Int. J. of Business Process Integration and Management   »   2008 Vol.3, No.2

 

 

Title: Assessment of business process information security

 

Author: Pontus Johnson, Erik Johansson

 

Addresses:
Industrial Information and Control Systems, KTH – Royal Institute of Technology, Stockholm 10044, Sweden.
Industrial Information and Control Systems, KTH – Royal Institute of Technology, Stockholm 10044, Sweden

 

Abstract: Business processes are increasingly dependent on their supporting information systems. With this dependence comes an increased security risk with respect to the information flowing through the processes. This paper presents a method for assessment of the level of information security within business processes in the form of a percentage number, where a high score indicates good information security and a low score indicates a poor level of information security. The method also provides a numerical estimate of the credibility of the information security score, so that an assessment based on few and uncertain pieces of evidence is associated with low credibility and an assessment based on a large set of trustworthy evidence is associated with high credibility. A common problem with information security assessments is the cost related to collecting the required evidence. This paper proposes an evidence collection strategy designed to minimise the effort spent on gathering assessment data while maintaining the desired credibility of the results. A case study is presented, demonstrating the use of the method.

 

Keywords: information security; computer security; ISO/IEC 17799; credibility; cost of evidence; enterprise information security; business process information; trustworthiness.

 

DOI: 10.1504/IJBPIM.2008.020975

 

Int. J. of Business Process Integration and Management, 2008 Vol.3, No.2, pp.118 - 130

 

Available online: 29 Oct 2008

 

 

Editors Full text accessAccess for SubscribersPurchase this articleComment on this article