Automation of Security and Privacy Controls for Efficient Information Security Management

摘要

Information security management incorporates both security and privacy controls where security program deals with the security of information and information systems to assure confidentiality, integrity, and availability and privacy programs handle agreement with appropriate confidentiality requirements and problems integrated with personally identifiable information. So, when it comes to the functioning and controlling of any aspect of an organization both controls should be properly implemented. However, the complexity and the scope of organizations with rapidly evolving technology risks make management difficult. To achieve efficiency in implementation and monitoring, controls are required to be managed automatically. It is shown in the paper that 47.8% from NIST Special Publication 800-53 revision 5 [3] recommended controls for high impact systems can be automated. To facilitate automation for rest 52.2% non-automatable controls, it is shown that implementation of compensating controls provides the same degree of security. Moreover, the paper includes examples of tools and applications that support automation of controls and examples of challenges in the automation process.