IT/IS security management with uncertain information

Klimeš, Cyril ; Bartoš, Jiří

Kybernetika, Tome 51 (2015) no. 3, pp. 408-419

Abstract (VO)

The paper introduces a novel proposal of a security management system destined primarily for application in the field of IT. Its core is formed by a triplet of cooperating knowledge-based (expert) systems, the knowledge bases of which consist of vague If-Then rules. The knowledge bases were created by experts on the problem domain and multiple times tested and verified on actual scenarios and real systems. With the system, a comprehensive methodology that is a part of a more complex approach to a decision making process is introduced. The proposed fuzzy tool is demonstrated on examples and problems from the area of information security. The paper also briefly reviews other used approaches to information security management - mainly qualitative and quantitative methodologies.

Détail

DOI : 10.14736/kyb-2015-3-0408

Classification : 62A10, 93E12
Keywords: information retrieval; fuzzy sets; modeling information systems under uncertainty; adaptive model; information security; risk management; risk analysis

Bibliographie

[1] 13335-3, ČSN ISO/IEC TR: Information technology - Guidelines for the management of IT Security - Part 3: Techniques for the management of IT Security. Český normalizační institut, Praha 1999, pp. 1-25.

[2] 27001, ČSN ISO/IEC: Information technology - Security techniques - Information security management systems - Requirements. Český normalizační institut, Praha 2006, Annex A.

[3] Bartoš, J., Procházka, J., Klimeš, C., Walek, B., Pešl, M.: Fuzzy reasoning model for decision making under uncertainty. In: 16th International Conference on Soft Computing Mendel 2010, Brno 2010.

[4] Bartoš, J., Procházka, J., Klimeš, C., Walek, B., Pešl, M.: Fuzzy reasoning model for decision making under uncertainty. In: 16th International Conference on Soft Computing Mendel 2011. Brno 2010, pp. 203-209.

[5] Bartoš, J., Walek, B.: A methodology for testing of information system under uncertainty. In: Proc. 36th International Conference on Telecommunications and Signal Processing (TSP), Faculty of Electrical Engineering and Communication, Brno University of Technology, Brno 2013, pp. 20-22. | DOI

[6] Bartoš, J., Walek, B., Smolka, P., Procházka, J., Klimeš, C.: Fuzzy modeling tools for information system testing. In: 17th International Conference on Soft Computing Mendel 2011. Brno 2011, pp. 154-161.

[7] Habiballa, H., Novák, V., Dvořák, A., Pavliska, V.: Using software package LFLC 2000. In: 2nd International Conference Aplimat, Bratislava 2003, pp. 355-358.

[8] Klimeš, C., Procházka, J.: Reasoning in Software Support and Maintenance. In: Abstracts of Contributions to 5th International Workshop on Data-Algorithm-Decision Making. DAR - UTIA 2009/3, Praha 2009.

[9] Klimeš, C.: Expert System Utilization for Modeling the Decision Making Processes upon Indetermination. Acta Electrotechnica et Informatica 1 (2007), 1.

[10] Klimeš, C., Procházka, J.: Research paper: Using LFLC for decision making in SW support and maintenance. In: Research intention DAR - OASA 2/2009. Ostrava 2009.

[11] Krutz, R. L., Vines, R. D.: The CISSP Prep Guide-Mastering the Ten Domains of Computer Security. John Wiley \and Sons, Inc., 2001, pp. 12-33.

[12] Makowski, M.: Mathematical Modeling for Coping with Uncertainty and Risk. In: System and Human Science for Safety, Security and Dependability, November 2003, pp. 1-20. | DOI

[13] Novák, V.: Fuzzy množiny a jejich aplikace. SNTL, Praha 1986. | Zbl

[14] Novák, V.: Fuzzy Relation Equations with Words. First edition. Springer,Heidelberg 2004, pp. 167-185. | DOI | MR

[15] Novák, V., Perfilieva, I., Močkoř, J.: Mathematical Principles of Fuzzy Logic. First edition. Kluwer Academic Publishers, Boston - Dordrecht - London 1999. | DOI | MR

[16] Walek, B., Bartoš, J., Žáček, J.: Proposal of The Expert System for Conducting Information Security Risk Analysis, Proceedings of the International Conference on Electrical and Electronics Engineering, Clean Energy and Green Computing. In: The Society of Digital Information and Wireless Communications, 2013, pp. 58-68.

[17] Steiner, F., Tupá, J.: Management rizik v systémech řízení bezpečnosti informací. In: MOPP 2007. Západočeská univerzita, Plzeň 2007, pp. 177-183.

[18] Šegudović, H.: Quantitative risk analysis method comparison. In: MIPRO 2007 conference, ISS, pp. 1-6.

[19] Šegudović, H.: Upravljanje sigurnošću informacijskih sustava. In: KOM 2003, FER LSS, 2003, pp. III 31-40.

[20] Walek, B., Bartoš, J., Klimeš, C.: A methodology for creating a conceptual model under uncertainty. In: International Conference on Computer, Electrical, and Systems Science, and Engineering, Amsterdam 2012, pp. 86-92.