Security Policy Management Process within Six Sigma Framework

Abstract

This paper presents a management process for creating adaptive, real-time security policies within the Six Sigma 6σ framework. A key challenge for the creation of a management process is the integration with models of known Industrial processes. One of the most used industrial process models is Six Sigma which is a business management model wherein customer centric needs are put in perspective with business data to create an efficient system. The security policy creation and management process proposed in this paper is based on the Six Sigma model and presents a method to adapt security goals and risk management of a computing service. By formalizing a security policy management process within an industrial process model, the adaptability of this model to existing industrial tools is seamless and offers a clear risk based policy decision framework. In particular, this paper presents the necessary tools and procedures to map Six Sigma DMAIC (Define-Measure-Analyze-Improve-Control) methodology to security policy management.

Information security policy development and implementation: The what, how and who

“…The existing literature highlights certain information security policy development and implementation methods (Anand, 2012;Bayuk, 2009), but these methods do not include a comprehensive, integrated method that details step-by-step processes. Accordingly, this paper aims to find a solution to the problem of the Information Security Policy Development Life Cycle (ISPDLC) in order to address the challenges that have been highlighted in this section.…”

On the cost of cyber security in smart business

“…Related work in [10] and [11] has developed research results about improving the service quality using Six Sigma. In contrast to that the work in [12] presented a management process for "Security Policy Management" within the Six Sigma framework. In [13] Chen & Sion present solutions of how to protect data and guarantee security in the public cloud.…”

Review of Information Security Policy based on Content Coverage and Online Presentation in Higher Education

“…The literature underlines a number of information security policy development process and implementation methods [1], although these methods do not offer a comprehensive and integrated method that includes a step-by-step guideline [9].…”