Applying heuristics to the selection and prioritisation of security assessment items in software assessment: the case of ISO/IEC 27001 the case of ISO/IEC 27001

Abstract

Security standards are essential instruments for security assessment. To create security assessment designs with suitable assessment items, we need to know the security aspects that are covered by a particular standard. We propose an approach to the selection and prioritisation of security assessment items. Assessment heuristics are proposed, aiming to increase the coverage of assessment dimensions and security characteristics in assessment designs. The main contribution of this paper to the field is the set of security assessment heuristics. Our approach can be applied to security standards in order to select or to prioritise assessment items with respect to 11 security properties and 6 assessment dimensions. The approach is flexible and allows the inclusion of security dimensions and properties. Our proposal is applied herein to a well-known security standard, ISO/IEC 27001, and its assessment items were analysed. The proposal is intended to support (i) the generation of high-coverage assessment designs, by including security assessment items with assured coverage of the main security characteristics and (ii) the evaluation of security standards with respect to the coverage of security aspects.