A Methodology for Assessing IS Security Controls

摘要

This paper is a summary of a study that assessed the state of information system (IS) security controls within a South Australian Government Agency. The aim of the study was to ascertain the feasibility of using the GAS methodology (Kiresuk, Smith & Cardillo, 1994) for the evaluation of IS security. The objectives of this study were: To develop an evaluation instrument in accordance with the GAS methodology; To use the instrument to evaluate IS security controls within the Government Agency and; To analyse the evaluation results and interpret (hem in a report to management.