Kybernetika 51 no. 3, 408-419, 2015

IT/IS security management with uncertain information

Cyril Klimeš and Jiří BartošDOI: 10.14736/kyb-2015-3-0408


The paper introduces a novel proposal of a security management system destined primarily for application in the field of IT. Its core is formed by a triplet of cooperating knowledge-based (expert) systems, the knowledge bases of which consist of vague If-Then rules. The knowledge bases were created by experts on the problem domain and multiple times tested and verified on actual scenarios and real systems. With the system, a comprehensive methodology that is a part of a more complex approach to a decision making process is introduced. The proposed fuzzy tool is demonstrated on examples and problems from the area of information security. The paper also briefly reviews other used approaches to information security management - mainly qualitative and quantitative methodologies.


fuzzy sets, information retrieval, adaptive model, risk management, modeling information systems under uncertainty, information security, risk analysis


93E12, 62A10


  1. ČSN ISO/IEC TR 13335-3: Information technology - Guidelines for the management of IT Security - Part 3: Techniques for the management of IT Security. Český normalizační institut, Praha 1999, pp. 1-25.   CrossRef
  2. ČSN ISO/IEC 27001: Information technology - Security techniques - Information security management systems - Requirements. Český normalizační institut, Praha 2006, Annex A.   CrossRef
  3. J. Bartoš, J. Procházka, C. Klimeš, B. Walek and M. Pešl: Fuzzy reasoning model for decision making under uncertainty. In: 16th International Conference on Soft Computing Mendel 2010, Brno 2010.   CrossRef
  4. J. Bartoš, J. Procházka, C. Klimeš, B. Walek and M. Pešl: Fuzzy reasoning model for decision making under uncertainty. In: 16th International Conference on Soft Computing Mendel 2011. Brno 2010, pp. 203-209.   CrossRef
  5. J. Bartoš and B. Walek: A methodology for testing of information system under uncertainty. In: Proc. 36th International Conference on Telecommunications and Signal Processing (TSP), Faculty of Electrical Engineering and Communication, Brno University of Technology, Brno 2013, pp. 20-22.   DOI:10.1109/tsp.2013.6613883
  6. J. Bartoš, B. Walek, P. Smolka, J. Procházka and C. Klimeš: Fuzzy modeling tools for information system testing. In: 17th International Conference on Soft Computing Mendel 2011. Brno 2011, pp. 154-161.   CrossRef
  7. H. Habiballa, V. Novák, A. Dvořák and V. Pavliska: Using software package LFLC 2000. In: 2nd International Conference Aplimat, Bratislava 2003, pp. 355-358.   CrossRef
  8. C. Klimeš and J. Procházka: Reasoning in Software Support and Maintenance. In: Abstracts of Contributions to 5th International Workshop on Data-Algorithm-Decision Making. DAR - UTIA 2009/3, Praha 2009.   CrossRef
  9. C. Klimeš: Expert System Utilization for Modeling the Decision Making Processes upon Indetermination. Acta Electrotechnica et Informatica 1 (2007), 1.   CrossRef
  10. C. Klimeš and J. Procházka: Research paper: Using LFLC for decision making in SW support and maintenance. In: Research intention DAR - OASA 2/2009. Ostrava 2009.   CrossRef
  11. R. L. Krutz and R. D. Vines: The CISSP Prep Guide-Mastering the Ten Domains of Computer Security. John Wiley \and Sons, Inc., 2001, pp. 12-33.   CrossRef
  12. M. Makowski: Mathematical Modeling for Coping with Uncertainty and Risk. In: System and Human Science for Safety, Security and Dependability, November 2003, pp. 1-20.   DOI:10.1016/b978-044451813-2/50004-x
  13. V. Novák: Fuzzy množiny a jejich aplikace. SNTL, Praha 1986.   CrossRef
  14. V. Novák: Fuzzy Relation Equations with Words. First edition. Springer,Heidelberg 2004, pp. 167-185.   DOI:10.1007/978-3-540-39675-8_6
  15. V. Novák, I. Perfilieva and J. Močkoř: Mathematical Principles of Fuzzy Logic. First edition. Kluwer Academic Publishers, Boston - Dordrecht - London 1999.   DOI:10.1007/978-1-4615-5217-8
  16. B. Walek, J. Bartoš and J. Žáček: Proposal of The Expert System for Conducting Information Security Risk Analysis, Proceedings of the International Conference on Electrical and Electronics Engineering, Clean Energy and Green Computing. In: The Society of Digital Information and Wireless Communications, 2013, pp. 58-68.   CrossRef
  17. F. Steiner and J. Tupá: Management rizik v systémech řízení bezpečnosti informací. In: MOPP 2007. Západočeská univerzita, Plzeň 2007, pp. 177-183.   CrossRef
  18. H. Šegudović: Quantitative risk analysis method comparison. In: MIPRO 2007 conference, ISS, pp. 1-6.   CrossRef
  19. H. Šegudović: Upravljanje sigurnošću informacijskih sustava. In: KOM 2003, FER LSS, 2003, pp. III 31-40.   CrossRef
  20. B. Walek, J. Bartoš and C. Klimeš: A methodology for creating a conceptual model under uncertainty. In: International Conference on Computer, Electrical, and Systems Science, and Engineering, Amsterdam 2012, pp. 86-92.   CrossRef