CRAC++ Risk-Based Confidentiality Requirements Specification for Outsourced IT Systems.

Slides:

Advertisements

Similar presentations

© 2008 Cisco Systems, Inc. All rights reserved.Cisco Confidential 14854_10_2008_c1 1 Holistic Approach to Information Security Greg Carter, Cisco Security.

Advertisements

Chapter 7 Control and AIS Copyright © 2012 Pearson Education, Inc. publishing as Prentice Hall 7-1.

Control and Accounting Information Systems

Pedigreed Attribute eLicitation Method (PALM) Onno Dijkstra.

Chapter 4: Security Policy Documents & Organizational Security Policies.

Smart Grid - Cyber Security Small Rural Electric George Gamble Black & Veatch

Security Controls – What Works

Chapter 7 Control and AIS Copyright © 2012 Pearson Education, Inc. publishing as Prentice Hall 7-1.

Technical Specification / Schedule Department of Computer Science and Engineering Michigan State University Spring 2007 Team : CSE 498, Collaborative Design.

Pertemuan Matakuliah: A0214/Audit Sistem Informasi Tahun: 2007.

First Practice - Information Security Management System Implementation and ISO Certification.

A METHOD FOR COMPATIBLE COTS COMPONENT SELECTION (BHUTA, J., BOEHM, B., 2005) Nikos Argyropoulos

Software Safety Risk Evaluation (SSRE) Process SAŠA ŠPILER METHOD ENGINEERING UTRECHT, APRIL 2014.

INFORMATION SECURITY GOVERNANCE (ISG) Relates to the security of information systems Is an element of corporate governance.

Information Security Framework & Standards

CMGT400 Intro to Information Assurance and Security (University of Phoenix) Lecture, Week 4 Tom Olzak, MBA, CISSP.

City Hall of Iasi Ethics in e-guidance, privacy and security devices Date: Author: Cristina Nucuta.

Company Confidential How to implement privacy and security requirements in practice? Tobias Bräutigam, OTT Senior Legal Counsel, Nokia 8 October

Supplementary Specifications (Chapters 20,22 - Requirements Text) Question 1 by Steve & Chandan (Along with others in the past! - See notes, below)

Security Baseline. Definition A preliminary assessment of a newly implemented system Serves as a starting point to measure changes in configurations and.

Security requirements for e-government services: a methodological approach for developing a common PKI-based security policy Authors: C. Lambrinoudakis,

David N. Wozei Systems Administrator, IT Auditor.

1 Chapter Three IT Risks and Controls. 2 The Risk Management Process Identify IT Risks Assess IT Risks Identify IT Controls Document IT Controls Monitor.

2 nd June 2006UPV1 Value-based requirements engineering in decentralized value networks Roel Wieringa University of Twente The Netherlands.

Systems Engineering for the Transportation Critical Infrastructure The Development of a Methodology and Mathematical Model for Assessing the Impacts of.

ISO17799 Maturity. Confidentiality Confidentiality relates to the protection of sensitive data from unauthorized use and distribution. Examples include:

Secure Cloud Solutions Open Government Forum Abu Dhabi April 2014 Karl Chambers CISSP PMP President/CEO Diligent eSecurity International.

Risk Management. IT Controls Risk management process Risk management process IT controls IT controls IT Governance Frameworks IT Governance Frameworks.

What does secure mean? You have been assigned a task of finding a cloud provider who can provide a secure environment for the launch of a new web application.

Software Safety Risk Evaluation Process Yorick Bouma, , Group III.

LeToia Crozier, Esq., CHC Vice President, Compliance & Regulatory Affairs Corey Wilson Director of Technical Services & Security Officer Interactive Think.

Method Engineering Wensi Ai Value-Driven Service Matching.

1 Chapter Nine Conducting the IT Audit Lecture Outline Audit Standards IT Audit Life Cycle Four Main Types of IT Audits Using COBIT to Perform an Audit.

Qualifications for the professions Developing qualifications for the professions Neil Summers Calibrand the currency for talent ® Bangalore 11th October.

