In this paper we present an approach for specifying and prioritizing information security requirements in organizations. It is important to prioritize security requirements since hundred per cent security is not achievable and the limited resources available should be directed to satisfy the most important ones. We propose to link explicitly security requirements with the organization's business vision, i.e. to provide business rationale for security requirements. The rationale is then used as a basis for comparing the importance of different security requirements. A conceptual framework is presented, where the relationships between business vision, critical impact factors and valuable assets (together with their security requirements) are shown.
The increasing concerns of clients, particularly in online commerce, plus the impact of legislations on information security have compelled companies to put more resources in information security. It is clear that senior managers in many organizations are now expressing a much greater interest in information security. Understanding and specifying what kind of security an organization need is however a difficult task. Many underlying goals (why and what security is needed) remain tacit within organizations and requirements end up being articulated as specifications of the security control baseline (how security will be achieved) without a clear rationale. The problem becomes more urgent when more and more organizations are involved in collaboration and commerce. Being able to articulate security goals and requirements consistently, based on an accurate view of existing security capabilities, and using shared understandings, becomes much more important. Networked business will be difficult to function if the organizations involved cannot agree: why security is necessary; the scope it should cover and what each organization expects it to achieve.
The complexity of undertaking an enterprise-wide view of security management can be illustrated in the challenges facing chief security officers (CSO). Often CSOs are tasked with ”securing” the organization, but it may not be clear what that means. As a result, the CSO is often left to answer very important organization questions without specific guidance: What needs to be secured? Why, and in what priority? How to ensure that people agree on the above issue? How will I know when the organization has been ”secured”? What will be used to measure success?
We believe that to answer the above questions, it is necessary to link the security requirements with the organization’s unique business drivers. E.g., for a production company, the availability of its production control system is of vital importance, whereas for a financial service provider, it is important to protect the integrity of its financial transactions. The reason of making explicit the business rationale behind security requirement is twofold. Firstly, different organizations have different business drivers, which in turn determine their different requirements to security. Secondly, since hundred per cent security is not achievable and the limited resources available should be directed to satisfy the most important ones, we need a way to prioritize security requirements. The business rationale serves as the underlining criterion for evaluating how important each security requirement is. It is our intention in this paper to develop techniques and instruments to help stakeholders articulate the connection between security requirements and the business drivers in a systematic way. Further, we shall use the rationale to prioritize security requirements. 2
A security requirement specification tells what should be secured and why. It identifies the organizations’ needs with respect to security. Consider, for example, the differences between the needs of a university and that of a cryptographic organization. The university fosters scholarship and open research: papers, discoveries, and work are available to the general public as well as to other academics. The cryptographic organization, on the other hand, prizes secrecy. The university will need to protect the integrity and confidentiality of the data, such as grades, on its systems. It might also want to ensure that the system is available via the Internet so that students, faculty, and other researchers have access to information. The cryptographic organization, though, will emphasize confidentiality of all its work.
When an organization wants to secure its system, it must first determine what requirements to meet. Given that organizations normally have limited resources to protect its assets, it is equally important to determine which requirements are more important and thus should be prioritized. To achieve this, we propose to use a conceptual framework where security requirements are linked to the unique business drivers of the organization in question. Figure 1 portrays the conceptual framework. The business vision consists of high level business goals the organization has. Critical Impact Factors (CIFs) identify what will be the business impacts if security requirements are violated. Valuable assets and their security requirements are inventories of security requirements. Valuable assets and their security requirements have an effect on the CIFs and the CIFs in turn impact the accomplishment of the organization’s business vision. In other words, we can use an organization’s business vision to prioritize the CIFs, which can be used to further prioritize the security requirements. To achieve that, three subsequent steps need to be taken. Firstly an organization’s CIFs and business vision need to be defined. Secondly, we need to enumerate valuable assets and their security requirements. Thirdly, security requirements shall be linked with CIFs and business vision. We will discuss them in detail.
impact prioritize Business vision
Critical Impact Factors impact prioritize
Valuable assets
and their security
requirements
Each organization has its own unique business vision that defines the very
principles of how the business wants to achieve its goals. This vision, moreover,
often changes over time to reflect changing circumstances. Notwithstanding this
diversity, scholars in business administration have identified certain “patterns”
in the business vision of leading firms. In this paper, we use the well-known
value disciplines identified by Treacy and Wiersema [
Treacy and Wiersema argue that there are three generic ways a business can differentiate itself from the competitors, which they call operational excellence, customer intimacy, and product leadership. Each of these three value disciplines aims at creating distinguishing value for customers, but each does so in a different way. A company striving for operational excellence focuses on offering its products with the least amount of hassle possible (usually, at the lowest cost) to its customers. A customer intimacy company aims at delivering exactly what its customers want by investigating the needs of a narrow market and then customizing its offerings to this market. Finally, a product leader aims at delivering radically innovative products that create an unbridgeable gap with the competition.
Each of the three value disciplines leads to a radically different operating model for the company: the culture, processes, management systems and IT systems of the company. For instance, while operational excellence calls for highly standardized business processes, the customer intimacy discipline requires just the opposite: to meet customer requirements, business processes should be as flexible as possible. Security requirements should be likewise aligned with the requirements imposed upon culture, processes and management systems by the value discipline chosen.
