INPROFORUM 2011

Model for security alert procesing in monitoring phase of information security management system
Ladislav Beránek, Jiří Knížek, Radim Remeš

Language: cs
Last modified: 2013-07-29

Abstract


Monitoring phase is an important area in the operation of information security management system (ISMS) according to ISO 27001. Its aim is to obtain an overview of the situation in the area of information security in organization. This overview can be created based on events and security alerts from various systems. However, the complexity and diversity of these systems, a number of different reports about various security incidents make this task difficult. A complete overview of the security situation is not so easy to obtain. In this paper, we describe some problems in creating an overview of the security situation and propose a model to assess the current state of the security. The model includes the processing of security reports using methods based on data mining, transformation of data into a uniform format and a use of Dempster-Shafer theory to describe the state of information security in organization. The application demonstrates that the proposed model is effective and can be an important tool for monitoring phase in the operation of information security management system.


Keywords


information security management system, data processing, Dempster-Shafer theory

Full Text: PDF