The 4th International Conference on Information System Security (ICISS 2007) was held December 16-20, 2008 at the Jawaharlal Nehru Technological Univ- sity (JNTU) in Hyderabad, India. Although this conference is held in India, it is a decidedly international conference, attracting papers from all around the world. This year, there were 81 submissions from 18 di?erent countries. The- nal program contained papers from Australia, Austria, France, Germany, India, Poland, UK, and USA. From the 81 submissions, the Program Committee accepted 15 full papers, 4 short papers, and 2 ongoing research reports. The accepted papers span a wide rangeoftopics, includingaccesscontrol, cryptography, forensics, formalmethods and language-based security, intrusion detection, malware defense, network and Web security, operating system security, and privacy. Theconferencefeaturedfourkeynotetalks, withwrittenpapersaccompanying most of them. We would like to thank the speakers Somesh Jha, Basant Rajan, Amit Sahai, and Dawn Song for accepting our invitation to deliver keynotetalks atthis year'sconference.Theconferencewasprecededbytwo daysoftutorials. We would like to thank JNTU for hosting the conference, and EasyChair (http: //www.easychair.org/) for providing conference management services to handle the paper review and selection process. Lastly, we wish to express our deepest thanks to the members of the Program Committee who give their p- sonal free time to perform the often thankless job of reviewing many papers under extremely short deadlines, and to the external reviewers, volunteers and local assistants who made this program a succes