Information system is an important part of any business system and business organizations can't do business without that system. It is therefore very important to provide the information system because it is often exposed to various unexpected attacks. Attackers can perform both active and passive attacks while using various attack methods such as interruptions and interceptions. The security of information systems can be undermined by malicious programs as well. Many types of malicious programs exist, such as viruses, worms and Trojan horses. Trojan horses, unlike viruses and worms, can not spread on their own. Antivirus programs have been developed to protect information systems, but often, as these programs are the only prossible protection, are not enough to protect the whole system. Protective measures have been developed for the security of information systems, such as a physical protection method that includes the protection of buildings and the environment, as well as the equipment itself and the protection methodology that includes encrypting. There are ISO standards that consist of best practices and recommendations for designing, implementation and maintaining information security management systems.