Functional modeling of information security risk management system
Володимир Володимирович Мохор, Василь Васильович Цуркан, Yaroslaw Dorogyy, Ольга Миколаївна Крук · Ukrainian Information Security Research Journal · 2016
Preservation of confidentiality, integrity and availability of information in organization is achieved by risk management system designing and implementation. For these purposes, a generic approach described in the international standard ISO/IEC 27005: 2011 is used. In view of above-mentioned, it is specified by the principles and recommendations of the ISO 31000:2009, ISO/TR 31004:2013, IEC 31010:2009. Therefore, the definitions from these legal documents are used for information security risk management system design and implementation. The system is developing by identifying her functional boundaries, functions and terms of their performance. This will be possible by the way of its functional simulation. Thus, resulting functional model will be presented in IDEF0 graphical diagram notation. According to this view, information security risk management activities are formalized by defining objectives, terms of model and set of functions. At last, such approach has given us the possibility to visualize the conditions and results of their execution by the system was simulated, within the prescribed limits.