Automated Compliance Checking Methodology for Non-Log Operations

Abstract

Compliance Management (CM) is the management process that an organization implements to ensure organizational compliance with relevant requirements and expectations. The most complicated, time-consuming, and costly process in CM is compliance checking because it requires a person who has a good knowledge in policy to examine whether the current operations meet the policy requirements. Many researchers have tried to study better ways to automate the compliance checking process, but most of them require the operation logs in to the computer systems. This paper proposes a methodology to enable the automation of compliance checking for those operations that have no log in computer systems by using questions and answers principle to cooperate with the semantic web technologies. Since there are some operations that cannot be understood by computer systems, using questions is one way to gather the answers, such as operation log to evaluate their compliance. The proposed methodology can help noncertified auditors perform the compliance checking so that the time and cost of compliance checking would be greatly reduced.

A Survey of Security Assessment Ontologies

“…: Risk Management, Security Policies; Incident Analysis; Attack Patterns, Performance Tests; Expert Systems Tests, etc.). Works which aim to describe domains and sub-domains are the following: [11]; [12]; [13]; [14]; [15,16]; [17]; [18]; [19]; [20]; [21]; [22]; [23]; [24]; [25]; [26]; [27]; [28]; [29]; [30]; [31]; [32]; [33]; [34]; [35]; [36]; [37]; [38]; [39]; [40]; [41]; [42]; [43]; [44]; [45]; [44]; [8]; [46]; [47].…”

“…Table 1 presents the keywords and the search string. [11]; [12]; [13]; [14]; [15,16]; [17]; [18]; [19]; [20]; [21]; [22]; [23]; [24]; [25]; [26]; [27]; [28]; [29]; [30]; [31]; [32]; [33]; [34]; [35]; [36]; [37]; [38]; [39]; [40]; [41]; [42]; [43]; [44]; [45]; [44]; [8]; [46]; [47]. Generic and abstract proposals (Top-Level Ontologies) can be found in [48], [3], [49], [50], and [51].…”