Establish a Dynamic Business Driven Integrative Information Security Architecture

Abstract:

With Respect to the challenges most organizations are facing when considering information security management, especially how to demonstrate the value of security to senior leadership and how to meet all kinds of legislations in one place, this article describes a dynamic business driven integrative information security architecture to address those problems. By designing the architecture through three levels which are domain level, component level, and control level, the architecture is target to establish alignment and traceability between business and security, build customer service concept within security practices, establish a dynamic and integrative framework, and manager information security in a more predictive and proactive manner. By applying this architecture into a real life business case, the fact shows that after the implementation, the major security indicators have been visibly improved.

• Periodical: Applied Mechanics and Materials (Volumes 513-517)
• Pages: 1309-1315
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.513-517.1309
• Online since: February 2014
• Authors: Chang Long Tang*
• Keywords: Alignment, Business Value, Information Security Architecture, Integrative Framework, Ligislation Requirements, Traceability

References

[1] Humphreys, Edward (2010), Information Security Risk Management –Handbook for ISO/IEC 27001, Pub. BSI British Standards Institution.

DOI: 10.3403/9780580607455

[2] Humphreys, Edward (2011), Information Security Management System Standards, DuD Datenschutz und Datensicherheit.

DOI: 10.1007/s11623-011-0004-3

[3] Humphreys, Edward and Plate Angelika (2008), Pub. BSI British Standards Institution.

[4] Humphreys, Edward and Plate Angelika (2007), ISMS Metrics, Pub. MIQA, London.

[5] IT Governance Institute. Control Objectives for Information and related Technology 5. 0, USA: IT Governance Institute, (2012).

[6] Sharon Taylor, Majid Iqbal, Michael Nieves, . Information Technology Infrastructure Library , England: Office of Government Commerce, ITIL Press Office, (2007).

[7] International Organization for Standardization, International Electrotechnical Commission. ISO/IEC 27001: 2005 Information Technology-Security Techniques-Information Security Management Systems -Requirements. Switzerland: ISO copyright office, (2005).

DOI: 10.3403/30428291u

[8] National Institute of Standards and Technology, U.S. Department of Commerce. NIST Special Publication 800 series.

[9] National Security Agency Information Assurance.

[10] Solutions Technical Directors. Information Assurance Technical Framework (IATF) version3. 0. (2010).

[11] PCI Security Standards Council LLC. PCI DSS Requirements and Security Assessment Procedures, Version 2. 0. (2010).

[12] Federal Financial Institutions Examination Council. IT Examination Handbook, information security Booklet. USA: FFIEC, (2006).

[13] The Open Group's Architecture Forum. The Open Group Architecture Framework version 9. 1, (2012).

[14] Howard Rohm. Using the Balanced Scorecard to Align Your Organization. Balanced Scorecard Institute, a Strategy Management Group company, (2008).

[15] Software Engineering Institute, Carnegie Mellon University. Capability Maturity Model Integration (CMMI) Version 1. 3. USA: Carnegie Mellon University, (2010).

DOI: 10.14796/jwmm.r246-24

[16] STRATUM SECURITY. Proactive Phishing Defense. (2012).