Expert system for business decisions on security requirements

Abstract

Information systems are frequently built with inadequate requirements for security and performance, which often results in unjustified business risks or losses. This paper proposes novel expert system application for modeling high level business requirements for informar tion security and their implication on the development of the system, e.g. cost, maintainability, etc. By using such a system decision makers, especially at the early stages of development could better understand trade-offs between development costs, security requirements, and business risks, thus enabling more informed and conscious decisions on major security requirements. © Springer-Verlag Berlin Heidelberg 2007.