Abstract:The security breaches of sensitive information have remained difficult to solve due to increased malware programs and unauthorized access to data stored in critical assets. As risk appetite differ from one organization to another, it prompts the threat analysis tools be integrated with organization’s information security policy so as to ensure security controls at local settings. However, it has been noted that the current tools for threat assessment processes have not encompassed information security policy for effective security management (i.e. confidentiality, integrity and availability) based on organization’s risk appetite and culture. The information security policy serves as a tool to provide guidance on how to manage and secure all business operations including critical assets, infrastructure and people in the organization. This guidance (e.g. usage and controls) facilitates the provisions for threat assessment and compliance based on local context. The lack of effective threat assessment frameworks at local context have promoted the exposure of critical assets such as database servers, mails servers, web servers and user smart-devices at the hand of attackers and thus increase risks and probability to compromise the assets. In this paper we have proposed a conceptual framework for security threat assessment based on organization’s information security policy. Furthermore, the study proposed the policy automation canvas for provision of a methodology to alert the security managers what possible threats found in their organizations for quick security mitigation without depending on security expertise.

Convergence of Corporate and Information Security

Physical security and IT convergence: Managing the cyber-related risks

An information security policy in converged network environment

The Evolution of Information Security Strategies: A Comprehensive Investigation of INFOSEC Risk Assessment in the Contemporary Information Era

Enhancing Infrastructure Security in Real Estate

Information Security Strategy in Organisations: Review, Discussion and Future Research Directions

Security of IT/OT Convergence: Design and Implementation Challenges

Contemporary Threats Countermeasuresi

Security Alert Management in E-Business Networks

FSCsec: Collaboration in Financial Sector Cybersecurity -- Exploring the Impact of Resource Sharing on IT Security

Security Risks and Modern Cyber Security Technologies for Corporate Networks

An Overview of the Security Concerns in Enterprise Cloud Computing

Incentive Alignment and Risk Perception: An Information Security Application

Counterattacking Cyber Threats: A Framework for the Future of Cybersecurity

The importance of information security for organizations

Common Security and Control Framework in Tri-Network Convergence

Building a Viable Information Security Management System

Emergent (In)Security of Multi-Cloud Environments

IT Security Plan for Flight Simulation Program

Enterprise information security risks: a systematic review of the literature

A Conceptual Framework for Threat Assessment Based on Organization’s Information Security Policy