Information security management standards: Problems and solutions

Information and Management

Volumn 46, Issue 5, 2009, Pages 267-270

  Siponen, Mikko ^a   Willison, Robert ^b  

^a UNIVERSITY OF OULU   (Finland)

^b Copenhagen Business School ^*  (Denmark)

Author keywords

Information security certification; Information security management; Information security management guidelines; Information security management standards; Information systems security

Indexed keywords

INFORMATION SECURITY CERTIFICATION; INFORMATION SECURITY MANAGEMENT; INFORMATION SECURITY MANAGEMENT GUIDELINES; INFORMATION SECURITY MANAGEMENT STANDARDS; INFORMATION SYSTEMS SECURITY;

COORDINATE MEASURING MACHINES; INDUSTRIAL MANAGEMENT; INFORMATION SYSTEMS; STANDARDS;

SECURITY OF DATA;

EID: 67651102640     PISSN: 03787206     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.im.2008.12.007     Document Type: Article

References (24)

1. Backhouse J., Hsu C., and Silva L. Circuits of power in creating de jure standards: shaping an international information systems security standard. MIS Quarterly 30 Special issue (2006) 413-438
2. Baskerville R. Risk analysis: an interpretative feasibility tool in justifying information systems security. European Journal of Information Systems 1 2 (1991) 121-130
3. Baskerville R. Risk analysis as a source of professional knowledge. Computers and Security 10 8 (1991) 749-764
4. Baskerville R. Information systems security design methods: implications for information systems development. Computing Surveys 25 4 (1993) 375-414
5. 7799BS, Code of Practice for Information Security Management, Department of Trade and Industry, DISC PD003, British Standard Institute, London, UK (1995).
6. BS7799-1, Code of Practice for Information Security Management, Department of Trade and Industry, 1999.
7. BS ISO/IEC 17799:2000 (BS 7799-1:2000), Information Technology - Code of Practice for Information Security Management, British Standards Institute, 2000.
8. BS 7799-2:2002 Information security management systems - Specification with guidance for use, BSI, UK, 2002.
9. Common Criteria, Common criteria for information technology security evaluation, 2006, http://www.commoncriteriaportal.org/public/consumer/index.php?menu=2.
10. GASSP, Generally Accepted System Security Principles (GASSP), Version 2.0, Information Systems Security, June, vol. 8, no. 3, 1999.
11. GAISP V3.0, 2003, http://www.issa.org/gaisp/_pdfs/v30.pdf.
12. GAISP, Detailed Principles Cookbook, 2003, http://www.issa.org/gaisp/_pdfs/v30.pdf.
13. R. Hefner, W. Monroe, System Security Engineering Capability Maturity Model, Conference on Software Process Improvement, UC Irvine, CA, USA, 1997.
14. Herbsleb J., Zubrow D., Goldenson D., Hayes W., and Paulk M. Software quality and the capability model. Communications of the ACM 40 6 (1997) 30-40
15. Hopkinson J. Security standards overview. Proceedings of the Second Annual International Systems Security Engineering Conference (2001)
16. Information Technology Security Evaluation Criteria (ITSEC), Harmonised Criteria of France, Germany, the Netherlands and the United Kingdom, 1990.
17. IT Baseline Protection Manual, BSI, Germany, 1996.
18. P. Overbeek, Common criteria for IT security Evaluation - Update Report, in: Proceedings of the IFIP TC11 Eleventh International Conference on Information Security, Cape Town, South Africa, 1995.
19. Saltmarsh T., and Browne P. Data processing - risk assessment. In: Wofsey M. (Ed). Advances in Computer Security Management vol. 2 (1983), John Wiley and Sons Ltd 93-116
20. Siponen M. Information security standards focus on the existence of process not its content?. Communications of the ACM 49 8 (2006) 97-100
21. Siponen M., Pahnila S., and Mahmood A. Employees' adherence to information security policies: an empirical study. Proceedings of the IFIP SEC2007. Sandton, Gauteng, South Africa (2007)
22. SSE-CMM, The Appraisal Method, v2.0 and v3.0, 1998, http://www.sse-cmm.org.
23. Straub D. Effective IS security: an empirical study. Information Systems Research 1 3 (1990) 255-276
24. Straub D., and Nance W. Discovering and disciplining computer abuse in organizations: a field study. MIS Quarterly 14 1 (1990) 45-60