Keywords

1 Introduction

Today, a strong emphasis is put on the security of Information Systems (IS) and on the management of security risks. For example, a new national regulation in Luxembourg about records management [1] concentrates on security and authenticity of records, and imposes a risk-based approach to service providers. CSSF, Footnote 1 as the National Regulation Authority (NRA) for the financial sector, has defined rules that emphasize IS security; the recent regulation “Circulaire CSSF 12/544” [2] has introduced a “risk-based approach” for financial service providers. Last but not least, in the telecommunication sector, the service providers have to comply with the EU Directive 2009/140/EC [3], which Article 13a on security and integrity of networks and services constraints Member States to ensure that providers of public communication networks manage the security risks of networks and services.

Although managing risks is constrained by regulators, modern day enterprises consider their Risk Management (RM) capabilities as an opportunity to drive competitive advantage. In its 2011 study on Global Risk Management [4], Accenture has identified that “risk management is now more closely integrated with strategic planning and is conducted proactively, with an eye on how [risk management] capabilities might help a company to move into new markets faster or pursue other evolving growth strategies”. From a security perspective, IS Security RM (ISSRM) supports enterprises to adopt cost-effective security measures: security threats are so numerous that it is impossible to act on all and enterprises are looking for a positive Return On Security Investment (ROSI). In this sense, ISSRM plays an important role in the alignment of a company’s business with its IT strategy [5].

Beside the increasing regulatory compliance, enterprises have to deal with disruptions that increase the complexity of their environment: the continuous enterprise evolution (planned evolution and/or unplanned and emergent changes), the disruption in the usage of traditional business solutions (e.g., Dropbox), the heterogeneity of the stakeholder’s profile and ability to address security risks, etc. In this enterprise “in motion” [6], new security risks constantly appear and new solutions are required to address them.

Enterprise Architecture Management (EAM) have appeared to be a valuable and engaging instrument to face enterprise complexity and the necessary enterprise transformation [7, 8]. EAM offers means to govern complex enterprises, such as, e.g., an explicit representation of the enterprise facets, a sound and informed decisional framework, a continuous alignment between business and IT, and so forth [9].

Given that the ISSRM discipline is not able to deal with this increasing complexity alone (see Sect. 2), we claim in this paper that a connection with EAM (see Sect. 3.1) contributes in addressing the above challenges (see Sect. 3.2), thereby sustaining governance and compliance in enterprises in motion (see Sect. 3.3).

Section 2 describes the background of our work, and focuses on our preceding works and their drawbacks. Section 3 presents the state of the art in the field of EAM, its links with ISSRM and the evolution of RM towards the GRC concept (Governance, RM, and Compliance). Our research objectives are then defined in Sect. 4. Section 5 presents the research method we currently follow. Finally, Sect. 6 is about current state of the research work, conclusion and future work.

2 Background on Information System Security and Risk Management and Problem to be Tackled

In our preceding works, the concepts of ISSRM have been formalised as a domain model, i.e. a conceptual model depicting the studied domain [10]. The ISSRM domain model was designed from related literature [11]: risk management standards, security-related standards, security risk management standards and methods and security requirements engineering frameworks. The ISSRM domain model is composed of 3 groups of concepts: Asset-related concepts, Risk-related concepts, and Risk treatment-related concepts. Each of the concepts of the model has been defined and linked one to the other [11], as represented in Fig. 1.

Fig. 1.
figure 1

ISSRM domain model (extracted from [11])

Full size image

Asset-related concepts describe assets and the criteria which guarantee asset security. An asset is anything that has value to the organisation and is necessary for achieving its objectives. A business asset describes information, processes, capabilities and skills inherent to the business and core mission of the organisation, having value for it. An IS asset is a component of the IS supporting business assets like a database where information is stored. A security criterion characterises a property or constraint on business assets describing their security needs, usually for confidentiality, integrity and availability.

