Towards end-to-end Continuous Monitoring of Compliance Status Across Multiple Requirements
Journal Title: International Journal of Advanced Computer Science & Applications - Year 2018, Vol 9, Issue 12
Abstract
Monitoring compliance status by an organization has been historically difficult due to the growing number of compliance requirements being imposed by various standards, frameworks, and regulatory requirements. Existing practices by organizations even with the assistance of security tools and appliances is mostly manual in nature as there is still a need for a human expert to interpret and map the reports generated by various solutions to actual requirements as stated in various compliance documents. As the number of requirements increases, this process is becoming either too costly or impractical to manage by the organization. Aside from the numerous requirements, multiple of these documents actually overlap in terms of domains and actual requirements. However, since current tools do not directly map and highlight overlaps as well as generate detailed gap reports, an organization would perform compliance activities redundantly across multiple requirements thereby increasing cost as well. In this paper, we present an approach that attempts to provide an end-to-end solution from compliance document requirements to actual verification and validation of implementation for audit purposes with the intention of automating compliance status monitoring as well as providing the ability to have continuous compliance monitoring as well as reducing the redundant efforts that an organization embarks on for multiple compliance requirements. This research thru enhancing existing security ontologies to model compliance documents and applying information extraction practices would allow for overlapping requirements to be identified and gaps to be clearly explained to the organization. Thru the use of secure systems development lifecycle, and heuristics the research also provide a mechanism to automate the technical validation of compliance statuses thereby allowing for continuous monitoring as well as mapping to the enhanced ontology to allow reusability via conceptual mapping of multiple standards and requirements. Practices such as unit testing and continuous integration from secure systems development life cycle are incorporated to allow for flexibility of the automation process while at the same time using it to support the mapping between compliance requirements.
Authors and Affiliations
Danny C. Cheng, Jod B. Villamarin, Gregory Cu, Nathalie Rose Lim-Cheng
Keywords
Related Articles
- EP ID EP429220
- DOI 10.14569/IJACSA.2018.091264
- Views 76
- Downloads 0
Research on Energy Saving Method for IDC CRAC System based on Prediction of Temperature
Amid the information era, energy consumption of IDC Computer Room Air Conditioning (CRAC) system is becoming increasingly serious. Thus there is growing concern over energy saving and consumption reduction. Based on the...
Detecting Public Sentiment of Medicine by Mining Twitter Data
The paper presents a computational method that mines, processes and analyzes Twitter data for detecting public sentiment of medicine. Self-reported patient data are collected over a period of three months by mining the T...
Criminal Investigation EIDSS Based on Cooperative Mapping Mechanism
On purpose of improving the research in extension intelligence systems when the knowledge in hand is not sufficient, an intuition evidence model (IEM) based on human-computer cooperative is presented. From the initial in...
Bound Model of Clustering and Classification (BMCC) for Proficient Performance Prediction of Didactical Outcomes of Students
In this era of High-Performance High computing systems, Large-scale Data Mining methodologies in the field of education have become a convenience to discover and extract knowledge from Databased of their respective educa...
Matrix Clustering based Migration of System Application to Microservices Architecture
A microservice architecture (MSA) style is an emerging approach which is gaining strength with the passage of time. Micro services are recommended by a number of researchers to overcome the limitations and issues encount...