Um modelo conceitual para especificação da gestão de riscos de segurança em sistemas de informação

• Autor(a) principal: Kroll, Josiane
• Data de Publicação: 2010
• Tipo de documento: Dissertação
• Idioma: por
• Título da fonte: Manancial - Repositório Digital da UFSM
• Texto Completo: http://repositorio.ufsm.br/handle/1/8137
• topic: Gestão de riscos de segurança; Métricas de segurança; Sistemas de informação; Modelagem conceitual; Security risk management; Security metrics; Information systems; Conceitual modeling; CNPQ::ENGENHARIAS::ENGENHARIA DE PRODUCAO

The lack of an alignment among concepts that involve security risk management has caused the stalemate in the adoption of security risks management models for organizations. There are several standards and risk management methodologies, having a large set of concepts, defined in many ways. In order to get an alignment of concepts and establish a suitable vocabulary for risk management, the conceptual modeling was used within the realm of security risks management. By using the conceptual modeling it was possible to abstract concepts and obtain a conceitual model for the specification of security risks management, called GRiSSI - Gestão de Riscos de Segurança de Sistemas de Informação (Information Systems Security Risk Management). Some metrics were also proposed for the identified concepts in the conceitual model, to make further improvements and corrections in security processes. The proposed conceitual model was validated through the application audits and metrics for UML models.