• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>Workshops on business informatics research >Risk and Business Goal Based Security Requirement and Countermeasure Prioritization
【24h】

Risk and Business Goal Based Security Requirement and Countermeasure Prioritization

机译：基于风险和业务目标的安全需求和对策优先级

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Companies are under pressure to be in control of their assets but at the same time they must operate as efficiently as possible. This means that they aim to implement "good-enough security" but need to be able to justify their security investment plans. Currently companies achieve this by means of checklist-based security assessments, but these methods are a way to achieve consensus without being able to provide justifications of countermeasures in terms of business goals. But such justifications are needed to operate securely and effectively in networked businesses. In this paper, we first compare a Risk-Based Requirements Prioritization method (RiskREP) with some requirements engineering and risk assessment methods based on their requirements elicitation and prioritization properties. RiskREP extends misuse case-based requirements engineering methods with IT architecture-based risk assessment and countermeasure definition and prioritization. Then, we present how RiskREP prioritizes countermeasures by linking business goals to countermeasure specification. Prioritizing countermeasures based on business goals is especially important to provide the stakeholders with structured arguments for choosing a set of countermeasures to implement. We illustrate RiskREP and how it prioritizes the countermeasures it elicits by an application to an action case.
机译：公司承受着控制其资产的压力，但与此同时，它们必须尽可能高效地运作。这意味着他们旨在实现“足够好的安全性”，但需要能够证明其安全投资计划的合理性。当前，公司通过基于核对表的安全评估来实现这一目标，但是这些方法是达成共识的一种方式，而又不能根据业务目标提供对策的依据。但是，要在网络业务中安全有效地运行，就需要有这样的理由。在本文中，我们首先将基于风险的需求优先级排序方法（RiskREP）与一些需求工程和风险评估方法进行了比较，这些方法基于需求诱导和优先级划分属性。 RiskREP通过基于IT体系结构的风险评估，对策定义和优先级扩展了基于滥用案例的需求工程方法。然后，我们介绍RiskREP如何通过将业务目标与对策规范联系起来来确定对策的优先级。根据业务目标确定对策的优先级，对于为利益相关者提供结构化的论据以选择要实施的对策尤为重要。我们将说明RiskREP以及它如何对应用程序对行动案例提出的对策进行优先排序。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号