Automating Information Security assessments using intelligent software agents
Clemens Martin, Rania Nasr, Mark Hoersken, Tobias Fuechtler · 2016
Implementation of IT security regulations has become mandatory for organizations. They entail hundreds of predefined security controls that address numerous risks businesses can be faced with. The process of complying with such regulations is very complex, time- and resource-consuming. Current solutions often focus on data collection from operational systems and miss aggregating employee-generated data for the final reporting of the security status. Therefore, security self-assessments need to be automated to decrease associated costs, IT spending as well as efforts exerted. This paper proposes an integrated flexible and scalable framework to automate self-assessments in combination with security related data collected from IT systems using intelligent agents based on the belief-desire-intention programming paradigm. As a proof of concept, a prototypical solution is created to explain its functionality.