RUNA SEWRADJ GROUP A EXTRACTING AND MODELING PRODUCT LINE FUNCTIONAL REQUIREMENTS.

Network Security Principles & Practices By Saadat Malik Cisco Press 2003.

Working with HIT Systems

Introduction to Information Security

CSCE 548 Secure Software Development Security Operations.

Access Security IS3230.

Using Domain Ontology as Domain Knowledge for Requirements Elicitation Haruhiko Kaiya & Motoshi Saeki A model description by Roel Esten.

Chapter 19: Building Systems with Assurance Dr. Wayne Summers Department of Computer Science Columbus State University

Chapter 3 Pre-Incident Preparation Spring Incident Response & Computer Forensics.

Working with HIT Systems Unit 7a Protecting Privacy, Security, and Confidentiality in HIT Systems This material was developed by Johns Hopkins University,

Session 12 Information management and security. 1 Contents Part 1: Introduction Part 2: Legal and regulatory responsibilities Part 3: Our Procedures Part.

Systems Analysis and Design in a Changing World, 6th Edition 1 Chapter 6 - Essentials of Design an the Design Activities.

DCSS Information Security Office Partnership for a secure environment Lawrence “Buddy” Troxler Chief Information Security Officer February 13, 2011.

Chapter 3-Auditing Computer-based Information Systems.

Table of Contents. Lessons 1. Introduction to HIPAA Go Go 2. The Privacy Rule Go Go.

Dr. Mark Gaynor, Dr. Feliciano Yu, Bryan Duepner.

OCTAVE By Matt White. OCTAVE  OCTAVE® (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is a risk-based strategic assessment and planning.

3 STUDENT ASSESSMENT DEPARTMENT

Tech 50800: Champion/Define Phases DATE: PRESENTER: DARON SAUNDERS.

Lecture 5 Control and AIS Copyright © 2012 Pearson Education 7-1.

By: Mark Reed.  Protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

Department of Computer Science Introduction to Information Security Chapter 8 ISO/IEC Semester 1.

Welcome to the ICT Department Unit 3_5 Security Policies.

The History of ARM and Microcontrollers Chapter 1

Providing Access to Your Data: Handling sensitive data

Errors, Fraud, Risk Management, and Internal Controls

Current ‘Hot Topics’ in Information Security Governance Auditing

Information Security based on International Standard ISO 27001

Chapter 19: Building Systems with Assurance

By The Data Protection Commissioner

CSE 498, Collaborative Design

Goal and Scope Rubric, 0.5 points

Neopay Practical Guides #2 PSD2 (Should I be worried?)

Diagram showing the local impact of the deformation band network on oil saturation in model LL_1ORD, illustrating the controls of the deformation bands.

APPLICATION DISASTER RECOVERY RESPONSE

Presentation transcript:

CRAC++ Risk-Based Confidentiality Requirements Specification for Outsourced IT Systems

Content Authors Origins Method positioning Related literature Purpose and Main steps Process-Deliverable Diagram Method illustration Questions

Authors Ayse Moralie o PhD student at University of Twente o CRAC++ part of PhD dissertation Roel Wieringa o Information Systems Group, University of Twente o Head of Computer Science Department, University of Twente

Origins Regulations require companies to have control over the security of IT assets Companies outsource IT systems, the result is confidential data present in two different systems. No practical method to specify confidentiality requirements in SLA’s. Based on CRAC (Morali &Wieringa, 2009)

Method positioning

Related literature Insurance Contracts (IC) defines security requirements based on past incidents (Gritzalis et al., 2007) Determine adequate security requirements as constraints on functional requirements(Haley et al., 2008) Common Criteria tool for comparing two sets of requirements (ISO 15408, 2007)

Purpose and Main steps Assesssing and comparing confidentaility risks of two alternative networked IT architectures Step 0: Elicit Input Data Step 1: Assessing Total Impact of Disclosure per Component Step 2: Assessing Protection Level per Component Step 3: Determining Candidate Confidentiality Requirements

PDD

PDD

Method illustration

Questions