Information Security Evaluation Research Articles

A Possibility Theory Framework for Security Evaluation in National Infrastructure Protection

Simple probability theory is not a good basis for security in the case of high-stakes information resources where these resources are subject to attacks upon national infrastructure or to battle space illumination. Probability theory induces us to believe that one cannot totally rule out all probabilities of an intrusion. An alternative theoretical base is possibility theory. While persistent, well-supported, and highly professional intrusion attacks will have a higher probability of success, operating instead against the possibility of intrusion places defenders in a theoretical framework more suitable for high-stakes protection. The purpose of this paper is to introduce an alternative quantitative approach to information security evaluation that is suitable for information resources that are potential targets of intensive professional attacks. This approach operates from the recognition that information resource security is only an opinion of officials responsible for security.

The evaluation and certification of information security against BS 7799

Electronic commerce has become a reality, but unfortunately it is held back by the lack of information security associated with it. Business partners will have to prove to each other that they are adequately secured, before electronic commerce will really blossom. This can best be done through a scheme whereby information security can be evaluated and certified. To enable this, some international or generally accepted information security standard needs to act as a memorandum against which evaluation can be conducted. The British Standard, BS 7799, can fulfill this role as it is becoming very well known internationally. This paper proposes a scheme whereby information security, within an organization, can be evaluated against BS 7799 and certification can take place, if successful. This scheme will provide the mutual trust between business partners, as far as information security is concerned, that is required in electronic commerce.

A framework for information security evaluation

Information Security Management consists of various facets, such as Information Security Policy, Risk Analysis, Risk Management, Contingency Planning and Disaster Recovery; these are all interrelated in some way, often causing uncertainty and confusion among top management. This paper proposes a model for Information Security Management, called an Information Security Management Model (ISM 2), which puts all the various facets in context. The model consists of five different levels, defined on a security axis. ISM 2 introduces the idea of international security criteria or international security standards. The rationale behind these is to enable information security evaluation according to internationally accepted criteria. Due to the lack of internationally recognized and/or accepted information security standards and criteria, this model cannot be implemented in its totality at this time. A restricted form is implemented, forming an information security evaluation tool. This tool can be used for information security management with great success within an organization.

A Tool for Information Security Management

Top management is responsible for the wellbeing of the organization. Most organizations nowadays are dependent totally on the availability and effectiveness of their information service resources. For this reason it is imperative that top management gets involved and stays involved in the protection of the information service assets of the organization. This can only be accomplished through a process of continuous information security evaluation and reporting. An information security evaluation and reporting tool, representing the information security status in a concise, clear manner, will help a great deal in ensuring top management involvement. Suggests implementation of an information security management model by means of an evaluation tool. This tool will provide top management with information security status reporting in a clear, non‐technical format.

The information security evaluation criteria conference in Brussels

The information security evaluation criteria conference in Brussels

Unique approach to security evaluation

Abstract The growth of on-line, real-time and distributed systems increases accessibility and vulnerability of company data and systems to the public and company users. A frequent concern is the security of a specific asset. The focus of this article is a methodology for evaluating the security of specific company assets. The Information and Systems Security Evaluation Methodology (ISSEM) was established to meet the need for a rigorous and thorough methodology in this area. The documentation produced serves as a basis for evaluating continuing changes to the control procedures as business conditions and related risks change. ISSEM has proved to be a meaningful tool to aid in monitoring and evaluating security on a continuing basis.

Unique approach to security evaluation

The growth of on-line, real-time and distributed systems increases accessibility and vulnerability of company data and systems to the public and company users. A frequent concern is the security of a specific asset. The focus of this article is a methodology for evaluating the security of specific company assets. The Information and Systems Security Evaluation Methodology (ISSEM) was established to meet the need for a rigorous and thorough methodology in this area. The documentation produced serves as a basis for evaluating continuing changes to the control procedures as business conditions and related risks change. ISSEM has proved to be a meaningful tool to aid in monitoring and evaluating security on a continuing basis.