Measurement Models of Information Security Based on the Principles and Practices for Risk-Based Approach

Abstract

Elements of good practice and principles of a risk-based approach are often used in measurement models to assess the level of security of the information resource. The practical problem of measuring the level of information security is the selection of an appropriate model, followed by measures and a method that will be adequate to the specific organization. This puts in light second problem related to set a proper method of binding them together to generate consistent measure for determining the total information security level within organization. Paper presents two models proposed by authors for this use case. The proposed models can become the starting point for creating an information security evaluation system for each type of organization.