A STOPE model for the investigation of compliance with ISO 17799‐2005

Abstract

Purpose -With the widespread of e-services, provided by different organizations at the internal intranet level, the business extranet level, and the public internet level, compliance with international information security management standards is becoming of increasing importance for establishing a common and safe environment for such services. The purpose of this paper is to examine the development of a mathematical model that enables the investigation of compliance of organizations with the widely acknowledged international information security management standard ISO 17799-2005. Design/methodology/approach -The model is based on the strategy, technology, organization, people and environment -STOPE -framework that provides an integrated well-structured view of the various factors involved. The paper addresses the use of the model for practical investigations; it describes a practical example illustrating possible practical results. Findings -The results show the strengths and the weaknesses of compliance, with the standard, at different levels: from the level of the measures associated with each of the "131" standard protection controls, up to the level of the STOPE domains. Originality/value -The paper addresses the use of a mathematical model for practical investigations of compliance with the international information security management standard.

Management of Technical Security Measures

“…These studies were primarily targeted to internet users' behavior towards the adoption of technical security measures and items have already been empirically validated. The compliance measure was developed in reference to prior literature from Ma and Pearson (2005) and Saleh et al (2007), who based their works on ISO 17799:2005 (which has been revised and renamed to ISO 27002). All constructs were measured reflectively with either positive…”

Generating Citizen Trust in E-Government Security

“…A model for the representation of the compliance of an e-government with the ISO 17799-2005 standard is being developed by Bakry (2004). Recent work has identified hundreds of control measures (257) associated with evaluation of the use of security controls (133) in a single security standard which has 39 objectives (Saleh et al, 2006). The first aim of the research will be to relate these to features that a user can understand in evaluating the security of a site through the use of questionnaires to elicit the required information about a site.…”