Enterprise Information Security Management Based on Context-Aware RBAC and Communication Monitoring Technology

Abstract

Information technology has an enormous influence in many enterprises. Computers have not only become important devices that people rely on in their daily lives and work, but have also become essential tools for enterprises. More and more enterprises have shifted their focus to how to prevent outer forces from invading and stealing from networks. However, many enterprises have disregarded the significance of internal leaking, which also plays a vital role in information management. This research proposes an information security management approach that is based on context-aware role-based access control (RBAC) and communication monitoring technology, in order to achieve enterprise information security management. In this work, it is suggested that an enterprise may, first, use an organizational chart to list job roles and corresponding permissions. RBAC is a model that focuses on different work tasks and duties. Subsequently, the enterprise may define a security policy to enforce the context-aware RBAC model. Finally, the enterprise may use communication monitoring technology in order to implement information security management. The main contribution of this work is the potential it provides to both reduce information security incidents, such as internal information leakage, and allow for effective cost control of information systems.

A Framework for Context Sensitive Risk-Based Access Control in Medical Information Systems

“…First, there are various emergency situations in medical environments, and it is crucial to respond to such situations promptly [ 10 ]. Therefore, the situation must be taken into consideration when deciding access permissions, and access decisions should change, depending on the severity of the situation [ 11 ]. Second, MISs store sensitive data, such as personal information and medical records, and information leakages in this field are likely to result in egregious violations of patient confidentiality.…”

Towards Modelling the Impact of Security Policy on Compliance

“…Monitoring can be achieved through logging, observing, and recording a person's behaviour. New information equipments are available to help security personnel and system administrators enforce and monitor information security policies (Mei-Yu & Ming-Hsien, 2013). The devices are technical methods that can provide backup, logging, blocking and monitory functions.…”

“…The devices are technical methods that can provide backup, logging, blocking and monitory functions. Communication monitoring technologies can filter, record, or block suspected activities in order to reduce the occurrence of security incidence (Mei-Yu & Ming-Hsien, 2013). Logging of data is important for monitoring and forensics purposes and should include network traffic monitoring.…”