Abstract:The security breaches of sensitive information have remained difficult to solve due to increased malware programs and unauthorized access to data stored in critical assets. As risk appetite differ from one organization to another, it prompts the threat analysis tools be integrated with organization’s information security policy so as to ensure security controls at local settings. However, it has been noted that the current tools for threat assessment processes have not encompassed information security policy for effective security management (i.e. confidentiality, integrity and availability) based on organization’s risk appetite and culture. The information security policy serves as a tool to provide guidance on how to manage and secure all business operations including critical assets, infrastructure and people in the organization. This guidance (e.g. usage and controls) facilitates the provisions for threat assessment and compliance based on local context. The lack of effective threat assessment frameworks at local context have promoted the exposure of critical assets such as database servers, mails servers, web servers and user smart-devices at the hand of attackers and thus increase risks and probability to compromise the assets. In this paper we have proposed a conceptual framework for security threat assessment based on organization’s information security policy. Furthermore, the study proposed the policy automation canvas for provision of a methodology to alert the security managers what possible threats found in their organizations for quick security mitigation without depending on security expertise.

A Framework of Information Security Integrated with Human Factors

Application of a Human Factors-Integrated Information Security Framework to an Oil and Gas Organization.

Towards the Framework of Information Security

Information Security Engineering: A Framework for Research and Practices

Computer Information System Security Framework Design

A process framework for information security management

An integrated system theory of information security management

The Evolution of Information Security Strategies: A Comprehensive Investigation of INFOSEC Risk Assessment in the Contemporary Information Era

A Collaborative Framework for Information Security Management System Using Intelligent Multi-Agent

Integrated Solution Modeling Software: A New Paradigm on Information Security Review

Information Security Management: A Hierarchical Framework for Various Approaches

Integrated Solution Modeling Software: A New Paradigm on Information Security Review and Assessment

Building a Viable Information Security Management System

Information Security management: A human challenge?

Organizational information security policies: a review and research framework

Holistic Information Security Management and Compliance Framework

A Conceptual Framework for Threat Assessment Based on Organization’s Information Security Policy

A Framework and It's Application for Security Architecture of Computer Networks

Information Security Strategy in Organisations: Review, Discussion and Future Research Directions

A comprehensive privacy and security framework for dynamic protection (CPSF)

I-SolFramework: An Integrated Solution Framework Six Layers Assessment on Multimedia Information Security Architecture Policy Compliance