A process model design and tool support for information assets access control using security patterns

Abstract

Information assets such as customer information, business transaction, and contract transaction data are important for the organization as these assets affect business value and operation. Therefore, to manage information assets, the organization needs to establish the security system, one of the non-functional requirements, to control the resource accessibility. The security patterns provide practices for formal security process establishment which could be applied to assets access control. However, the security patterns explanations are specific but an applying has to define process operation in details. This research proposes a design of process model for Information Assets Access Control (IAAC) using security patterns. In addition, the proposed process model also uses ISO/IEC 27001:2005 and ISO/IEC 27002:2005 as a fundamental framework. The supporting templates are also designed to support the proposed process model.