definisi tanggung jawab keamanan

Mengapa People Penting?

2. Process (Prosedur)

Contoh Process:

• Information Security Policy: kebijakan utama keamanan
• Access Control Policy: prosedur kontrol akses
• Incident Response Plan: prosedur penanganan insiden
• Change Management: prosedur perubahan sistem
• Risk Assessment: prosedur penilaian risiko
• Business Continuity Plan: rencana kelangsungan bisnis

3. Technology (Teknologi)

Contoh Technology:

• Firewall, IDS/IPS: proteksi jaringan
• Encryption: proteksi data
• SIEM: monitoring dan analisis log
• Endpoint Protection: antivirus, EDR
• Backup Solutions: proteksi data
• Identity Management: IAM, PAM

Keseimbangan PPT

Klasifikasi informasi adalah proses mengkategorikan informasi berdasarkan tingkat sensitivitas dan dampak jika informasi tersebut bocor, diubah, atau tidak tersedia. Klasifikasi adalah fondasi dari kontrol keamanan yang tepat.

Standar Klasifikasi (4 Level)

Klasifikasi Berdasarkan Dampak

Menurut FIPS 199 (NIST), klasifikasi berdasarkan dampak terhadap CIA:

Labeling & Marking

Setiap informasi harus dilabeli sesuai klasifikasinya:

• Dokumen: header/footer dengan label klasifikasi
• Email: subject line dengan label
• File: metadata atau watermark
• Physical: stiker warna pada folder/brankas

Contoh Label Klasifikasi
# Dokumen Restricted
[RESTRICTED]
LAPORAN KEUANGAN Q3 2026
PT ABCD Tbk

# Email Confidential
Subject: [CONFIDENTIAL] Data Nasabah - Migration Plan

# File Internal
Filename: SOP_Keamanan_v2.1_INTERNAL.docx

# Physical Label
Folder merah: RESTRICTED
Folder kuning: CONFIDENTIAL
Folder biru: INTERNAL
Folder hijau: PUBLIC

Handling Berdasarkan Klasifikasi

Praktik: Klasifikasi dengan Python

Python - Information Classification
class InformationClassifier:
    """Klasifikasi informasi berdasarkan sensitivitas."""
    
    LEVELS = {
        'RESTRICTED': {
            'level': 4,
            'color': 'red',
            'encryption': 'AES-256',
            'access': 'need-to-know + MFA'
        },
        'CONFIDENTIAL': {
            'level': 3,
            'color': 'orange',
            'encryption': 'AES-128',
            'access': 'need-to-know'
        },
        'INTERNAL': {
            'level': 2,
            'color': 'blue',
            'encryption': 'none',
            'access': 'employees'
        },
        'PUBLIC': {
            'level': 1,
            'color': 'green',
            'encryption': 'none',
            'access': 'anyone'
        }
    }
    
    def classify(self, data_type, sensitivity):
        """Klasifikasi berdasarkan tipe dan sensitivitas data."""
        if sensitivity >= 9:
            return 'RESTRICTED'
        elif sensitivity >= 7:
            return 'CONFIDENTIAL'
        elif sensitivity >= 4:
            return 'INTERNAL'
        else:
            return 'PUBLIC'
    
    def get_handling(self, classification):
        """Dapatkan prosedur handling berdasarkan klasifikasi."""
        return self.LEVELS[classification]

# Contoh penggunaan
classifier = InformationClassifier()

# Klasifikasi data
data_types = [
    ("Password admin", 10),
    ("Data nasabah", 8),
    ("SOP internal", 5),
    ("Website publik", 2)
]

for data, sensitivity in data_types:
    classification = classifier.classify(data, sensitivity)
    handling = classifier.get_handling(classification)
    print(f"{data}: {classification}")
    print(f"  - Encryption: {handling['encryption']}")
    print(f"  - Access: {handling['access']}\n")

# Output:
# Password admin: RESTRICTED
#   - Encryption: AES-256
#   - Access: need-to-know + MFA
#
# Data nasabah: CONFIDENTIAL
#   - Encryption: AES-128
#   - Access: need-to-know
# ...

Manajemen risiko adalah proses inti dalam keamanan informasi. Tanpa memahami risiko, kita tidak bisa menentukan kontrol keamanan yang tepat atau mengalokasikan resources secara efektif.

