A remote IT security evaluation scheme: a proactive approach to risk management

Author

Kondakci, Suleyman

Author_Institution

Fac. of Comput. Sci., Izmir Univ. of Econ.

fYear

2006

fDate

13-14 April 2006

Lastpage

102

Abstract

We present a new model to conduct security evaluation of remote assets with dedicated profiles. An alternative approach to risk management in information assurance (IA) and a related protocol for remote evaluation of information assets is presented here. Application of this protocol ensures long-term risk management, hence efficient proactive lifecycle protection of critical information systems. Due to its generic and interoperable structure based on the modern Web technologies, the protocol can be applied to risk assessment and evaluation of a multitude type of systems. The protocol consists of a secure communication architecture associated with each asset a security profile, and software services and agents that communicate over the Internet and other open networks. The secure communication architecture uses a secure exchange protocol incorporating the fast elliptic curve cryptography. Interoperable, continuous, inexpensive, time- and location-neutral, and minimum resource usage are some of its advantages. With this new notion, we also aim at inspiring developers and researchers to develop value-added security evaluation tools, techniques and procedures

Keywords

cryptography; information systems; open systems; protocols; risk management; software agents; Internet; Web technologies; fast elliptic curve cryptography; information assets; information assurance; information systems; open networks; proactive approach; proactive lifecycle protection; remote IT security evaluation scheme; remote assets; risk management; secure communication architecture; secure exchange protocol; security profile; software agents; software services; value-added security evaluation tools; Communication system security; Computer architecture; Cryptographic protocols; IP networks; Information security; Intelligent agent; Management information systems; Protection; Risk management; Web and internet services; Proactive IA; Verification and validation of security; remote assessment; risk analysis and security management; security evaluation; security protocol.;

fLanguage

English

Publisher

ieee

Conference_Titel

Information Assurance, 2006. IWIA 2006. Fourth IEEE International Workshop on

Conference_Location

London

Print_ISBN

0-7695-2564-4

Type

conf

DOI

10.1109/IWIA.2006.1

Filename

1610002