Future methods for IT security assessment
Publish date: 2010-12-31
Report number: FOI-R--3094--SE
Pages: 56
Written in: Swedish
Keywords:
- IT security
- assessment
- lifecycle model
- TSAR
Abstract
The use of information systems within the Swedish Armed Forces is increasing while the systems are becoming larger, more interconnected, and manages more mission-critical information. This leads to increasing needs to ensure that the systems have a sufficient level of IT security. Different approaches to determining the IT security levels are more or less appropriate during the various stages of the IT lifecycle model used by the Swedish Armed Forces. To create a clear picture of what types of future IT security assessment methods that may be relevant to the Swedish Armed Forces a literature study was conducted. The literature study resulted in a number of articles that describe different approaches to determine the IT security level of a system. Similar approaches were grouped together, resulting in four groups of methods. These four method groups were tested using the test procedure TSAR. To get an indication of the relevance to the Swedish Armed Forces, each method group was tested against the needs of IT security assessment at each stage of the IT life cycle model. The needs of IT security assessment were identified through a survey. The tests resulted in a measure of how relevant each method group is considered to be for the Swedish Armed Forces during the steps of the IT life cycle model. Based on the test results, recommendations are provided regarding what types of IT security assessment methods that may be of interest to the Swedish Armed Forces in the future.