Development of an IT-Security Performance Measurement System

Inhaltsangabe:Abstract:

Adequate security of information and the systems that process it is a fundamental management responsibility. Management must understand the current status of their IT-Security program in order to make informed decisions.

In this context, this Bachelor Thesis proposes a Performance Measurement System for IT-Security, which is designed to be well-balanced and comprehensive. It views IT-Security from four perspectives: Organisational, Financial, Operational and Personnel.

The documentation of the system contains the key figures and their interrelationships. With its modular design, it can either be used out-off-the-box or tailored to the specific requirements of the organisation.

Chapter 1 briefly discusses the reason for this Bachelor Thesis and introduces the problem statement. Chapter 2 explores the basic concepts behind both IT-Security and performance measurement. Chapter 3 covers general requirements, which are fundamental principles needed to be taken into consideration when building an IT-Security Performance Measurement System. Chapter 4 describes the approach taken for the design of the system. Chapter 5 introduces the Performance Measurement System for IT-Security.

Inhaltsverzeichnis:Table of Contents:

1.Introduction1

1.1Motivation1

1.2Problem Statement2

2.Theoretical Background3

2.1Performance Measurement4

2.1.1Definitions4

2.1.2Key Figures4

2.1.3The Balanced Scorecard6

2.2IT-Security7

2.2.1Goals of IT-Security7

2.2.2Security Policy9

2.2.3Incident Response10

2.3Risk Management11

2.3.1The Asset/Threat/Vulnerability/Safeguard Concept11

2.3.2Risk Assessment12

2.3.3Risk Mitigation13

2.4Existing Standards for IT-Security14

2.4.1Standards for Information Security Management14

2.4.2Standards for Evaluation15

2.4.3Standards for Development15

2.4.4Standards for a Common Terminology16

3.Requirements19

3.1General Requirements20

3.1.1Financial Requirements20

3.1.2Regulatory Requirements20

3.1.3Organisational Requirements20

3.1.4Requirements for Performance Measurement21

3.2Requirements at a Glance22

4.Development Approach23

4.1Top-Down vs. Bottom-Up23

4.1.1Top-Down23

4.1.2Bottom-Up24

4.1.3Comparison26

4.2Development Approach chosen26

5.Findings29

5.1Top-Down Findings30

5.1.1Generic Security Model30

5.1.2Self-Assessment Guide31

5.1.3Findings and Discussion34

5.2Bottom-Up Findings36

5.2.1List of Key Figures36

5.2.2Relationships38

5.3Meet in the Middle39

5.4Discussion of Key [¿]