# MASISCo--Methodological Approach for the Selection of Information Security Controls
## 3 Results
### Phase 2: Proposal Design
#### 3.2.2 Recommendation  
From the diagnosis results, it is possible to know the gap that the company must cover if it wants to reach a certain level of risk or a degree of conformity with the standard. For this, it is necessary to define an improvement plan, which determines the set of controls or security criteria necessary to achieve the risk or compliance goal, considering the characteristics and resources of the organization. Despite this need, there is no methodological framework based on quantitative optimization techniques to support this process. This situation leads to subjectivity in recommending an improvement plan since much of the process is subject to the analyst's experience. Accordingly, a large part of this proposal is framed by defining a methodical and replicable process that defines the procedures, techniques, and tools that support the  
Figure 3: MASISCo Stages. definition of a plan for the implementation of security criteria or controls within a given time frame and according to the goals, strategies, and resource conditions of each organization. Then, in the Recommendation stage of this proposal, we seek to solve the subjectivity problem by incorporating optimization methods and techniques for modeling and solving the scenarios that represent the problem of the selection of security controls. As shown in Figure 4, we have divided this stage into three major processes:  
* The first refers to the identification of the optimization problem to be solved. The result of this stage is a detailed description of the problem, which specifies: (i) the objective, (ii) the constraints to be considered, and (iii) the parameters of the variables that define the objective, as well as the organization's constraints. Table 2 summarizes seven situations a security assessor may face when making recommendations. We have classified them according to their objective, in order of increasing complexity: prioritization, selection, or scheduling problems. The prioritization of controls refers to ordering controls concerning one or more criteria, for example, risk or cost, prioritizing from highest to lowest value or vice versa. In the case of selection, there is a recommendation of a subset of controls concerning the entire set based on the organization's objectives and constraints. In the case of scheduling, it not only selects a subset of controls but also determines the implementation sequence of the selected controls based on some criteria. In addition, for each situation identified, we list the OR technique or method that can be applied for its modeling and solution. These situations are detailed in depth in [31]. This definition of problem types, categorized by objective, facilitates subsequent modeling since each of these situations requires different modeling and the use of different OR techniques for their resolution. Thus, the proposal supports security advisors in selecting these modeling and resolution techniques for the situation. Figure 4: Detail of MASISCo stages. * The second process refers to modeling the situation as an optimization problem. The result of this stage is the mathematical model derived from the formats found in the OR field. In this process, it is necessary to determine the conditions and restrictions to be included in the modeling. In this sense, the proposal proposes the need to establish three aspects:
* Improvement plan objectives;
* The constraints of the organization;
* The relevant parameters for modeling. Concerning the objective sought by the organization, it must establish what it hopes to achieve or satisfy with the selection process. Some examples of valid objectives are:  
* Maximize the number of controls to be implemented or maximize the benefit of implementing the group of controls;
* Minimize the risk of non-implementation of controls, or minimize the implementation time of the group of controls. According to an optimization problem, these objectives represent the model equation that will drive the resolution of the problem.