Methodology for Evaluating Security Controls Based on Key Performance Indicators and Stakeholder Mission

Information security continues to evolve in response to disruptive changes with a persistent focus on information-centric controls and a healthy debate about balancing endpoint and network protection, with a goal of improved enterprise/business risk management. Economic uncertainty, intensively collaborative styles of work, virtualization, increased outsourcing and ongoing compliance pressures require careful consideration and adaptation. This paper proposes a Cyberspace Security Econometrics System (CSES) that provides a measure (i.e., a quantitative indication) of reliability, performance and/or safety of a system that accounts for the criticality of each requirement as a function of one or more stakeholders’ interests in that requirement. For a given stakeholder, CSES accounts for the variance that may exist among the stakes one attaches to meeting each requirement. This paper introduces the basis, objectives and capabilities for the CSES including inputs/outputs as well as the s...

• Type: Conference
• Year: 2009
• Where: HICSS
• Authors: Frederick T. Sheldon, Robert K. Abercrombie, Ali Mili
• Keywords: Biometrics, Cyberspace Security Econometrics, Enterprise/business Risk Management, HICSS 2009, Performance And/or Safety, System Sciences