Definisi Risiko

Rumus Risiko

Risk Formula
RISK = THREAT × VULNERABILITY × ASSET VALUE

# Atau versi lebih detail:
RISK = LIKELIHOOD × IMPACT

# Dimana:
# LIKELIHOOD = kemungkinan threat mengeksploitasi vulnerability
# IMPACT = dampak jika insiden terjadi

Tahapan Risk Assessment

1. Asset Identification: identifikasi semua aset informasi
2. Threat Identification: identifikasi threat yang mungkin
3. Vulnerability Identification: identifikasi vulnerability
4. Likelihood Assessment: nilai kemungkinan terjadinya
5. Impact Assessment: nilai dampak jika terjadi
6. Risk Calculation: hitung risiko (Likelihood × Impact)
7. Risk Treatment: tentukan cara menangani risiko

Risk Treatment Options

Risk Matrix

Praktik: Risk Assessment Calculator

Python - Risk Assessment Calculator
class RiskAssessor:
    """Kalkulator risiko keamanan informasi."""
    
    def __init__(self):
        self.risks = []
    
    def assess_risk(self, asset, threat, vulnerability, 
                      likelihood, impact):
        """Hitung risiko."""
        risk_score = likelihood * impact
        
        # Klasifikasi risiko
        if risk_score >= 16:
            level = "CRITICAL"
        elif risk_score >= 9:
            level = "HIGH"
        elif risk_score >= 4:
            level = "MEDIUM"
        else:
            level = "LOW"
        
        risk = {
            'asset': asset,
            'threat': threat,
            'vulnerability': vulnerability,
            'likelihood': likelihood,  # 1-5
            'impact': impact,          # 1-5
            'score': risk_score,
            'level': level
        }
        
        self.risks.append(risk)
        return risk
    
    def get_priority(self):
        """Dapatkan risiko prioritas (highest first)."""
        return sorted(self.risks, key=lambda x: x['score'], reverse=True)

# Contoh penggunaan
assessor = RiskAssessor()

# Assess risiko
risks = [
    ("Database nasabah", "SQL Injection", "Input tidak divalidasi", 4, 5),
    ("Server web", "DDoS", "Tidak ada rate limiting", 3, 4),
    ("Email karyawan", "Phishing", "Tidak ada training", 5, 3),
    ("Laptop karyawan", "Pencurian", "Tidak ada enkripsi", 2, 3)
]

for asset, threat, vuln, likelihood, impact in risks:
    risk = assessor.assess_risk(asset, threat, vuln, likelihood, impact)
    print(f"{asset}:")
    print(f"  Threat: {threat}")
    print(f"  Vulnerability: {vuln}")
    print(f"  Risk Score: {risk['score']} ({risk['level']})\n")

# Output:
# Database nasabah:
#   Threat: SQL Injection
#   Vulnerability: Input tidak divalidasi
#   Risk Score: 20 (CRITICAL)
#
# Email karyawan:
#   Threat: Phishing
#   Vulnerability: Tidak ada training
#   Risk Score: 15 (HIGH)
# ...

# Prioritas risiko
print("=== PRIORITAS RISIKO ===")
for i, risk in enumerate(assessor.get_priority(), 1):
    print(f"{i}. {risk['asset']} - {risk['level']} ({risk['score']})")

Risk Register Template

Risk Register Template
# ============================================
# RISK REGISTER - PT ABCD Tbk
# Tanggal: 2026-09-09
# ============================================

Risk ID: RISK-2026-001
Asset: Database nasabah
Threat: SQL Injection attack
Vulnerability: Input validation lemah
Likelihood: 4 (High)
Impact: 5 (Critical)
Risk Score: 20
Risk Level: CRITICAL

Treatment:
  - [ ] Implement parameterized queries
  - [ ] Deploy WAF (Web Application Firewall)
  - [ ] Conduct code review
  - [ ] Security testing (pentest)

Owner: CTO
Target Date: 2026-10-15
Status: In Progress

# ============================================

Risk ID: RISK-2026-002
Asset: Email karyawan
Threat: Phishing attack
Vulnerability: Kurang awareness
Likelihood: 5 (Very High)
Impact: 3 (Medium)
Risk Score: 15
Risk Level: HIGH

Treatment:
  - [ ] Security awareness training
  - [ ] Phishing simulation
  - [ ] Email filtering
  - [ ] MFA enforcement

Owner: CISO
Target Date: 2026-11-30
Status: Planned

Informasi penting (critical information) adalah aset informasi yang paling bernilai bagi organisasi dan memerlukan proteksi tertinggi. Mengidentifikasi informasi penting adalah langkah pertama dalam manajemen risiko dan klasifikasi.

