Last modified: 2013-07-29
Monitoring phase is an important area in the operation of information security management system (ISMS) according to ISO 27001. Its aim is to obtain an overview of the situation in the area of information security in organization. This overview can be created based on events and security alerts from various systems. However, the complexity and diversity of these systems, a number of different reports about various security incidents make this task difficult. A complete overview of the security situation is not so easy to obtain. In this paper, we describe some problems in creating an overview of the security situation and propose a model to assess the current state of the security. The model includes the processing of security reports using methods based on data mining, transformation of data into a uniform format and a use of Dempster-Shafer theory to describe the state of information security in organization. The application demonstrates that the proposed model is effective and can be an important tool for monitoring phase in the operation of information security management system.