Email this article 
Mapping ISO 27001:2013 and COBIT 2019 Framework to STRIDE Threat Modeling Using Qualitative Descriptive Research
Abstract
One of the crucial assets in every organization is information so making its protection through robust information security processes is indispensable. COBIT and ISO/IEC 27001 are key reference frameworks for managing information security, providing organizations with tools to implement controls that are appropriate and assess security risks. Within the COBIT framework, information security management is a core element of IT, focusing on ensuring the resource's integrity, confidentiality, and availability. Given that COBIT’s approach to managing information security aligns with the principles of the ISO/IEC 27001 standard, integrating ISO/IEC 27001 into a COBIT-based infrastructure is an ideal strategy for effective information security management. To facilitate their complementary use, mapping COBIT processes to ISO/IEC 27001 controls has proven highly advantageous. In this paper, we want to explore the significance of information security in COBIT and outline a method for mapping COBIT processes to ISO/IEC 27001 controls to enhance the effectiveness of information security management.
Keywords
Full Text:
PDFReferences
E. Handoyo, “Analisis Tingkat Keamanan Informasi: Studi Komparasi Framework Cobit 5 Subdomain Manage Security Services (DSS05) dan NIST Sp 800 – 55,” J. CoSciTech (Computer Sci. Inf. Technol., vol. 1, no. 2, pp. 76–83, 2020.
“Rekap Serangan Siber (Januari – April 2020) | bssn.go.id.”.
“BSSN: Malware Trojan Dominasi Serangan Siber di 2020 - Tempo.co.”.
“Laporan Tahunan 2019 PUSOPSKAMSINAS BSSN | bssn.go.id.”.
A. Ključnikov, L. Mura, and D. Sklenár, “Information security management in smes: Factors of success,” Entrep. Sustain. Issues, vol. 6, no. 4, pp. 2081–2094, 2019.
Department for Digital Culture Media and Sport, “Reino Unido Cyber Security 2018,” Cyber Secur. Breaches Surv., no. 1, pp. 1–58, 2018.
M. G. Cains, L. Flora, D. Taber, Z. King, and D. S. Henshel, “Defining Cyber Security and Cyber Security Risk within a Multidisciplinary Context using Expert Elicitation,” Risk Anal., 2021.
D. Sulistyowati, F. Handayani, and Y. Suryanto, “Comparative analysis and design of cybersecurity maturity assessment methodology using nist csf, cobit, iso/iec 27002 and pci dss,” Int. J. Informatics Vis., vol. 4, no. 4, pp. 225–230, 2020.
D. R. F. Dits Prasanti, “Penelitian Kepustakaan (Library Research) dalam Penelitian Pendidikan IPA,” Pembentukan Anak Usia Dini keluarga, Sekolah, Dan Komunitas, vol. 2, no. 1, p. 15, 2018.
N. Deysel, “A model for information security control audit for amall to mid-sized organizations”, Masters thesis in Business Information Systems in the Faculty of Engineering, the Built Environment and Information Technology at the Nelson Mandela Metropolitan University, (2009) January.
IT Governance Institute (ITGI), “COBIT Mapping: Mapping of ISO/IEC 17799:2000 with COBIT”, 2nd Edition, Printed in the United States of America, United States of America, (2000).
Witjaksono, R. (2019). Audit Sistem Informasi Akademik Universitas Telkom Menggunakan Framework COBIT 5 Domain DSS Untuk Optimasi Proses Service Delivery. Jurnal Rekayasa Sistem & Industri (JRSI), 6(01), 16-23. doi:10.25124/jrsi.v6i1.341
IT Governance Institute (ITGI), “COBIT Security Baseline. An Information Security Survival Kit”, Rolling Meadows: Author. Retrieved (2008) June 30, from http://www.isaca.org.
W. Boehmer, “Appraisal of the effectiveness and efficiency of an Information Security Management System based on ISO 27001”, Proceeding of Second International Conference on Emerging Security Information, Systems and Technologies, (2008), pp. 224-31.
A. Tsohou, S. Kokolakis, C. Lambrinoudakis and S. Gritzalis, “Information Systems Security Management: A Review and a Classification of the ISO Standards”, Next Generation Society, Vol.26, Technological and Legal Issues, Part 6, (2010), pp. 220-235.
E. Humphreys, “Information security management standards: Compliance, governance and risk management”, J Information Security Technical Report, Vol.13, No. 4, (2008), pp. 247-55.
K. L.,Thomson and R. von Solms, “Information security obedience: a definition”, J Computers & Security, Vol. 24, (2005), pp. 69-75.
ISO/IEC 27001: 2005, “Information technology- Security techniques - Information security management systems- requirements,” ISO Office, Published in Switzerland (2005).
J. Heasuk, K. Seungjo and W. Dongho, “A Study on Comparative Analysis of the Information Security Management Systems”, Lecture Notes in Computer Science, Vol. 6019, (2010), pp. 510-519.
A. Nakrem, “Managing Information Security in Organizations, A Case Study”, Master thesis in information systems, (2007), Institute of information science, department of economy and social studies HIA
E. Humphreys, “Information security management standards: Compliance, governance and risk management”, J Information Security Technical Report, Vol.13, No. 4, (2008), pp. 247-55.
DOI: https://doi.org/10.17509/coelite.v3i2.73228
Refbacks
- There are currently no refbacks.
Journal of Computer Engineering, Electronics and Information Technology (COELITE)
and managed by Department of Computer Enginering.
Jl. Dr. Setiabudi No.229, Kota Bandung, Indonesia - 40154
email: [email protected]
e-ISSN: 2829-4149
p-ISSN: 2829-4157