A Conceptual Framework for Threat Assessment Based on Organization’s Information Security Policy

Abstract

The security breaches of sensitive information have remained difficult to solve due to increased malware programs and unauthorized access to data stored in critical assets. As risk appetite differ from one organization to another, it prompts the threat analysis tools be integrated with organization's information security policy so as to ensure security controls at local settings. However, it has been noted that the current tools for threat assessment processes have not encompassed information security policy for effective security management (i.e. confidentiality, integrity and availability) based on organization's risk appetite and culture. The information security policy serves as a tool to provide guidance on how to manage and secure all business operations including critical assets, infrastructure and people in the organization. This guidance (e.g. usage and controls) facilitates the provisions for threat assessment and compliance based on local context. The lack of effective threat assessment frameworks at local context have promoted the exposure of critical assets such as database servers, mails servers, web servers and user smart-devices at the hand of attackers and thus increase risks and probability to compromise the assets. In this paper we have proposed a conceptual framework for security threat assessment based on organization's information security policy. Furthermore, the study proposed the policy automation canvas for provision of a methodology to alert the security managers what possible threats found in their organizations for quick security mitigation without depending on security expertise.

On Development of Platform for Organization Security Threat Analytics and Management (POSTAM) Using Rule-Based Approach

“…However, the controls defined by the organisation's information security policy were used in order to maintain their existing policy structure. After this technical alignment, the data collected [2] during assessment of security awareness and maturity levels were used as pilot data for testing the experimental prototype while on development stage.…”

“…The generated radar and line graphs for assessing inside threats and security awareness and maturity level in public organization have provided practical approach for improving the internal security strategies for preserving confidentiality, integrity and availability as core services in security management. During prototype testing, we selected one organization from five organizations U, V, W, Y and Z which participated in the previous study [2]. The graphs generated for visual demonstration have provided evidence that, the policies can be automated to support security management based on pre-defined set of rules.…”

“…Despite the user being a weak link, the advancement in computer technology also produces a huge number of data i.e. information overload compared to the organisational ability to manipulate in order to extract potential useful information for informed decision-making [2] [3] [4]. According to Mbowe et al (2014), the security awareness and maturity level for selected organisations in Tanzania are not satisfactory in many aspects.…”

“…information overload compared to the organisational ability to manipulate in order to extract potential useful information for informed decision-making [2] [3] [4]. According to Mbowe et al (2014), the security awareness and maturity level for selected organisations in Tanzania are not satisfactory in many aspects. For example, about 92.1% responses of respondents indicated that their organisations had no effective strategies for managing their ICT assets in regard to security breaches and only 41.2% responses of respondents were aware of the existing security awareness programs in their organizations.…”

A Generic Framework for Information Security Policy Development

“…The results from cross-case analysis also indicate that risk assessment was the key element that could determine the comprehension of the security policy's contents. Currently, there are various tools available for security threat assessment such as Common Criteria, OCTAVE, CORAS and CySeMoL [52]. However, even though there are numerous tools and techniques that can facilitate the identification and analysis of risks, it is recommended that a multidisciplinary workshop discussion be included in the threat analysis [18].…”