Semantic integration of security knowledge sources

Abstract

For evaluating the security in enterprise systems, we need a security model that is amenable to integration, automated comparison and assessment. Over the years, practitioners have used various frameworks or standards (COBIT, ISO 2700x family) as checklists against which they could assess the security level in enterprise systems. On the other hand, researchers were more concerned with analysing security requirements or designing software for describing those requirements. These security models are either too general and contain unnecessary information for a particular organisation, or are highly dependent on the expertise of a security engineer. Besides these standards that are giving guidelines regarding security, there are many other sources like books, blogs, news, trainings and courses that produce security recommendations, there are regulations that mandate awareness about security, but still, organisations are missing appropriate knowledge and their systems are often attacked and breached. Having all these means available at a click of a mouse, it is questionable how can we use them in order to find the right solution that generates appropriate behaviour. This paper intends to tackle this problem by formulating a proposal for a methodology to setup a hybrid security knowledge repository for enterprise systems. The proposed solution will enable various stakeholders to add/share security knowledge in/from a repository and at the same time can use external trusted security data (from collaborative partners or reliable organisations) to enrich this knowledge base via semantic inter-operability techniques. Combining various online sources with knowledge from security officers would enable inferring new insights. The security knowledge holds some key characteristics that are considered as imperative. We referred to these as the 5C: Complexity, Continuity, Comprehensive and Cross-organisations, Compliance and Common representation. Our approach is making use of a common representation based on semantic technology for describing both security requirements pertaining to an organisation and trusted external security data.