Security modelling for organisations

ABSTRACT

Information security officers of large organisations have the responsibility, inter alia, to advise senior management on the current level of organisational risk and to overview the operation of effective security systems within the organisation.Current developments in risk analysis methodologies and system security certification, e.g. ITSEC, can provide security officers with information on the current level of organisational risk and the effectiveness of security systems. However these activities are commonly undertaken as large one-off projects. Hence they do not provide the methodologies or tools that allow security officers to respond to the often ad hoc demands made upon them.This paper deals with the development of a security model for use by information security officers, either as a method of monitoring the implementation of internal security policy, or as a preparatory step before seeking certification. The model comprises three main groups of security information: information system environment, information systems and information system assets. The model serves to indicate the current state of security in the organisation. A threat to the system environment can be traced through to its potential organisational impact, taking into account the current defences in the information processing systems.The two major areas of research in the project lie in the estimation of security effectiveness from threat countermeasure diagrams, and the means of inferring business impacts from the interrelationships amongst information processing assets.Current work is directed to the implementation of the model in a hypertext and an object oriented paradigm.

REFERENCES

• ANDE91: Aderson AM, "Comparing Risk Analysis Methodologies", in Lindsay DT and Price WL (eds.), Information Security, Elsevier 1991.
• CAEL92: William J. Caelli , Dennis Longley , Alan B. Tickle, A Methodology for Describing Information and Physical Security Architectures, Proceedings of the IFIP TC11, Eigth International Conference on Information Security: IT Security: The Need for International Cooperation, p.277-296, May 27-29, 1992
• FIPS74: Guidelines for ADP Physical Security and Risk Management, NBS, Washington, 1974.
• ITSE92: Information Technology Security Evaluation Manual (ITSEM) Draft Vol.2, Commission of the European Communities, Brussels 1992.
• KATZ88: Katzke, S, "A Government Perspective on Risk Management of Automated Information Systems", Proc. 1988 Computer Security Risk Management Model Builders' Workshop, NBS, Gaithersburg MD, USA, 1988.
• POTT93: D. Pottas , Sebastiaan H. von Solms, Superseding Manual Generation of Access Control Specification - From Policies to Profiles, Proceedings of the IFIP TC11, Ninth International Conference on Information Security: Computer Security, p.327-342, May 12-14, 1993
• KWOK94: Kwok LF, Longley D, "A Security Officer's Workbench" Proceedings IFIP Sec94, Curacao, 1994.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS

General Terms:
Management, Security, Theory