GQ01: Information Security Policy Repository

Different types of information security policies make it difficult to access relevant passages in individual policies and combine them into an actionable recommendation. A repository in which the policies are stored, and their sections can be accessed in relation to their relevance in each situation, ranging from editing and auditing policies to applying them to incident handling, would therefore be very helpful. To be effective, the developed repository needs to support the information security policy life cycle.

The goal of the project is to develop such a policy repository/store model and implement a prototype. For searching the policy store, AI technologies as well as traditional search mechanisms building on keywords and ontologies should be considered.

The following sources can serve as starting point for this project:

M. Alam and M. U. Bokhari, "Information Security Policy Architecture," International Conference on Computational Intelligence and Multimedia Applications (ICCIMA 2007), Sivakasi, India, 2007, pp. 120-122, doi: 10.1109/ICCIMA.2007.275.

Kenneth J. Knapp, R. Franklin Morris, Thomas E. Marshall, Terry Anthony Byrd, Information security policy: An organizational-level process model, Computers & Security, Volume 28, Issue 7, 2009, Pages 493-508, ISSN 0167-4048, https://doi.org/10.1016/j.cose.2009.07.001.

Nader Sohrabi Safa, Rossouw Von Solms, Steven Furnell, Information security policy compliance model in organizations, Computers & Security, Volume 56, 2016, Pages 70-82, ISSN 0167-4048, https://doi.org/10.1016/j.cose.2015.10.006.

Hanna Paananen, Michael Lapke, Mikko Siponen, State of the art in information security policy development, Computers & Security, Volume 88, 2020, 101608, ISSN 0167-4048, https://doi.org/10.1016/j.cose.2019.101608.

The suggested structure for the paper accompanying the project is:

The suggested structure for the paper accompanying the project is:

1. Introduction/Topic description/Motivation
2. State of the art in literature and practice
3. Modelling method and approach used
4. Development of the model
5. Prototype (documentation, source code, etc.)
6. Test
7. Discussion of the results
8. Outlook and conclusion

Tags: Quirchmayr;