Abstract
M.Sc. (Informatics)
Information is power. Any organization must secure and protect its entire information assets. Management is responsible for the well-being of the organization and
consequently for computer security. Management must become and stay involved with the computer security situation of the organization, because the existence of any organization depends on an effective information system. One way in which
management can stay continually involved and committed with the computer security situation of the organization, is by -, the periodic evaluation of computer security. The results from this evaluation process can initiate appropriate actions to increase computer security in areas needed. For effective management involvement, a tool is needed to aid management in monitoring the status of implementing computer security on a regular basis.
The main objective of this dissertation is to develop such a management tool. Basically the thesis consists of three parts, namely framework for effective computer security
evaluation, the definition of the criteria to be included in the tool and lastly, the tool itself.
The framework (chapters 1 to 6) defines the basis on which the tool (chapters 7 to 9) is built, e.g. that computer security controls need to be cost-effective and should aid
the organization in accomplishing its objectives. The framework is based on a two dimensional graph: firstly, tho various risk areas in which computer security should be
applied and secondly, the severity of controls in each of these areas.
The tool identifies numerous risk areas critical to the security of the computer and its environment. Each of these risk areas need to be evaluated to find out how well it is
secured. From these results an overall computer security situation is pictured.
The tool is presented as a spreadsheet, containing a number of questions. The built -in formulae in the spreadsheet perform calculations resulting in an appreciation of
the computer security situation. The results of the security evaluation can be used by management to take appropriate actions regarding the computer security situation.