Information security evaluation methods ABSTRACT FOR THE 1 SWEDISH IT SECURITY NETWORK FOR PHD STUDENTS SEMINAR, 2-3 APRIL 2001, IN SUNNE

Abstract: The starting point of the study presented here was to scan the literature for information security evaluation methods. The “unit of evaluation” and whishedfor application situation is identified for each of the methods, and these are classified in a basic model. The aim is to support information security practitioners and researchers in their selection of evaluation methods by means of investigating and clarifying in which situation each method can be employed. Those of the surveyed methods that are considered suitable for evaluation of the organisational aspects of information security are examined further. A brief comparative analysis is performed to identify similarities and differences, aiming to make explicit notable differences in methodological approach.