Risk-related concepts present how the risk itself is defined. A risk is the combination of a threat with one or more vulnerabilities leading to a negative impact harming the assets. An impact describes the potential negative consequence of a risk that may harm assets of a system or organisation, when a threat (or the cause of a risk) is accomplished. An event is the combination of a threat and one or more vulnerabilities. A vulnerability describes a characteristic of an IS asset or group of IS assets that can constitute a weakness or a flaw in terms of IS security. A threat characterises a potential attack or incident, which targets one or more IS assets and may lead to the assets being harmed. A threat agent is an agent that can potentially cause harm to IS assets. An attack method is a standard means by which a threat agent carries out a threat.

Risk treatment-related concepts describe what decisions, requirements and controls should be defined and implemented in order to mitigate possible risks. A risk treatment is an intentional decision to treat identified risks. A security requirement is the refinement of a treatment decision to mitigate the risk. Controls (countermeasures or safeguards) are designed to improve security, specified by a security requirement, and implemented to comply with it.

After having defined the ISSRM domain model, our contributions has been focused on having a model-based approach for ISSRM. It has been motivated both by an efficiency improvement of the ISSRM process, and by the enhancement of the product resulting of the performed process [11]. The ISSRM domain model has been successfully applied to analyse different modelling languages: Mal-activity Diagrams [12], Misuse Case [13], Secure Tropos [14], Business Process Modelling Notations [15], and KAOS extended to security [11]. As a general conclusion of these assessments, none of the preceding modelling languages (even when improvements are proposed) is really suited to support the whole ISSRM steps. They are generally focused on a limited number of activities of ISSRM and do not cover its full scope (i.e. the business-to-IT stack). Another (related) drawback we observed is that it is generally difficult to model (business and IS) assets in a meaningful manner for ISSRM. In this frame, and as described in the next section, EAM techniques and related benefits are promising to fill these gaps.

3 State of the Art

3.1 Enterprise Architecture Management

Lapalme has extensively reviewed the Enterprise Architecture (EA) literature and has identified three schools of thought, each with its own scope and purpose [16]: Enterprise IT Architecting (EA is the glue between business and IT), Enterprise Integrating (EA is the link between strategy and execution) and Enterprise Ecological Adaptation (EA is the means for organisational innovation and sustainability). Considering the increased competition and disruptions in the markets, Lapalme’s taxonomy demonstrates the evolution of EA from an instrument supporting IT and business strategy execution to a management instrument for sustainable innovation and enterprise transformation [17]. As formulated by Op’t Land et al. [18], the suggested mission of EAM is to add value by providing to the management means for informed governance of enterprise transformation. Next to top-down changes dictated by the strategy, enterprises are subject to a continuous stream of bottom-up changes, which are neither planned nor controlled: from minute adjustments in business processes, simply to make things “work”, to the introduction of “shadow IT” (not formally introduced/supported ICT) in the form of cloud services, social media and BYOD.Footnote 2 As a consequence, enterprises are in constant motion [19], increasing the governance complexity. EAM, as a management science, provides the optimal platform for managing complexity [8], and making organisations more resilient in the face of disruption, leading to sustainable benefits: Ross et al. [20] show how constructing the right EA enhances profitability and time to market, while it improves strategy execution.

EAM is supported by multiple approaches [9, 21–24]. TOGAF [25] is an open EA framework proposed by The Open Group (TOG) and established as a standard. First published in 1995, TOGAF is based on the US Department of Defense Technical Architecture Framework for Information Management (TAFIM). From this sound foundation, TOG’s Architecture Forum developed successive versions of TOGAF at regular intervals and published them on TOG’s public web site. The framework is mainly composed of a method (the Architecture Development Method, ADM) and a meta-model for architectural artefacts (the Architecture Content Framework, ACF). TOG proposes ArchiMate [26] as a standard EA Modeling Language, providing the capability to represent an enterprise in a uniform way, according to the multiple stakeholders’ viewpoints [9]. ArchiMate introduces a layered representation of the EA: business, application and technology. Furthermore, two extensions are introduced since version 2.0 of the language: the Motivation Extension and the Implementation and Migration Extension. The TOGAF framework and the ArchiMate modelling language, as current EA standards, are of particular interest in our context.