When security incidents happen, they may lead to damage to organizations. Critical impact factors are the indicators of what kind of damage the security incidents incur to the organization. They can include those within the control of the organization (e.g. loss of productivity), as well as that the organization may not be able to fully control (e.g., legal liability, and reputational damage). We do not provide any explicit guidance for developing organization’s CIFs in this paper. However, experienced executives and security officers generally identify some CIFs because they are part of their management domain. Other sources for identifying CIFs could include industry specific CIFs or reviews of peer CIFs if available. Figure 2 illustrate an example list of critical impact factors.
CIF financial loss
loss of productivity reputation damage
legal liability
The business vision can be used to guide the selection of valuable assets. Surely, the assets that are critical for accomplishing the business vision are the valuable ones for the organizations. For example, a financial service company that focuses on customer intimacy will consider its customer relationship management (CRM) systems as extremely valuable, while a financial service company that focuses at product leadership will likely value its systems for developing new financial products even higher.
Information security is about defining encompassing systems and procedures
designed to ensure the confidentiality, integrity and availability3 of an
organization’s critical information and technical assets [
So, IT security is about safeguard certain desired properties. The core of
computer and information security is widely regarded as the preservation of three
factors: confidentiality (ensuring that information is accessible only to those
authorized to access), integrity (safeguarding the accuracy and completeness
of information and processing methods) and availability (ensuring that only
authorized users have access to information and associated assets when required)
[
asset 1..n has 1..n security
property information asset technical asset process data account computer component network confidentiality To further elaborate the relations between security requirements and the business vision, the connection between them can be established via the linkage of CIFs. Figure 4 provides an example of such linkage for a production company. In this example, the organization is stating that any compromise to ”availability” of the ”control system” has ”critical impact” to ”loss of productivity”, which in turn has ”critical impact” to the organization’s vision ”improve operational efficiency”. The impact severity can be categorized according to the organization’s needs. An example categorization can be critical impact, marginal impact, and negligible impact. In this way, each security requirements can be connected to its CIFs and the CIFs further to business vision.
Using the impact diagram like figure 4, it is possible to categorize and
prioritize the different security requirements. Requirements that have ”critical
impact” on CIFs, that in turn have ”critical impact” on business vision, should be
4 Firesmith provides a list of security properties in his work [
asset
... control system confidentiality financial loss
loss of productivity reputation damage critical impact legal liability ...
business vision improve operational
efficiency critical impact managing financial
resources comply with law and regulation ... considered of most importance. These requirements shall be satisfied first if the resources (time, money, manpower etc.) are limited. In this example, it means that, for the production company, it is more important to mitigate threats to the control system’s availability than for instance, threats to the control system’s confidentiality. It is possible that one requirement may be linked to more than one CIFs. When that happens the overall significance of that security requirement can be determined in a number of ways. For example, one can choose the maximum impact level, e.g. if control system’s availability not only has ”critical impact” on loss of productivity but also has ”marginal impact” on reputation damage, the overall impact should be ”critical impact”. Alternatively, one can choose the average impact level. The organization shall decide which combination methods best reflects its situation.
The reason why we use CIFs to link critical assets and their security requirements with business vision is twofold. The business vision typically resides at the strategic level. When the business vision is outlined, the stakeholders do not normally have a security focus in mind. The Critical Impact Factors on the other hand, reflect the business implication when security is compromised. It is of course possible to directly connect assets’ security requirements to the business vision. But then the shift of focus from purely technical level security concerns to strategical level business concerns seems abrupt. The introduction of CIFs makes the shift smooth and the line of reasoning easier to follow.
Once the requirements are categorized and prioritized, other techniques, like attacks trees or misuse cases can be used to explore all possible threats and attack paths that would lead to the violation of security properties. In this example, it is to find out how the control system’s availability can be compromised. Our approach is complementary to this line of work, in the sense that we provide a business-grounded rationale for why certain security requirements are important while others are not. 2.5
A common way used in practice to get a very high-level specification and
prioritization of security requirements is categorizing every IT asset or project on
two dimensions [
There exist a number of security standards, among which COBIT (Control
Objectives for Information and related Technology) [
Our approach is also related to the work of security requirement modeling
[
The ISO 17999 standard on information security requires an organization to protect information from a wide range of threats to ensure business continuity, minimize business damage, and maximize return on investments and business opportunities. It is clear from this requirement that information security is ultimately about business security. In this paper, we have argued the necessity of making explicit the link between security requirements and the organization’s business drivers. Furthermore we have proposed a conceptual framework to that aim. The three main elements of our framework are business vision, CIFs and valuable assets and their security requirements. The connection between business goals and security requirements, once established, can be used to provide rationale for prioritizing security requirements. A number of issues will be addressed further in the future. An in-depth case study with a dutch government agency will reveal to what extend our approach addresses practical issues. We need to define guidelines that help the creative process of coming up with a proper set of CIFs. Also in the face of contradicting business visions, proper guidelines should be given on how to combine the results.
We thank professor Roel Wieringa and dr. Raimundas Matulevicius for their valuable comments.