A model for deriving information security control attribute profiles

✍ Scribed by Helen van der Haar; Rossouw von Solms

• Publisher: Elsevier Science
• Year: 2003
• Tongue: English
• Weight: 607 KB
• Volume: 22
• Category: Article
• ISSN: 0167-4048
• DOI: 10.1016/s0167-4048(03)00311-0

✦ Synopsis

How does an organization ensure that all information security loopholes are covered? This paper describes a possible solution in terms of an Information Security Control Attribute Profile for an organization. This profile will dictate attributes that should accompany each and every information security control in an organization, thus minimizing the likelihood of malfunctioning controls.
It is up to the organization to investigate the best way of implementing information security for itself. This is usually done by the implementation of information security controls in the organization. The paper does not suggest which controls to implement, as the literature provides standardized methods for choosing from lists of controls. Rather, the paper suggests which attributes should support every control in an organization.

The organization will be able to derive a set of attributes that should accompany every information security control. The process that should be followed, in order to derive the optimal set of control attributes, is described in a model and presented in this paper. The derived set of control attributes will be called the Information Security Control Attribute

Profile for the organization.