# MASISCo--Methodological Approach for the Selection of Information Security Controls
## 4 Conclusions
Furthermore, modern optimization solutions have been demonstrated to address and solve security management situations from the OR perspective. Consequently, it is possible to argue that information security management not only has an excellent opportunity to improve its approach by incorporating the OR perspective but that OR also has, in information security management, an interesting domain to study. The evaluation of the proposal made it possible to demonstrate, in an academic context, its impact on a security consultant. Furthermore, a method adoption study determined that there is a positive inclination towards using this methodological approach as opposed to the traditional solution. Generally, the experience results for each dimension studied tend towards the positive ends of the scale. The descriptive statistics analysis for each dimension shows that the study subjects perceive the approach as a helpful process compatible with their way of working. Moreover, they show their predisposition to adopt the approach in the future if they can do so. On the other hand, the main weakness of the proposal lies in the complexity of modeling the scenarios that represent the situation the organization wants to solve. Moreover, the modeling is done in an optimization language that is generally not in the domain of knowledge of a security consultant. The results obtained in the analysis of the linear regression model, the analysis of descriptive statistics, and the qualitative analysis are consistent and point in the same direction regarding essential aspects for the subjects and opportunities for improvement. However, it is necessary to recognize some limitations of the study conducted. The most important is undoubtedly the size of the group and its characteristics, which means that the conclusions must be interpreted carefully. However, it should be noted that the evaluation carried out was formative and, therefore, its purpose is not to study a finished product but rather, being the first application of the model, to determine a set of perceptions that will provide a series of opportunities for improvement. Based on the conclusions of the method adoption study, we identified the need to support the user in the application of the methodological approach. For this purpose, we developed a prototype software tool that covers all the stages of the methodological approach, which provides even more excellent support to the security consultant in applying the approach. This automation allows the expert to abstract from the complexity of modeling and solving the problem and focus his effort on analyzing the response, where the recommendation of the optimal set of controls is made explicit. In this way, the tool facilitates the consultant's task and the methodological approach's application. Moreover, in this way, it is expected to account for the observations made about the proposal's ease of use, reducing the process's complexity. Although we have not evaluated the tool's impact on the assessor's implementation of the proposal experimentally, it is possible to estimate that the use of the tool will improve the ease-of-use index of the model. Consequently, we expect that the automation of these processes of the proposed methodological approach will increase the adoption intention of security assessors. A proposal such as this would have a positive impact on the recommendations for the implementation of an improvement plan based on the selection and programming of security controls since: (i) it formalizes a process that is currently not standard and depends mainly on the experience of the security consultant, (ii) by using optimization methods, it ensures optimal solutions according to the profile and restrictions of each organization, which optimizes time and resources, and (iii) by using software support, it automates a large part of the process, facilitating its application, reducing time and costs.