A Framework for the Management of Information Security

Information security is based on access control models and cryptographic techniques These are well established areas of research in computer security but are not capable of supporting development of comprehensive information security within organizations There is a need to study upper level issues and to provide with organizational mechanisms to identify security enforcement mechanisms and specify policies that coordinate these mechanisms This paper summarizes one such framework and identi es major components and critical success factors of the approach