Pattern-Based Support for Context Establishment and Asset Identification of the ISO 27000 in the Field of Cloud Computing
- The ISO 27000 is a well-established series of information security standards. The scope for applying these standards can be an organisation as a whole, single business processes or even an IT application or IT infrastructure. The context establishment and the asset identification are among the first steps to be performed. The quality of the results produced when performing these steps has a crucial influence on the subsequent steps such as identifying loss, vulnerabilities, possible attacks and defining countermeasures. Thus, a context analysis to gather all necessary information in the initial steps is important, but is not offered in the standard. In this paper, we focus on the scope of cloud computing systems and present a way to support the context establishment and the asset identification described in ISO 27005. A cloud system analysis pattern and different kinds of stakeholder templates serve to understand and describe a given cloud development problem, i.e. the envisaged ITThe ISO 27000 is a well-established series of information security standards. The scope for applying these standards can be an organisation as a whole, single business processes or even an IT application or IT infrastructure. The context establishment and the asset identification are among the first steps to be performed. The quality of the results produced when performing these steps has a crucial influence on the subsequent steps such as identifying loss, vulnerabilities, possible attacks and defining countermeasures. Thus, a context analysis to gather all necessary information in the initial steps is important, but is not offered in the standard. In this paper, we focus on the scope of cloud computing systems and present a way to support the context establishment and the asset identification described in ISO 27005. A cloud system analysis pattern and different kinds of stakeholder templates serve to understand and describe a given cloud development problem, i.e. the envisaged IT systems and the relevant parts of the operational environment. We illustrate our support using an online banking cloud scenario.…
Author: | Kristian Beckers, Holger Schmidt, Jan-Christoph Küster, Stephan Faßbender |
---|---|
Fachbereich/Einrichtung: | Hochschule Düsseldorf / Fachbereich - Medien |
Hochschule Düsseldorf / Fachbereich - Medien / Digitale Vernetzung und Informationssicherheit | |
Document Type: | Conference Proceeding |
Year of Completion: | 2011 |
Language of Publication: | English |
Publisher: | IEEE |
Place of publication: | Vienna |
Parent Title (English): | 2011 Sixth International Conference on Availability, Reliability and Security |
First Page: | 327 |
Last Page: | 333 |
Related URL: | https://ieeexplore.ieee.org/document/6045958 |
DOI: | https://doi.org/10.1109/ARES.2011.55 |
ISBN: | 978-1-4577-0979-1 |
Tag: | Cloud computing; ISO27005; IT infrastructure; risk management; security standards |
Dewey Decimal Classification: | 0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 000 Informatik, Informationswissenschaft, allgemeine Werke |
Licence (German): | keine Lizenz - nur Metadaten |
Release Date: | 2018/10/11 |
Note: | Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. |