3.2 EAM as ISSRM Facilitator

Connecting ISSRM and EAM has been investigated by academic works. Saeki et al. [27] underline that EAM is not only for IS/IT planning, but is also an instrument for corporate planning and business function, e.g., compliance management or RM. Innerhofer-Oberperfler and Breu [28] propose an approach for a systematic assessment of IT risks using EAM. The goal of the approach is to bridge the different views of the stakeholders involved in security management. They propose an information security meta-model and consider the security management process to be performed by security micro-processes executed by domain owners. In the same way, Ertaul and Sudarsanam [29] propose to exploit the Zachman framework [7] for defining and designing tools for securing an enterprise. This helps, in fine, to support security planning especially for IT. Leveraging EAM to defragment the identification of risks and to manage them in an holistic way was also recently proposed in Barateiro et al. [30]: EA description is used to model complex business system at the desired level of abstraction, and to cover the views of the enterprise relevant to assess and manage the different kinds of risks. All of the preceding research works are providing some initial and promising inputs towards leveraging EAM to deal with security and/or RM issues. However, to the best of our knowledge, there is no extensive and mature research work trying to benefit from research in EAM to improve RM in the specific field of information security and proposing a completely integrated approach: modelling language, method and tool.

In terms of industry standards, TOGAF [25] states that the enterprise architects are in good place to identify and mitigate risks. TOG’s Architecture Forum is currently investigating the integration of security within EA, making it integrally part of the development of EA, and the ArchiMate Forum investigates extending ArchiMate concepts in order to support risk modelling, notably based on our previous works [31]. We have indeed proposed a conceptual mapping of EAM and ISSRM (first step in conceptual integration) [32] and have demonstrated that ArchiMate can be used to model the subject of the security risk assessment (the assets), but also that security risks and controls can be modelled with the existing ArchiMate constructs. This previous work represents a proof-of-concept in the conceptual integration of ISSRM-EAM: we have indeed identified gaps that require further theoretical and conceptual analysis. These different industrial initiatives confirm the interest of practitioners in the integration of EAM and ISSRM, as well as the need to develop the theoretical foundation for this integration.

3.3 From Risk Management to GRC

Today, RM is part of the integrated GRC concept: Governance, RM, and Compliance. According to the literature [25, 33, 34], “governance” evaluates, directs, and monitors the enterprise strategic objectives. To that end, the corporate governance aims at sustaining the relation between the management, the board of direction, and the shareholders [33, 34]. It also expresses the decision making policies related to corporate issues with the intent to ensure the adequacy of the resources usage according to the strategic objectives of the organisation [35]. The international standard ISO/IEC 38500 [36] is a high level framework that confers guidance on the role of governing body. It provides a set of six high level principles for the managers of the company to help them in evaluating, directing and monitoring the use of the information system of the company. COBIT [37] is a framework that enables the development of clear policies and good practice for IT control throughout enterprises. It is a framework and a supporting toolset that allow managers to bridge the gap with respect to control needs, technical issues and business risks, and communicate this level of control to employees.

GRC is also tackled by academics. Racz et al. [38] observe the few existing scientific researches in GRC as an integrated concept, despite the amount of research in the three topics separately. They also identify the main drivers for GRC: the regulatory compliance, followed by RM. The authors define GRC as “an integrated, holistic approach to organisation-wide governance, risk and compliance ensuring that an organisation acts ethically correct and in accordance with its risk appetite, internal policies and external regulations through the alignment of strategy, processes, technology and people, thereby improving efficiency and effectiveness”. Bonazzi et al. [39] propose a process that achieves the regulatory compliance by aligning governance activities and RM. Vicente and da Silva also acknowledge the lack of scientific references related to GRC [40] and define an innovative GRC conceptual model, which strengthens the connections between risk and governance in the sense that governance aims at understanding and foreseeing the vulnerabilities of an organisation. The authors also claim that the alignment between business and risks is enforced by structured governance and compliance management. Another approach [41] proposes to use Situational Method Engineering and method fragments [42] to implement GRC. Once again, in this broader domain of GRC, to the best of our knowledge, there is no extensive and mature research work trying to benefit from research in EAM to improve ISSRM for compliance and governance purpose.

4 Research Objectives

Our proposal aims at connecting RM and EAM, in the area of IS security. We claim that such a connection shall help to reduce GRC complexity and associated cost. Our objective is therefore to answer the following research question (Fig. 2): How to improve ISSRM using results from EAM for Compliance and Governance purpose?

