NCJ Number
102817
Date Published
1986
Length
6 pages
Annotation
This paper describes a structured (layered) approach to risk analysis and links it to Nolan's stage model for computing evolution in organizations.
Abstract
Computer security is a global objective that incorporates several subobjectives or attributes. An indepth analysis of the concept of computer-security factorings points out its major components: reliability, integrity, vulnerability, confidentiality, and privacy. These attributes can be arranged in a recurring and abstract definition of computer security in the formula of an inclusive chain. This inclusive specification minimizes conflicts among attributes, including internal security conflicts (those among access control measures), personal security of personnel, and conflicts among data integrity (backup copies) and confidentiality (multiple copies of protected data). By applying appropriate definitions to security attributes, it is possible to map each attribute onto a corresponding stage of Nolan's model. Thus, the development of information systems is isomorphic to the particular aspect of their security for the stages of initiation, contagion, control, integration, and data administration. Only Nolan's final stage (maturity) requires redefinition of the security concept in terms of security engineering as a solution to external security conflicts arising from concurrent access and deadlock. 2 figures and 5 references.