Information Asset Classification and Labelling Model Using Fuzzy Approach for Effective Security Risk Assessment

Abstract

Many information assets have been exposed to threats as a result of business owners not having access to an efficient model for classifying their information assets into appropriate security risk levels, required level of protection and priority. Manual and machine learning among several approaches have been employed in classifying information; these were not effective in considering users' preferences and are also not based on security standard. This study proposed a Fuzzy-based Information Asset Classification and Labeling framework based on ISO/IEC 27001 security standard. The framework comprises of six major phases: expert based information asset security assessment and classification (IAC), fuzzy based information assets security assessment and classification (FIACL), information asset labeling, information security risk assessment, and information asset handling and information asset storage. The implementation of the model will be done by developing an automated system with an enhanced classification using fuzzy logic and Delphi method for the security risk assessment. The comparative analysis revealed that FIACL was more efficient and accurate in classifying information assets for proper security risks assessment and control. This model will foster effective classification of information assets in any organization.