Integrated model for the management of the complexity risk and resilience of secure information infrastructure

安全信息基础设施复杂性风险和弹性管理的集成模型

• 批准号: 400156
• 金额: $ 107.14万
• 依托单位: INFORMATION GOVERNANCE LIMITED
• 依托单位国家: 英国
• 项目类别: Collaborative R&D
• 财政年份: 2010
• 资助国家: 英国
• 起止时间: 2010 至 无数据
• 项目状态: 已结题
• 来源: https://gtr.ukri.org/projects?ref=400156
• 关键词: Integrated; model; management; complexity; risk

The iGRC Consortium launched its integrated dynamic risk management operational capability on 15th December 2011. Focused on the protection of critical national infrastructure from cyber attack, the iGRCTM capability combines Infogov’s leading Proteus® Enterprise information security management system with network security related sensor technologies via the Consortium’s open governance, risk and compliance inter-operability protocol, iGRCTM. The demonstration was about handling customer credit card payments in accordance with PCI DSS 2.0. Four scenarios were used: (1) disclosure of card payment details via email, (2) unauthorised system access, (3) unauthorised changes to executable files and (4) system access by ex-employees. The Proteus iGRCTM capability provides accurate understanding of the risk profile, whilst providing: dynamic risk management; insurance for high impact low probability risk events; derivation of security intelligence from the ICT estate; linkage of risk operations to management; exploitation of existing sensor information and verification of risk assessments.

IGRC联盟于2011年12月15日启动了其综合动态风险管理业务能力。IGRCTM功能专注于保护关键的国家基础设施免受网络攻击，通过该联盟的开放式治理、风险和合规性互操作性协议iGRCTM，将Infogov领先的Proteus®企业信息安全管理系统与网络安全相关传感器技术相结合。该演示是关于根据PCIDSS 2.0处理客户信用卡付款的。使用了四种情况：(1)通过电子邮件披露信用卡支付细节，(2)未经授权访问系统，(3)未经授权更改可执行文件，以及(4)前雇员访问系统。Proteus iGRCTM能力提供对风险概况的准确了解，同时提供：动态风险管理；为高影响、低概率风险事件提供保险；从信息和通信技术产业获得安全情报；将风险操作与管理联系起来；利用现有传感器信息和核实风险评估。