Search

Speed and accessibility operations promoted by information and communication technologies, particularly the Internet, leads organizations to become heavily dependent of their information systems. Further, the rapid technological advances have also created significant risks to organizations and government operations. The risks are expected to continue to escalate as new technologies and new Internet-enabled services emerge. As a result, the security strategies of these organizations need to evolve as well, in response to the evolving information security requirements. In short, there is a need for a proper information security management, within the context of the organization's structure, objectives and activities. One way to achieve this goal is to plan regular audits to evaluate the information systems security. The current available resources are typically guidelines and checklists, more or less linked to particular views. To address this issue, it was developed a framework based on a conceptual model approach. This solution introduces a new perspective to model information in security domain. It allows the description of the data semantics and enables to firm up and unify the concepts and terminology defined in the information security domain, based on the ISO/IEC̱JTC1 standards. This paper presents the preliminary stage of the framework development, in particular, the adoption of the ontological approach for the information security management. [ABSTRACT FROM AUTHOR]