Assessment of organization’s information security on the criterion of confidence

Abstract

Currently, the protection of information remains a pressing issue, and the most common approaches to its assessment are verification and risk-oriented method. However, the information security metrics in the relevant methodologies based on these approaches are insufficiently informative, since they take into account only objective aspects of security, completely ignoring the subjective ones. Therefore, they do not allow the development of judgments based on the state of confidentiality, integrity and availability of information and the organization’s information security level as a whole. For that reason, there is a necessity to develop a methodological apparatus for assessing the organization's information security, taking into account objective and subjective aspects of security. The article proposes the approach to assessing information security on the basis of the criterion of confidence that an organization implements its adopted security policy. Assessment of confidence includes assessment of the credibility of organization’s information security, the quality of the trust assessment model and the background of the persons who conducted such an assessment and knowledge assessment regarding threats. As an indicator of confidence, the utility indicator is used as the value of the generalized Harrington’s desirability function. The proposed approach to assessing the organization's information security is fairly simple to be implemented and can be used as a pilot to develop appropriate methods for assessing the security of organizations of various forms of ownership.