A new approach of information system security governance: A proposition of the continuous improvement process model of information system security risk management: 4D-ISS

摘要

nowadays the information system security (ISS) has become the main lever of the world economy, it is the keystone for the creation of value, and its unavailability has an undeniable technical, human and financial impact. Mastering this discipline, comes down to three pillars (1) securing the content of the risks to which it is exposed (Risk Management of the ISS, ISSRM), (2) defining the stakeholders that contribute to its management and its governance (Governance of the ISS, ISSG) and (3) complying with the regulations in force, law, standards and contractual obligations (Compliance Management of ISS, ISSCM). Satisfying this structure, means developing a holistic approach of ISS governance (ISSG) across the entire target organization. The ISSG that have emerged lately in the world of business and information technology remains a difficult subject to demystify. To develop this approach it is essential to handle the three disciplines each as a separate entity, which will constitute the main building blocks of a new ISSG concept. Then, explore the synergies of their cohabitations in a transverse way, in order to guarantee the business profits. This article focuses on the first brick of our ISSG Framework; which is the ISSRM, by the proposing a new model of process, called 4D-ISS. This model breaks down into four phases named respectively, Define, Direct, Deploy and Decide. This work also proposes the conceptualizing of its deployment using the Business Process Modeling Notation (BPMN), defining the requirements for its implementation, and giving future actions to explore.