Research Article
Information Systems Security Management: A Review and a Classification of the ISO Standards
@INPROCEEDINGS{10.1007/978-3-642-11631-5_21, author={Aggeliki Tsohou and Spyros Kokolakis and Costas Lambrinoudakis and Stefanos Gritzalis}, title={Information Systems Security Management: A Review and a Classification of the ISO Standards}, proceedings={Next Generation Society. Technological and Legal Issues. Third International Conference, e-Democracy 2009, Athens, Greece, September 23-25, 2009, Revised Selected Papers}, proceedings_a={E-DEMOCRACY}, year={2012}, month={5}, keywords={Information security management systems standardization}, doi={10.1007/978-3-642-11631-5_21} }- Aggeliki Tsohou
Spyros Kokolakis
Costas Lambrinoudakis
Stefanos Gritzalis
Year: 2012
Information Systems Security Management: A Review and a Classification of the ISO Standards
E-DEMOCRACY
Springer
DOI: 10.1007/978-3-642-11631-5_21
Abstract
The need for common understanding and agreement of functional and non-functional requirements is well known and understood by information system designers. This is necessary for both: designing the “correct” system and achieving interoperability with other systems. Security is maybe the best example of this need. If the understanding of the security requirements is not the same for all involved parties and the security mechanisms that will be implemented do not comply with some globally accepted rules and practices, then the system that will be designed will not necessarily achieve the desired security level and it will be very difficult to securely interoperate with other systems. It is therefore clear that the role and contribution of international standards to the design and implementation of security mechanisms is dominant. In this paper we provide a state of the art review on information security management standards published by the International Organization for Standardization and the International Electrotechnical Commission. Such an analysis is meaningful to security practitioners for an efficient management of information security. Moreover, the classification of the standards in the clauses of ISO/IEC 27001:2005 that results from our analysis is expected to provide assistance in dealing with the plethora of security standards.