Use this URL to cite or link to this record in EThOS: http://ethos.bl.uk/OrderDetails.do?uin=uk.bl.ethos.554026
Title: Analysis of information security risks and protection management requirements for enterprise networks
Author: Saleh, Mohamed Saad Morsy
Awarding Body: University of Bradford
Current Institution: University of Bradford
Date of Award: 2011
Availability of Full Text:
Access from EThOS:
Access from Institution:
Abstract:
With widespread of harmful attacks against enterprises' electronic services, information security readiness of these enterprises is becoming of increasing importance for establishing the required safe environment for such services. Various approaches are proposed to manage enterprise information security risks and to assess its information security readiness. These approaches are, however, not adequate to manage information security risks, as all required information security components of its structural and procedural dimensions have not considered. In addition, current assessment approaches lack numerical indicators in assessing enterprise information security readiness. Furthermore, there is no standard approach for analysing cost versus benefit in selecting recommended protection measures. This thesis aims at contributing to the knowledge by developing comprehensive Enterprise Information Security Risk Management (EISRM) framework that integrates typical approaches for information security risk management, and incorporates main components of key risk management methodologies. In addition, for supporting phases of the proposed EISRM framework, analytical models for enterprise information security readiness assessment and cost-benefit analysis are developed. The practical evaluation, using the proposed enterprise information security readiness assessment model has been performed depending on a developed investigation form that used to investigate nine enterprises inside Saudi Arabia. The results demonstrate the effectiveness of the model in assessing and comparing enterprises information security readiness at all levels of the model, using numerical indicators and graphical representations. The EISRM framework and the analytical models presented in this research can be used by enterprises as single point of reference for assessing and cost effectively improving their information security readiness.
Supervisor: Kamala, Mumtaz; Cullen, Andrea J. ; Mellor, John E. ; Bakry, Saad Haj. Sponsor: Not available
Qualification Name: Thesis (Ph.D.) Qualification Level: Doctoral
EThOS ID: uk.bl.ethos.554026  DOI: Not available
Keywords: Information security ; Risk management ; Analytical models ; Protection measures ; ISO/IEC 27002 Standard ; Cost-Benefit Analysis ; Six-Sigma ; Compliance ; Enterprise Information Security Risk Management (EISRM)
Share: