Ontology-based information security compliance determination and control selection on the example of ISO 27002
| Autor: | Stefan Fenz, Thomas Neubauer |
|---|---|
| Rok vydání: | 2018 |
| Předmět: |
Decision support system
Information Systems and Management Computer Networks and Communications business.industry Computer science 020206 networking & telecommunications 02 engineering and technology Information security Design science Ontology (information science) Security controls Management Information Systems Risk analysis (engineering) Information security standards Management of Technology and Innovation Information technology management 0202 electrical engineering electronic engineering information engineering 020201 artificial intelligence & image processing business Software Risk management Information Systems |
| Zdroj: | Information & Computer Security. 26:551-567 |
| ISSN: | 2056-4961 |
| DOI: | 10.1108/ics-02-2018-0020 |
| Popis: | PurposeThe purpose of this paper is to provide a method to formalize information security control descriptions and a decision support system increasing the automation level and, therefore, the cost efficiency of the information security compliance checking process. The authors advanced the state-of-the-art by developing and applying the method to ISO 27002 information security controls and by developing a semantic decision support system.Design/methodology/approachThe research has been conducted under design science principles. The formalized information security controls were used in a compliance/risk management decision support system which has been evaluated with experts and end-users in real-world environments.FindingsThere are different ways of obtaining compliance to information security standards. For example, by implementing countermeasures of different quality depending on the protection needs of the organization. The authors developed decision support mechanisms which use the formal control descriptions as input to support the decision-maker at identifying the most appropriate countermeasure strategy based on cost and risk reduction potential.Originality/valueFormalizing and mapping the ISO 27002 controls to the security ontology enabled the authors to automatically determine the compliance status and organization-wide risk-level based on the formal control descriptions and the modelled environment, including organizational structures, IT infrastructure, available countermeasures, etc. Furthermore, it allowed them to automatically determine which countermeasures are missing to ensure compliance and to decrease the risk to an acceptable level. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|