Security Evaluation supported by Information Security Mechanisms

Information security plays a key role in protection of organization’s assets. There exist a number of standards and guidelines providing huge lists of security controls that, if properly used, might be useful against cyber threats. However, these standards leave the process of controls selection to the organizations. Security manager has to carry out a decision on implementation of security controls. Deciding which controls should be encompassed and which bypassed could be tough and indeterminate, since different sources usually prefer another solutions. This work presents motivation for using metrics as an instrument for a risk analysis. The main goal of this work is to define proper security evaluation model for an organization, based on the score of security mechanisms. We present a mathematical model of evaluation, which minimizes subjectivity in this process and it should lead to more automatized risk analysis and make the results of the analysis more comparable. Our work is based on the ISO/IEC 27002 standard on which is built our evaluation model.