The concept behind the paper has been quietly brewing for a couple of months or more, taking the past few weeks to crystallise into words in a form that I'm happy to share publicly.
In a nutshell, 'attributes' are characteristics or features that can be used to categorise, sort or rank information security controls by various criteria. That simplistic concept turns out to unlock some powerful possibilities, described pragmatically in the paper.
It's a more innovative and valuable technique than it may appear.
Along the way, I regret inadvertently upsetting the team of JTC 1/SC 27 editors working on about the paper and released it to an unknown number of LinkeDinners.
Care to join the gang? accompanying a formal proposal for SC 27 to develop the standard is due out this month for voting and comments by mid-April.
PS A while (7 years!) ago, I blogged about a suggestion to evaluate the organisation's information security budget according to the proportions of spending on preventive, detective and corrective controls. I was unimpressed with the low PRAGMATIC value of the metric ... but nevertheless the idea of using control attributes to review budgets remains intriguing.
Vollständiger Original-Bericht
Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf blog.noticebored.com.
SOCIAL SHARE CARD GENERATOR