Deep Structures of Information Systems Security

Companies tend to adopt security approaches that align with some subset of the four categories of IS security techniques checklists, risk analysis, formal methods and soft modeling. To develop a structure of secure IS that upholds confidentiality, integrity and availability of information there remains a need for an integral security model that incorporates the benefits of other security designs outside the chosen ones. Organizations demand security models that cater to their unique operational characteristics. The paper uses the deep-structure model of Wand and Weber (1990) to help reveal the deep structure characteristics of IS security using three models representational model identifies subsystems within an organization; statetracking model ensures security changes trace real world security system changes; and decomposition model defines specific external events that are stimuli to changes on internal events. A conceptual security model is presented that manifests the meaning of dynamic, custom-fit and flexible IS security structure which also incorporates features from checklists, risk analysis, soft modeling and formal methods.