ESRML-ST: A Language for Specifying Spatio-temporal Information Security Requirements of Enterprises

Dependence of enterprises on Information Technologies gives rise to the need for effective information security management. It is essential to manage risks relating to the confidentiality, integrity and availability of assets in an enterprise. Even a medium-sized enterprise contains a huge number of assets, and diverse access-control requirements, along with spatio-temporal aspects. Moreover, risks evolve rapidly in today´s connected digital world. The proper management of information security, therefore, requires automation of the various monitoring, analysis, and control processes. This can be best achieved by representing information security requirements of an enterprise in a standard, structured format. This paper presents such a structured format in the form of Enterprise Security Requirement Markup Language with Space-Time extension (ESRML-ST). It is an XML-based language that considers the elements of ISO 27002:2005 and 27005:2011 standards.