Information Security Risk Management in a World of Services

Vincent Lalanne (1) , Manuel Munier (1) , Alban Gabillon (2)

1 LIUPPA - Laboratoire Informatique de l'Université de Pau et des Pays de l'Adour
2 GePaSUD - Géopôle du Pacifique Sud

Service Oriented Architectures (SOA) offer new opportunities for the interconnection of systems. However, for a company, opening its Information System to the "world" is not insignificant in terms of security. Whether to use available services or provide its own services, new technologies have introduced new vulnerabilities and therefore new risks. Our work aims to propose an approach for risk management which is based on the ISO/IEC 27005:2011 standard: we propose a development of this standard (by an extension of Annex D) so that it can fully take into account the type "service" as web services and cloud services. Indeed, a world of services is not limited to link interconnected systems, it is more a relationship between customer and supplier, where notions of trust, accountability, traceability and governance are developed. Following this study we introduce a new security criterion, controllability, to ensure that a company keeps control of its information even if it uses such outsourced services.

Mots clés: IEC standards; ISO standards; cloud computing; information systems; security of data; service-oriented architecture; ISO/IEC 27005:2011 standard; SOA; accountability; cloud services; controllability; customer supplier relationship; governance; information security risk management; information system; link interconnected systems; outsourced services; security criterion; service oriented architectures; system interconnection; traceability; trust; Risk management; Simple object access protocol; ISO/IEC 27005; cloud; information security; web services

Domaines: Cryptographie et sécurité [cs.CR]

Vincent Lalanne, Manuel Munier, Alban Gabillon. Information Security Risk Management in a World of Services. ASE/IEEE International Conference on Privacy, Security, Risk and Trust (PASSAT 2013), Sep 2013, Washington D.C, United States. pp.586-593, ⟨10.1109/SocialCom.2013.88⟩. ⟨hal-01020244⟩