Ranking information security controls by using fuzzy analytic hierarchy process
详细信息 查看全文
- 作者：Hamid Khajouei ; Mehdi Kazemi…
- 关键词：Information security management ; ISO 27001 ; Fuzzy analytic hierarchy process ; Information security controls
- 刊名：Information Systems and e-Business Management
- 出版年：2017
- 出版时间：February 2017
- 年：2017
- 卷：15
- 期：1
- 页码：1-19
- 全文大小：
- 刊物类别：Business and Economics
- 刊物主题：IT in Business; Information Systems Applications (incl.Internet); Management;
- 出版者：Springer Berlin Heidelberg
- ISSN：1617-9854
- 卷排序：15
文摘
Information security can be achieved by implementing a set of appropriate controls. However, identifying and selecting the most effective information security controls in organizations have been major challenges for years. Although many studies have been done to address these challenges, there is still lack of research to rank these controls. In this study, a fuzzy Analytic Hierarchy Process was used to prioritize and select effective managerial domains and control objectives in information security controls. In this research, the process of implementing ISO 27001 Information Security in National Iranian Oil Products Distribution Company was selected. According to results, the access control, information systems acquisition, development and maintenance have the highest priorities among the information security controls in managerial domains. On the other hand, the business continuity management and asset management have the lowest priorities among the studied information security controls. Furthermore, it was found that among 39 control objectives, the user access management and third party service delivery management have the highest and lowest priorities, respectively.