2009 Proceeding- Program Chairs:
- Sushil Jajodia,
- Michiharu Kudo
- Sponsor:
- sigsac
It is our great pleasure to welcome you to the 1st ACM Workshop on Information Security Governance (WISG'09). The goal of this workshop is to establish a framework to drive implementation of effective information security strategies in organizations involving risk management, reporting, and accountability. Recent changes in business environment such as outsourcing, global supply chain, and cross organizational collaborations are forcing users to access and retrieve business data across organizational boundaries. This is making data governance in enterprise intractable. In addition, since emerging IT infrastructure such as cloud computing calls for storing enormous amount of confidential and sensitive information, it is imperative that these data must be appropriately handled according to the agreements. These new disruptive trends will greatly change the notions of the information security governance calling for more fine-grained, data-centric, and risk-adjusted governance models with the innovative implementation technologies.
The call for papers attracted sixteen submissions from Asia, Europe, and the United States. The program committee accepted five full papers and three short papers that cover the compliance, governance, security risk, security policy and privacy issues.
Proceeding Downloads
Information security governance framework
Many companies, especially Japanese companies, have implemented information security with bottom up approach, starting from implementing piece by piece security controls. As increase the number of information security incidents and spread its impact, ...
A method of calculating the cost of reducing the risk exposure of non-compliant process instances
A method is introduced to measure the risk of being non-compliant and the cost of reducing the risk by performing internal audits with the help of automated audit tools. Risk exposure of a business process is defined in terms of the prevalence of non-...
Model driven security accreditation (MDSA)for agile, interconnected it landscapes
Assurance accreditation of agile, interconnected IT landscapes is a great challenge, and is currently often cited as one of the show-stoppers for the adoption of modern IT architectures (e.g. agile, model-driven, process-led SOA and Cloud) in mission ...
Strengthening employee's responsibility to enhance governance of IT: COBIT RACI chart case study
The ongoing financial markets debacle and the global economic context advocate enhancing the governance of the companies and, de facto, improving the elaboration and the understanding of employees' responsibilities. Furthermore, the moral aspects of the ...
GoCoMM: a governance and compliance maturity model
Advanced methodologies for compliance such as CobiT identify a number of maturity levels that must be reached: first the existence of an infrastructure for the enforcement of security controls; second, the ability to continuously monitor and audit ...
Dynamic security policy learning
Recent research [12] has suggested that traditional top down security policy models are too rigid to cope with changes in dynamic operational environments. There is a need for greater flexibility in security policies to protect information appropriately ...
An XACML-based privacy-centered access control system
- Claudio Agostino Ardagna,
- Sabrina De Capitani di Vimercati,
- Stefano Paraboschi,
- Eros Pedrini,
- Pierangela Samarati
The widespread diffusion of the Internet as the platform for accessing distributed services makes available a huge amount of personal data, and a corresponding concern and demand from users, as well as legislation, for solutions providing users with ...
Security risk management using internal controls
Rather than treating security as an independent technical concern, it should be considered as just another risk that needs to be managed alongside all other business risks. An Internal Controls approach to security risk management is proposed whereby ...
Index Terms
Proceedings of the first ACM workshop on Information security governance