An integrated system for information security management with the unified framework. Issue 1 (2nd January 2016)

• Record Type: Journal Article
• Authors: Yang, Tsung-Han; Ku, Cheng-Yuan; Liu, Man-Nung
• Is Part Of: Journal of risk research. Volume 19:Issue 1(2016)
• Page Start: 21
• Page End: 41
• Publication Date: 2016-01-02
• Subjects: information security management -- business impact analysis -- risk analysis -- security requirement engineering -- information security policy; Technology -- Risk assessment -- Periodicals; Risk management -- Periodicals; Risk assessment -- Periodicals; 658.155
• DOI: 10.1080/13669877.2014.940593
• Languages: English
• ISSNs: 1366-9877

Abstract

Abstract : Information security management plays an essential role for drawing the roadmap of information security; thus, many theoretical methodologies and practical standards are brought into this domain. However, many standards and methodologies are too cumbersome to be adopted by an organization. Additionally, there is no unified framework to systematically handle the tedious tasks of information security management. This study's primary goal is to design an integrated system for information security management (ISISM) that aims to use current methodologies and standards to solve the above-mentioned issues. Because business impact analysis and risk analysis are the most important areas within this domain, we carefully select the related methods and then integrate them into a unified framework, upon which the proposed ISISM depends. To achieve this outcome for this study, security requirement engineering is adopted, which enables the designed system to support system users in generating risk assessment reports with related information security policies.