Abstract
The ISO 27001 standard specifies an information security management system (ISMS) as a means to implement security best practices for IT systems. Organisations that implement an ISMS typically experience various challenges such as enforcing a common vocabulary, limiting human errors and integrating existing management tools and security mechanisms. However, ISO 27001 does not provide guidance on these issues because tool support is beyond its scope, leaving organisations to start “from scratch” with manual and usually paper document-driven approaches. We propose a novel reference platform for security management that provides the foundation for systematic and automated ISMS tool support. Our platform consists of a unified information model, an enterprise-level repository and an extensible application and integration platform that aid practitioners in tackling the aforementioned challenges. This paper motivates and outlines the key elements of our approach and presents a first proof-of-concept prototype implementation.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
ISO/IEC: Information technology — Security techniques — Information security management systems — Requirements. 1st edn. (2005); ISO/IEC 27001:2005(E), International Standard
ISO/IEC: Information technology — Security techniques — Information security management system implementation guidance. 1st edn. (2010); ISO/IEC 27003:2010(E), International Standard
Müller, I.: The Information Security Management Information Model (ISM-IM). Technical Report. Swinburne University of Technology (2010), http://www.swinburne.edu.au/ict/research/cs3/rsr/pubs/ISM-IM.pdf
Müller, I., Han, J., Schneider, J.G., Versteeg, S.: A Conceptual Framework for Unified and Comprehensive SOA Management. In: Feuerlicht, G., Lamersdorf, W. (eds.) ICSOC 2008. LNCS, vol. 5472, pp. 28–40. Springer, Heidelberg (2009)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2011 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Müller, I., Han, J., Schneider, JG., Versteeg, S. (2011). Idea: A Reference Platform for Systematic Information Security Management Tool Support. In: Erlingsson, Ú., Wieringa, R., Zannone, N. (eds) Engineering Secure Software and Systems. ESSoS 2011. Lecture Notes in Computer Science, vol 6542. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-19125-1_20
Download citation
DOI: https://doi.org/10.1007/978-3-642-19125-1_20
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-19124-4
Online ISBN: 978-3-642-19125-1
eBook Packages: Computer ScienceComputer Science (R0)