An evaluation methodology of enterprise security management systems

Traditional methodologies related with an analysis, assessment or evaluation of enterprise security management systems are risk analysis methods. These consist of sophisticated processes of an asset identification and valuation, vulnerability analysis, threat analysis, and risk calculation which require very long time and heavy resources. The risk analysis approaches lack in showing an analysis result with strategic management viewpoints because these only focus on an analysis of each asset with perspectives of there value and possible loss. This paper provides an integrated approach of the evaluation methodology of enterprise security management systems. It consists of an evaluation process model and evaluation criteria. A case study proves the real value of this methodology. With a process model and evaluation criteria provided in this paper, a security officer could deliver the enterprise-wide security planning status to executive managers without burden of time and resources.