From risk analysis to effective security management: towards an automated approach

Abstract

Effective and risk-free operation of modern information systems relies heavily on security practices and overall information security management. Usually, organizations perform risk analysis in order to adjust their security practices and controls to an acceptable level of risk. One of the various outputs of a risk analysis is a set of recommended practices expressed in high-level statements of a natural language. In order to be applied to the real world, it is necessary to technically implement those requirements tailored to the specific organizational context. This is usually performed by experienced individuals. For this technical implementation and the configuration of the information technology facilities, several formal policy languages exist, which define access control policies, roles and responsibilities. This paper describes requirements for a software tool that could assist in the transition from high-level security requirements to a formal, well-defined policy language. Such a tool would provide valuable assistance and support in both policy implementation and overall security management.

Evaluating information security tradeoffs: Restricting access can interfere with user tasks

“…Tsoumas and Tryfonas (2004) present the case for a stronger set of automated security tools to augment current security systems and practices. They propose a semi-automated approach to, assist security professionals, design all security-related organizational inputs to a set of controls.…”

A Study of Storm Surge Risk Index System

“…Tun Lin Moe [5] proposed a set of effective natural disaster risk management framework and approach through the study of public facilities. Vassilis Tsoumas [6] suggested the natural disaster risk management should move towards automation direction. Michael K. Lindell [7] put forward the continuity model about the impact of natural disasters and the consequences.…”

Formal security policy implementations in network firewalls

“…Which security mechanisms are needed can then be planned for, and specific security controls -such as firewalls and filtering routers -can be developed and implemented [30]. Tsoumas and Tryfonas suggests a system to automate some of the development phase of the development life cycle [33]. Their system is top-down, and takes a natural language description of a policy, such as the recommendations from a risk analysis, and creates a formal model of a security policy.…”