Title: Assessment of business process information security

Authors: Pontus Johnson, Erik Johansson

Addresses: Industrial Information and Control Systems, KTH – Royal Institute of Technology, Stockholm 10044, Sweden. ' Industrial Information and Control Systems, KTH – Royal Institute of Technology, Stockholm 10044, Sweden

Abstract: Business processes are increasingly dependent on their supporting information systems. With this dependence comes an increased security risk with respect to the information flowing through the processes. This paper presents a method for assessment of the level of information security within business processes in the form of a percentage number, where a high score indicates good information security and a low score indicates a poor level of information security. The method also provides a numerical estimate of the credibility of the information security score, so that an assessment based on few and uncertain pieces of evidence is associated with low credibility and an assessment based on a large set of trustworthy evidence is associated with high credibility. A common problem with information security assessments is the cost related to collecting the required evidence. This paper proposes an evidence collection strategy designed to minimise the effort spent on gathering assessment data while maintaining the desired credibility of the results. A case study is presented, demonstrating the use of the method.

Keywords: information security; computer security; ISO/IEC 17799; credibility; cost of evidence; enterprise information security; business process information; trustworthiness.

DOI: 10.1504/IJBPIM.2008.020975

International Journal of Business Process Integration and Management, 2008 Vol.3 No.2, pp.118 - 130

Published online: 29 Oct 2008 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article