Information security standards focus on the existence of process, not its content

Communications of the ACM

Volumn 49, Issue 8, 2006, Pages 97-100

  Siponen, Mikko ^a  

^a UNIVERSITY OF OULU   (Finland)

Author keywords

[No Author keywords available]

Indexed keywords

DATA PRIVACY; ENGINEERING EDUCATION; ENGINEERING RESEARCH; SOCIETIES AND INSTITUTIONS; STANDARDS;

EDUCATION STRATEGIES; SECURITY MANAGEMENT STANDARDS; SECURITY PROCESSES;

SECURITY OF DATA;

EID: 33747194078     PISSN: 00010782     EISSN: 00010782     Source Type: Journal    
DOI: 10.1145/1145287.1145316     Document Type: Review

References (12)

1. Abrahamsson, P. The role of commitment in software process improvement. Ph.D. thesis. Acta Universitatis Quluensis A 386, Oulu University Press, 2002.
2. Code of Practice for Information Security Management, BS7799-1, Department of Trade and Industry, British Standard Institution, London, U.K., 2000.
3. Code of Practice for Information Security Management, BS7799, Department of Trade and Industry, British Standard Institution, London, U.K., 1993.
4. Eloff, M.M. and Solms, S.H. Information security management: A hierarchical frame-work for various approaches. Computers and Security 19, (2000), 243-256.
5. Generally Accepted Information Security Principles (GAISP) Version 3.0, 2003; www.issa.org/gaisp/_pdfs/v30.pdf.
6. Generally Accepted System Security Principles (GASSP). Version 2.0. Information Systems Security 8, 3 (June 1999).
7. Hardy, G. Standards - The need for a common framework. Computers and Security 14, 5 (1995), 426-427.
8. ISF Standard of Good Practice for Information Security (2003); www.isfsecuritystandard.com/index_ie.htm.
9. Janczewski, L. Managing security functions using security standards. In L. Janczewski, Ed. Internet and Intranet Security Management: Risks and Solutions, Idea Group Publishing, 2000, 81-105.
10. Siponen, M.T. A conceptual foundation for organizational information security awareness. Information Management and Computer Security 8 (2000), 31-41.
11. Salms, R. Information security management (3): The Code of Practice for Information Security Management (BS 7799). Information Management and Computer Security 6, 5 (1998), 224-225.
12. Solms, R. Information security management: Why standards are important. Information Management and Computer Security 7, 1 (1999), 50-58.