Information Security Risk Management in a World of Services
September 8, 2013·
,
·
0 min read
Vincent Lalanne
Manuel Munier
Alban Gabillon
Abstract
Service Oriented Architectures (SOA) offer new opportunities for the interconnection of systems. However, for a company, opening its Information System to the “world” is not insignificant in terms of security. Whether to use available services or provide its own services, new technologies have introduced new vulnerabilities and therefore new risks. Our work aims to propose an approach for risk management which is based on the ISO/IEC 27005:2011 standard: we propose a development of this standard (by an extension of Annex D) so that it can fully take into account the type “service” as web services and cloud services. Indeed, a world of services is not limited to link interconnected systems, it is more a relationship between customer and supplier, where notions of trust, accountability, traceability and governance are developped. Following this study we introduce a new security criterion, controllability, to ensure that a company keeps control of its information even if it uses such outsourced services.
Type
Publication
In 2013 ASE/IEEE International Conference on Privacy, Security, Risk and Trust (PASSAT'2013)
Location
Washington D.C., USA, September 8th-14th, 2013
Authors
Associate Professor in Computer Science
Manuel Munier received his Ph.D. in Computer Science from University of Nancy in january 1999. His thesis works studied cooperative systems, advanced transaction models, distributed systems. Immediately after receiving his Ph.D., he worked as a postdoctoral researcher for INRIA Lorraine and Xerox Research Centre Europe in Grenoble.
In september 1999 he joined the University of Pau (IUT des Pays de l’Adour, département Réseaux & Télécommunications, site de Mont de Marsan). Manuel Munier is a member of ISI-Know team (Information Security and engIneering through knowledge management) of the LIUPPA (Laboratoire d’Informatique de l’Université de Pau et des Pays de l’Adour).