Physical and logical Security Risk Analysis model

摘要

This paper describes the problem of carrying out a physical and logical Security Risk Analysis for an enterprise or Administration organism, considering the management and treatment of both kinds of risks by a new Security department that sprang from the convergence of the old physical and logical Security departments. This paper presents a Risk Analysis methodology that makes it possible to comply with the ISO 31000 standard (for physical security) and ISO 27001 standard (for logical security) methodologies, analyzing simultaneously both information and physical assets treatment processes. The paper will focus on the basis and steps followed by the method, and the relation between them and the AS/NZS 4360 standard. This methodology has been successfully used on industrial installations and various buildings.