From risk analysis to effective security management: towards an automated approach.

Autor: Tsoumas, Vassilis, Tryfonas, Theodore
Předmět:
Zdroj: Information Management & Computer Security; 2004, Vol. 12 Issue 1, p91-101, 11p, 2 Diagrams, 1 Chart
Abstrakt: Effective and risk-free operation of modern information systems relies heavily on security practices and overall information security management. In order to be applied to the real world, it is necessary to technically implement those requirements tailored to the specific organizational context. Experienced individuals usually perform this. For this technical implementation and the configuration of the information technology facilities, several formal policy languages exist, which define access control policies, roles and responsibilities. This paper describes requirements for a software tool that could assist in the transition from high-level security requirements to a formal, well-defined policy language. Such a tool would provide valuable assistance and support in both policy implementation and overall security management.
Databáze: Complementary Index