Karakteristik Informasi Penting

Contoh Informasi Penting

Cara Mengidentifikasi Informasi Penting

1. Business Impact Analysis (BIA): analisis dampak jika informasi tidak tersedia
2. Stakeholder Interview: tanya manajemen dan user
3. Regulatory Requirements: cek regulasi yang berlaku
4. Data Flow Analysis: telusuri aliran data di organisasi
5. Asset Inventory: inventarisasi semua aset informasi

Praktik: Critical Information Identification

Python - Critical Information Identifier
class CriticalInfoIdentifier:
    """Identifikasi informasi penting berdasarkan kriteria."""
    
    CRITERIA = {
        'financial_impact': "Kerugian finansial jika bocor/hilang",
        'regulatory': "Diwajibkan oleh regulasi",
        'business_critical': "Operasi bisnis bergantung padanya",
        'reputation': "Dampak reputasi jika bocor",
        'competitive': "Keunggulan kompetitif",
        'irreplaceable': "Tidak bisa diganti/direplikasi"
    }
    
    def __init__(self):
        self.critical_info = []
    
    def assess(self, info_name, criteria_met):
        """Assess apakah informasi penting."""
        score = len(criteria_met)
        
        if score >= 4:
            priority = "CRITICAL"
        elif score >= 2:
            priority = "HIGH"
        else:
            priority = "MEDIUM"
        
        info = {
            'name': info_name,
            'criteria_met': criteria_met,
            'score': score,
            'priority': priority
        }
        
        self.critical_info.append(info)
        return info
    
    def get_report(self):
        """Generate laporan informasi penting."""
        return sorted(self.critical_info, key=lambda x: x['score'], reverse=True)

# Contoh penggunaan
identifier = CriticalInfoIdentifier()

# Assess informasi
informations = [
    ("Database password", ['financial_impact', 'business_critical', 'irreplaceable', 'reputation']),
    ("Data nasabah", ['regulatory', 'financial_impact', 'reputation', 'business_critical']),
    ("Source code", ['competitive', 'irreplaceable', 'business_critical']),
    ("SOP internal", ['business_critical']),
    ("Website publik", [])
]

for info_name, criteria in informations:
    result = identifier.assess(info_name, criteria)
    print(f"{info_name}:")
    print(f"  Criteria met: {', '.join(criteria)}")
    print(f"  Score: {result['score']}/6")
    print(f"  Priority: {result['priority']}\n")

# Output:
# Database password:
#   Criteria met: financial_impact, business_critical, irreplaceable, reputation
#   Score: 4/6
#   Priority: CRITICAL
#
# Data nasabah:
#   Criteria met: regulatory, financial_impact, reputation, business_critical
#   Score: 4/6
#   Priority: CRITICAL
# ...

# Laporan
print("=== LAPORAN INFORMASI PENTING ===")
for i, info in enumerate(identifier.get_report(), 1):
    print(f"{i}. {info['name']} - {info['priority']} ({info['score']}/6)")

Proteksi Informasi Penting

Critical Information Register

Critical Information Register Template
# ============================================
# CRITICAL INFORMATION REGISTER
# PT ABCD Tbk
# Tanggal: 2026-09-09
# ============================================

ID: CI-001
Name: Database password (Production)
Owner: CTO
Classification: RESTRICTED
Priority: CRITICAL
Location: Password vault (CyberArk)
Access: 3 orang (CTO, Lead DevOps, Security Manager)
Protection:
  - [x] AES-256 encryption
  - [x] MFA required
  - [x] Audit logging
  - [x] Quarterly access review
  - [x] Rotation every 90 days

Backup: Encrypted backup di 2 lokasi berbeda
Recovery: RTO: 1 jam, RPO: 0 (zero data loss)

# ============================================

ID: CI-002
Name: Database nasabah
Owner: Head of Data
Classification: CONFIDENTIAL
Priority: CRITICAL
Location: PostgreSQL cluster (encrypted)
Access: Database team + authorized applications
Protection:
  - [x] AES-256 encryption at rest
  - [x] TLS 1.3 in transit
  - [x] Role-based access control
  - [x] Audit logging
  - [x] Daily backup
  - [x] DLP (Data Loss Prevention)

Regulatory: UU PDP, POJK, GDPR (untuk EU customers)
Backup: Daily encrypted backup, 30 days retention
Recovery: RTO: 4 jam, RPO: 24 jam

Uji pemahaman Anda tentang Bab 08! Target minimal: 70% untuk melanjutkan ke Bab 09.