No description available.

Today's businesses base their operation on their IT infrastructure, which consequently demands that it should be protected accordingly. Nevertheless, surveys tend to indicate that the number of IT security incidents is increasing, resulting in significant losses for the organisations concerned. Leading in poor security practices, and therefore frequent victims of related security incidents, are Small and Medium Enterprises (SMEs). Even though there are a number of solutions, ranging from baseline guidelines to a detailed Risk Assessment (which can be followed to guide organisations through systematically selecting appropriate controls and practices to properly secure their networked assets), evidence suggests that these are not being employed by SMEs. Constraints such as lack of budget, security personnel and awareness are amongst the factors that are deterring SMEs from adopting such solutions, and therefore contributing to their continued problem with security incidents. This thesis specifically targets the problem of security risk assessment within SME environments. Following an examination of the aforementioned constraints, the investigation considers the existing solutions, establishing the reasons that they are not appropriate for SME users. The research identifies that SMEs are in need of a solution that represents a progression of current guidelines, but without being as complicated as existing forms of Risk Analysis. Therefore a new methodology is designed, known as PRAM (Profile-based Risk Analysis and Management), which enables SMEs to analyse and manage their risks in a way that is simple to use and understand, as well as providing economic considerations on threats, their likelihood, effect and the spending required to reduce them to an acceptable level. The methodology is then implemented within a working prototype, which is evaluated using a series of test scenarios. These scenarios are also used as the basis for evaluating existing SME-oriented Risk Analysis solutions, and the findings determine that the PRAM approach is able to deliver a more comprehensive solution. In addition, an evaluation of the PRAM prototype by a series of end-users suggests that it also succeeds in providing a more user-friendly solution than the current alternatives. Overall, this thesis presents a solution that can be adopted by SMEs lacking in-house security expertise. It can assist them in understanding the threats they are under, while at the same time presenting appropriate information to enable management to evaluate their organisation's current IT security situation and select appropriate countermeasures.

No description available.

In recent years, advances in information technology and enterprise engineering have revolutionised the way businesses are conducted. Enterprises. are complicated organisations consisting of 'artefacts' (enterprise structure, activities, processes, information, resources, behaviour, goals, and constraints) that must be coordinated, planned and engineered to accomplish the enterprise goals. Enterprise engineering is an engineering approach comprised of techniques, methods, and infrastructures to aid the design, analysis, and implementation of an enterprise system. However, many modellers forgo the enterprise modelling methods and techniques and use localised ad-hoc and point solutions that are not amenable for enterprise infrastructure design. The current methods and techniques available are ill-equipped to model the holistic requirements oftoday's complex enterprises. .' This research adopts the PAM (problem Articulation Method), rooted in semiotics, a study of signs, symbols, language and information. PAM offers a suite of techniques, which enables the articulation and analysis of business, technical and organisational requirements, delivering a rigorous enterprise infrastructure to support the model. The method works by eliciting and formalising project planning and modelling (processes, .activities, relationships, responsibilities, communications, resources, agents, dependencies and constraints), where the abstractions are mapped to represent the manifestation ofthe 'actual' enterprise. ~ .,J The proposed enterprise framework incorporates PAM and MEASUR (Methods for Eliciting Analysing and Specifying Users Requirements) a suite of semiotics methods to model the agent's ontological relationships, defining its meaning (semantics) to improve the analytical capability of the model and elicit the normative behaviours of agents to enrich the enterprise model. The PAM method has been further extended to examine the method relevance and significance in dealing with innovation in the modelling and planning of complex enterprise projects. The PAM conceptual model created is subsequently analysed, tested and verified using an off-the-shelf discreteevent simulation software, to be modelled dynamically. The simulation models are also validated by the domain experts from the respective organisations to assess the consistency, coherence and logical correctness of the 'model. This modelling approach contributed to the further development of the PAM theories, methods and techniques and represents a significant improvement to facilitate enterprise infrastructure planning and in so doing, exploit the technological, business and organisational effectiveness.

No description available.

No description available.

No description available.

No description available.

No description available.

No description available.