Document Type : Research Paper
Authors
1
M.Sc. from Alzahra University , Tehran, Iran
2
Department of Management, Faculty of Social Sciences and Economics, Alzahra University, Tehran, Iran Corresponding Author: m.ranjbarfard@alzahra.ac.ir
3
lecturer at Alzahra University
Abstract
In this research, an expert system was designed and implemented based on the ISO/ICE27001 standard. In order to create the knowledge base of this expert system, control goals and criteria for evaluating these goals were extracted based on the ISO/ICE27001 standard, and the necessary information was collected to define the rules. Then, the approach of creating rules as well as the rules were confirmed through interviews with experts. The control objectives and evaluation criteria of the control objectives were using the Dematel technique along with the Dalala formula and WASPA method. In the next stage, the five main security objectives were chosen to continue the work due to their emphasis in the research literature. The specified goals were reviewed and confirmed during face-to-face interviews with experts. After designing the expert system, Visual Basic was used to implement the user interface and Excel 2016 was used for inference. The designed system is able to calculate the information security score according to the standard and also is able to calculate the information security score by applying the weight of the control objectives, the evaluation criteria of the control objectives and the percentage of realization of the main objectives of the information security. The resulted score is shown in three levels of critical status, average status and very good status to the user. Results of the system implementation in two Iranian organizations showed that the system with an average accuracy of 95% has the necessary accuracy and efficiency to evaluate information security.
Introduction
Information is a vital element for the survival of the organization and information security plays a decisive role in modern information organizations. Many organizations use successful global standards such as ISO/ICE27001 to ensure success in implementing and evaluating their information security management system. Organizations can become aware of the state of information security with the lowest cost and highest efficiency by using the intelligent information security audit system. In this research, an expert system with hierarchical coefficients to calculate the organization's information security score based on the ISO/ICE27001 standard was designed and implemented: considering the importance of control goals and evaluation criteria for these goals, as well as calculating the degree of achievement of the main security goals. In the design of this system, unlike other audit expert systems, the importance of information security evaluation criteria has not been considered equal. This system can be used in various organizations and industries for intra-organizational evaluations of information security status and determining corrective measures. Organization with ISO/ICE27001 certification can also use this system as an alternative to traditional audits to increase efficiency and reduce time and cost.
Literature review
ISO 27001 information security management standard
Information security management standards provide a security framework along with specialized techniques for implementing security in the information exchange space. The ISO 27001 international standard was prepared to provide requirements for the establishment, implementation, maintenance and continuous improvement of an information security management system (Chang and Lee 2013).
The ISO 27001 standard has been able to provide a complete form of security processes and controls for the organization (Wallhoff 2004). Referring to the capabilities of various information security standards shows that ISO 27001 is a leader compared to other standards, especially in the field of information security management systems; (Susanto, Almunawar, and Tuan 2011).
Intelligent information security audit systems
An expert system uses human knowledge to solve problems that normally require human intelligence. Expert systems are designed in such a way that they acquire the intelligence and information available in the minds of experts and provide this knowledge to other members of the organization with the aim of solving problems. The main components of an expert system are its knowledge base and inference engine. The knowledge base contains the necessary knowledge to understand, explain and solve the problem, and it is the inference engine of the brain of the expert system that determines its reasoning method (Tripathi 2011).
Research Question(s)
What are the control goals and evaluation criteria of the information security evaluation expert system?
What is the appropriate architecture of the expert system with coefficients to evaluate the organization's information security?
How are the goals and control security evaluation criteria determined?
How is the main security goal determined for each control?
What is the method of inference in the expert system of evaluating the organization's information security?
Does the designed system have the necessary credibility to measure the organization's information security?
Methodology
This research is applied-developmental in terms of purpose, because by using the ISO 27001 international standard and in order to improve and perfect the strategies, behaviors, methods, tools, devices, structures and patterns used by the organization. has designed the audit expert system. Also, the research is descriptive in terms of data and its strategy is design.
In order to create the knowledge base of this expert system, control goals, criteria for evaluating these goals and recommendations were extracted based on the ISO/ICE27001 standard, and the necessary information was collected to define the rules. Then, the approach of creating rules as well as the rules were confirmed through interviews with experts. The necessary information for ranking the control objectives and evaluation criteria of the control objectives was collected through a questionnaire and the weight of the control objectives and criteria was calculated using the Dematel technique along with the Dalala formula and WASPA method. In the next stage, the five main security objectives: authenticity, confidentiality, availability, accountability and auditability were chosen to continue the work due to their emphasis in the research literature. After determining which of the main security goals each control is aimed at, the specified goals were reviewed and confirmed during face-to-face interviews with experts. Then, using the information of these four stages, an expert system was designed to evaluate information security based on the ISO/ICE27001 standard. Visual Basic was used to implement the user interface and Excel 2016 was used for inference.
Discussion
In this research, the control objectives and information security evaluation criteria are extracted from the ISO 27001 standard, and the checklist used is completely in accordance with the standard, and the system has calculated the organization's information security score based on the standard. In addition, compared to previous researches, the presented system has special innovative aspects. The ranking of standard control goals and criteria has been done according to the opinion of experts, and the information security score has also been calculated by taking into account the weight of control goals and evaluation criteria. In addition, the main objectives of information security for each recommendation (control) have been determined according to the opinion of experts, and the designed system has also evaluated the degree of realization of the main security objective in the organization.
It is worth mentioning that the method of assigning points to each control is based on interviews with security auditors in Iran, and the structure of the ISO 27001 standard does not specify a specific method for scoring, which has an impact on the creation of rules and the efficiency of the expert system.
Results
The designed system is able to calculate the information security score according to the standard and also is able to calculate the information security score by applying the weight of the control objectives, the evaluation criteria of the control objectives and the percentage of realization of the main objectives of the information security. The resulted score is shown in three levels of critical status, average status and very good status to the user. Results of the system implementation in two Iranian organizations showed that the system with an average accuracy of 95% has the necessary accuracy and efficiency to evaluate information security.
Keywords:Information Security Management System, Expert System, ISO27001 International Standard, Dematel Technique, Dalala Formula, WASPAS Method
Keywords
Subjects
