A Methodology for Assessing IS Security Controls

摘要

This paper is a summary of a study that assessed the state of information system (IS) security controls within a South Australian Government Agency. The aim of the study was to ascertain the feasibility of using the GAS methodology (Kiresuk, Smith & Cardillo, 1994) for the evaluation of IS security. The objectives of this study were: 1. To develop an evaluation instrument in accordance with the GAS methodology 2. To use the instrument to evaluate IS security controls within the Government Agency and 3. To analyse the evaluation results and interpret them in a report to management.