CAF METHODOLOGY USAGE FOR MANAGEMENT OF THE INFORMATION SYSTEMS PROTECTION

摘要

Protection of critical infrastructures that are dependent on information systems becomes very actual in United States as well as in Europe. To achieve appropriate managerial control over this very complex issue is difficult and requires in depth oriented analysis of information system risk environment. Significant improvement of information systems protection is seriously limited by existing gap between architecture modeling and risk analysis and management. This gap has negative impact to final security protection strategy, which is designed on the base of risks identified during risk analysis stage. This article presents new approach to overcome this gap. We developed new methodology - CAF and set of tools that automate and synchronize both modeling processes. We briefly demonstrate some examples how this approach can be applied as a integral part of service delivery optimization.