Information Security Management: A Hierarchical Framework for Various Approaches

High-Level Self-Sustaining Information Security Management Framework

“…Therefore, in this section we will provide an overview of some relevant ISM frameworks to form a general view on existing solutions. Eloff and von Solms (2000) proposed a hierarchical framework for various approaches (Figure 1) consisting of three levels, where the top level of the hierarchical framework represents IT in its broadest sense and includes all activities and tools associated with and all approaches adopted to IT in general. This all-covering category is entitled Assessment of Information and Related Technologies.…”

“…It should be noted, that in terms of the framework, international standards, as endorsed by an international standards organization, are classified as being external standards. (Eloff and von Solms, 2000) Trček (2003) proposed an integral framework for information systems security management based on layered multi-panes ( Figure 2). The author declares that in order to protect information, an organization has to start with the identification of threats related to business assets.…”

Information security management standards: Problems and solutions

“…Different management standards exist, including TCSEC/Orange Book, GMITS, CobiT, IT Protection Manual, BS7799, GASSP, SSE-CMM, ITSEC (1990), CTCPEC, FC, CC, TNI, NCSC, EPL, TDI (see Abrams & Podell 1995, Chokhani 1992, Eloff & Solms 2000a. Some of these are more computer system-than organization oriented, such as the Common Criteria and the Orange Book, and are labelled as technical (Overbeek 1995).…”

“…To overcome this weakness, several IS security methods have been proposed (Baskerville 1993, Dhillon & Backhouse 2001, Dhillon 1997, Siponen, 2001. Of these methods, security checklists and management standards (classified as normative management-oriented security standards) are widely used (Parker 1998, Eloff & Solms 2000a, b, Solms & Haar 2000. In fact, IS security journals, including Computers & Security, Information Systems Security, Information Management & Computer Security, and information security management conference proceedings (e.g., annual IFIP TC11), are saturated with articles by security practitioners and academics paying lip service to the various existing standards; see, for example, Eloff and Solms (2000b), Ferris (1994), Ferraiolo and Sachs (1996), Fitzgerald (1995), Hardy (1995), Hopkinson (2001), Pounder (1999) and Solms (1996Solms ( , 1998Solms ( , 1999.…”

“…In fact, IS security journals, including Computers & Security, Information Systems Security, Information Management & Computer Security, and information security management conference proceedings (e.g., annual IFIP TC11), are saturated with articles by security practitioners and academics paying lip service to the various existing standards; see, for example, Eloff and Solms (2000b), Ferris (1994), Ferraiolo and Sachs (1996), Fitzgerald (1995), Hardy (1995), Hopkinson (2001), Pounder (1999) and Solms (1996Solms ( , 1998Solms ( , 1999. To boot, many even view these standards as the key issue in the business of security management (Eloff & Solms 2000a, Janczewski 2000. In the background, protests have been heard.…”