An integrated conceptual model for information system security risk management supported by enterprise architecture management

Abstract

Risk management is today a major steering tool for any organisation wanting to deal with information system (IS) security. However, IS security risk management (ISSRM) remains a difficult process to establish and maintain, mainly in a context of multi-regulations with complex and inter-connected IS. We claim that a connection with enterprise architecture management (EAM) contributes to deal with these issues. A first step towards a better integration of both domains is to define an integrated EAM-ISSRM conceptual model. This paper is about the elaboration and validation of this model. To do so, we improve an existing ISSRM domain model, i.e. a conceptual model depicting the domain of ISSRM, with the concepts of EAM. The validation of the EAM-ISSRM integrated model is then performed with the help of a validation group assessing the utility and usability of the model. IntroductionIn today's networked world, information system (IS) security and risk management (RM) are required for every organisation that wishes to survive. Whether for purely compliance purposes, business development opportunities, or even governance improvement, organisations tend to implement a security strategy based on an ISSRM (IS security RM) Communicated by Professor Alexander Pretschner.

Information Systems Risk Management: Litterature Review

“…Traditional risk management methods related to information systems security are no longer adapted to the complexity of organizations and the associated risks in such a context of compliance and governance. Because of these problems, new solutions are needed to deal with security risks (Mayer N., Aubert J. 2018).…”

Method Framework for Developing Enterprise Architecture Security Principles

“…For instance, [32] notes that the EAM provides a mean to mitigate the limiting siloed thinking of traditional risk management processes as it gives a better understanding on how an asset and its value can be affect by a manifestation of a risk. Similarly, [2] argues that the EAM is a promising approach to deal with the increasing complexity of organizations, technologies and the related security threats. Most of the current efforts, however, have focused only on individual areas on the domain of EAM, such as information systems risk management (e.g.…”

“…As an example, since May 2018 the enterprises operating in Europe have been obligated to comply with the General Data Protection Regulation (GDPR); and failing to guarantee organizational security and privacy of their customers' personal data may lead to substantial fines. It has been argued that nowadays the security and privacy considerations should be embedded in all the areas of organizational activities instead of only relying on technical security mechanisms that underlying systems and software provide [1], [2].…”

Information security management framework for small and medium enterprise

“…It can be stated, that the first organizational research was based upon user's motivation model analysis and was oriented to the evaluation of organization's information security, and the other study by Pooya was adapted to the applicable review of organization's ISM tools and was more coherent to the technical management of ISM processes. Mayer (Mayer et al, 2018) supports the vision and proposes to integrate information system security risk management with enterprise architecture management.…”