# Educational Organization's Security Level Estimation Model
## 3 Proposed Security Level Estimation Model
### Design of Education Organization Security Level Estimation Criteria Set  
The four P's of security [48] define the policies, processes, people, and products as base pillars to build a comprehensive security strategy. The same four elements are needed for education organizations to assure their security level. Therefore, (1) security policies, (2) security processes, (3) people security awareness, and (4) processed data or/and used systems are the main four criteria for security level estimation (see Figure 3). These four criteria are compound, and it would be difficult to evaluate its discrete values without the usage of security experts or automated tools. Therefore, the four criteria are divided into smaller ones leading to the usage of the AHP [49]. Based on the AHP, each criterion should be divided into smaller ones, while the criteria will be evaluable or undividable further. Based on [PERSON] [50], cybersecurity consists of several categories: network security, application security, information security, operational security, disaster recovery, end-user education. Based on these categories we define the security policy as a combination of policies of each of these categories: (1.1) network security policy, (1.2) application security policy, (1.3) information security policy, (1.4) operational security policy, (1.5) disaster recovery policy, (1.6) stakeholder security training policy. The education organization should have all these policies and it is important to achieve the highest maturity level possible. Stating security policies do not give the desired effect if it is not repeated, clearly defined, managed, and optimized for the specific organization. As the requirements for education organization requirements might vary, it is too difficult to state what exactly  
Figure 2: Principle schema of education organization security level estimation model. should be reflected in the security policies; therefore, the model uses a security policy maturity level as value for each of these criteria. The same idea of maturity level applies to security processes--it is important to optimize security processes to increase the security level. However, security processes might present different stages of security management; therefore, the criteria security processes are divided into more specific ones. The sub-criteria are defined based on five security functions, presented by the NIST [51]: (2.1) identify, (2.2) protect, (2.3) detect, (2.4) respond, (2.5) recover. The latest trends confirm the weakest link in enterprise security is humans [52]. Because of this trend, it is not enough to have a stakeholder security training policy; therefore, the model should include data on how qualified in the security area are the stakeholders. Therefore, the criteria people security awareness is divided into four sub-criteria: (3.1) existence of positions, responsible for security in the organization, (3.2) existence of systemic security training, (3.3) existence of security-related information sharing, (3.4) existence of help-desk service, for security incident or problem reporting. The 3.1 criteria are not divided into smaller ones, while the rest three criteria are divided into subcategories, representing two different stakeholders groups: employees and students. These groups have even deeper categories, where employees are divided into (a) administration and (b) teaching staff (see Figure 4). While students are divided taking into account the General Data Protection Regulation (GDPR) [53], where people under 16 years old are assigned to more  
Figure 3: The constructed criteria tree structure (only two levels of criteria are shown). sensitive groups. Therefore, we have three sub-categories for students: (c) students under 16 years, (d) 16 years and older students, (e) student-related persons (parents, trustees, etc.).