Fig. 2.
figure 2

Research outcome

Full size image

To answer this research question, the following objectives with the associated contributions have been specifically defined:

  1. 1.

    To assess and integrate the conceptual models of EAM and ISSRM domains [contribution 1 = EAM-ISSRM integrated model]

  2. 2.

    To assess and improve the ArchiMate modelling language to support the integrated conceptual model of EAM and ISSRM [contribution 2 = EAM-ISSRM extended language]

  3. 3.

    To analyse the processes supporting both ISSRM and EAM, and to define relevant method fragments/chunks allowing to link both domains at the methodological level [contribution 3 = EAM-ISSRM catalogue of method fragments/chunks]

  4. 4.

    To analyse and position the integrated EAM-ISSRM framework (conceptual model, modelling language and method chunks/fragments), called “ENTRI framework”, with regards to GRC models [contribution 4 = GRC-aware ENTRI model, language and method]

  5. 5.

    To implement the designed artefacts on a technological platform called the “ENTRI platform” [contribution 5 = ENTRI platform prototype]

5 Methods and Approach

This research work is especially motivated by the need to fill the gap between GRC and EAM from the IS security perspective. It falls in the frame of Design Science Research (DSR) that tends to design a solution for a specific problem [43]. The research method we want to follow is inspired by the “regulative cycle” approach established by Wieringa [44], that is instantiated to our case in Fig. 3.

Fig. 3.
figure 3

Research method: A Design Science Research (DSR) approach

Full size image

Step (1): The motivation of the research work resulted from the observation that ISSRM methods could be improved using EAM, as explained in Sect. 2. This statement is also shared by EBRC (E-Business & Resilience Centre),Footnote 3 a leading European datacentre operator and our industrial partner, both of us being experienced in running ISSRM methods. EBRC is particularly exposed to governance and compliance problems requiring to perform ISSRM: EBRC holds several certifications (especially the ISO/IEC 27001 certification [45]) and is subject to a set of regulations (financial regulation, tier certification, etc.) many of them involving ISSRM activities having different scopes.

Step (2): In order to achieve our research objectives (Sect. 4), we plan to produce a set of design artefacts called the ENTRI framework and composed of:

  • An integrated EAM-ISSRM model

  • A integrated modelling language

  • A catalogue of method fragments/chunks

  • A prototype integrating the preceding results

Step (3): The design validation activity includes the use of the ENTRI framework to run a lab-case study called ArchiSurance [46].

Step (4), (5) and (6): After this first design research iteration, we plan to perform a new design cycle in order to improve our artefacts based on the feedback obtained during the design validation step.

Step (7): Finally, the ENTRI framework will be assessed on a real-world case by EBRC in the frame of improvements of IS security compliance and governance. The ENTRI framework could be compared to their current practices and used in the context of ISO/IEC 27001 certification maintenance [45] and “Circulaire CSSF 12/544” [2] compliance for defining an integrated ISSRM system for the company. It is also possible to consider other contractual or regulatory frameworks during this implementation step if additional compliance issues related to our scope apply to EBRC during the design time.

6 Conclusions and Future Work

In this paper, we have described our research background, objectives and agenda in the frame of integrating ISSRM and EAM domains. After having explained the context of our work, we have introduced the current drawbacks of ISSRM approaches: it is generally difficult to model assets, risks and related countermeasures in a meaningful manner, in particular all along the business-to-IT stack. An extensive state-of-the-art has then been established in order to survey the current situation in the field of EAM, its integration with ISSRM and its contextualisation to the emerging GRC field. Our position is that a global framework, encompassing an integrated conceptual model, a modelling language, method(s) and a tool, should be useful to improve the state-of-practice. The expected benefits of such a contribution are numerous: better information security governance, reduction of time and effort dedicated to ISSRM, support in compliance to legal or normative requirements, etc. We plan to demonstrate these benefits through a real-world case-study, with the help of performance indicators.

Regarding current state of the work, the problem investigation step of our research method has been performed and the main observations have been reported in this paper. We are now designing the integrated EAM-ISSRM conceptual model and refining in parallel our coarse-grained research method in a detailed one, taking into account best practices of DSR [44]. Our future works will naturally be focused on following this research method.