# MASISCo--Methodological Approach for the Selection of Information Security Controls
###### Abstract
[7] presented four information security risk management categories:  
* Risk Management Standards. It includes standards such as ISO/IEC Guide 73 [8] and AS/NLZs 4360 [9]. * Security Requirements Frameworks. Proposals such as, [PERSON] et al. [10], Khan e Ikram [11], and techniques, such as, SecureUML [12; 13] and SIREN [14]. * Risk management methods, such as OCTAVE [15], and CORAS [16]. * Information security standards, such as ISO27001 [17], NIST [18], and COBIT [19]. The proposal is part of the latter approach to risk management. In this sense, IS standards propose this set of good security practices through the implementation of an Information Security Management System (ISMS) [20]. The actions proposed by a standard are transversal to the organization, affecting its organizational structure, policies, technological infrastructure, human resources, and processes, among other areas [3]. While it is true that the standard is clear regarding the implementation of the entire management system, there may be differences concerning partial implementations since organizations have different characteristics and different capabilities and resources [21; 22]. Therefore, the decision regarding the progress in achieving the standard is not trivial since it must consider various aspects of the organization, such as risk, costs, implementation times, prioritizations, and policies, among others. Usually, experts in implementing an ISMS make recommendations for advancement [22; 23]. However, this approach is subjective and does not ensure an optimal recommendation, as it does not follow a standardized process with well-defined steps and proven support techniques. Therefore, although this type of recommendation may meet the requirements and characteristics of the organizations, it does not optimize the use of resources. In this context, it becomes relevant to support decision-making regarding the progress in achieving a standard. However, the multiplicity of factors involved in this process complicates the resolution of the problem. Elements such as risk, cost, time, or human factors, among others [24], transform this problem into a multi-objective problem subject to resource constraints. Then, the methodological approach proposed in this work defines a systematic and repeatable process supported by mathematical modeling, multi-objective problem-solving techniques, and supported whit computer tools. This approach dramatically supports decision-making, decreasing the decision time, and increasing the recommendation accuracy from the perspective of resource optimization. Accordingly, the main objective of the investigation is to define a methodology for selecting information security controls that will help security consultants make their recommendations more efficiently, effectively, and with greater satisfaction than they would obtain using their usual methods. To this end, we propose that the methodology be based on a quantitative model for selecting information security controls and that it be supported by software tools that partially automate the process. As a direct result of this research, the following contributions to the area under study can be listed:  
1. Methodological approach for control selection: From the above, the main contribution of this article is the proposal of a methodological approach for the optimal selection of security controls. This approach allows systematizing a process that, to date, is not structured but depends on the criteria of each security expert. This work defines: (i) stages of the process, (ii) categorizes possible situations that can be faced, (iii) proposes techniques to be applied in each category, and (iv) details the products at each stage of the process. The advantages of this approach are mainly related to the systematization of the process, the possibility of solving complex recommendation problems, and the reduction of the time required to solve the problem. Proposal evaluation: This paper also evaluates the proposal by applying a methodology adoption study.