Um modelo conceitual para especificação da gestão de riscos de segurança em sistemas de informação

• Ano de defesa: 2010
• Autor(a) principal: Kroll, Josiane
• Tipo de documento: Dissertação
• Tipo de acesso: Acesso aberto
• Idioma: por
• Instituição de defesa: Universidade Federal de Santa Maria; BR; Engenharia de Produção; UFSM; Programa de Pós-Graduação em Engenharia de Produção
• Palavras-chave em Português: Gestão de riscos de segurança; Métricas de segurança; Sistemas de informação; Modelagem conceitual; Security risk management; Security metrics; Information systems; Conceitual modeling; CNPQ::ENGENHARIAS::ENGENHARIA DE PRODUCAO
• Link de acesso: http://repositorio.ufsm.br/handle/1/8137

The lack of an alignment among concepts that involve security risk management has caused the stalemate in the adoption of security risks management models for organizations. There are several standards and risk management methodologies, having a large set of concepts, defined in many ways. In order to get an alignment of concepts and establish a suitable vocabulary for risk management, the conceptual modeling was used within the realm of security risks management. By using the conceptual modeling it was possible to abstract concepts and obtain a conceitual model for the specification of security risks management, called GRiSSI - Gestão de Riscos de Segurança de Sistemas de Informação (Information Systems Security Risk Management). Some metrics were also proposed for the identified concepts in the conceitual model, to make further improvements and corrections in security processes. The proposed conceitual model was validated through the application audits and metrics for UML models.