Assessment of Enterprise Information Security: The Importance of Prioritization
2005 (English)In: Ninth IEEE International EDOC Enterprise Computing Conference, Proceedings, 2005, 207-218 p.Conference paper (Refereed)
Assessing the level of information, security in an enterprise is a serious challenge for many organizations. This paper considers the prioritization of the field of enterprise information security. The paper thus considers how we may know what parts Of information security are important for a company to address and what parts are not. Two methods for prioritization are used. The results demonstrate to what extent different standards committees, guideline authors and expert groups differ in their opinions on what the important issues are in enterprise information security. The ISOJEC 17799, the NIST SP 800-26, the ISF standards committees, the CMU/SEI OCTAVE framework authors and an expert panel at the Swedish Information Processing Society (DFS) are considered. The differences in prioritization have important consequences on enterprise information security assessments. The effects on the information security assessment results in a European energy company are presented in the paper.
Place, publisher, year, edition, pages
2005. 207-218 p.
Computational methods, Data privacy, Data processing, Information retrieval systems, Societies and institutions, Standards, Enterprise information security, Information Processing Society (IPS), Prioritization, Standards committees
Computer and Information Science
IdentifiersURN: urn:nbn:se:kth:diva-8896DOI: 10.1109/EDOC.2005.9ISI: 000234341900018ScopusID: 2-s2.0-33749392679ISBN: 0-7695-2441-9OAI: oai:DiVA.org:kth-8896DiVA: diva2:14376
9th IEEE International Enterprise Distributed Object Computing Conference, Enschede, NETHERLANDS, SEP 19-23, 2005
QC 201010282005-12-082005-12-082010-10-28Bibliographically approved