SPAN-a DSS for security plan analysis

This paper describes a decision support system for assessing information systems (IS) security and for designing an IS security plan. This system addresses threats, risks, vulnerabilities and examines existing countermeasures. It analyzes any need for new security practices and produces a draft IS security plan. The SPAN (Security Plan Analysis) system provides expert advice and decision support to improve decisions made during an analysis of an organization's IS security posture. It is applicable to most organizations, from those which are just starting IS risk assessment to those that already have IS security plans and wish to review them.