search menu icon-carat-right cmu-wordmark

Modeling and Analysis of Information Technology Change and Access Controls in the Business Context

Technical Note
In this report, the authors describe progress in developing a system dynamics model of typical use of change and access controls to support IT operations.
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-2006-TN-040
DOI (Digital Object Identifier)
10.1184/R1/6575642.v1

Abstract

Ongoing field work centered at the Information Technology Process Institute (ITPI) makes clear that processes that control change and access within information technology (IT) management and operations simultaneously reduce security risk and increase efficiency and effectiveness. The CERT's Coordination Center is building on this work. This technical note describes a system dynamics model that embodies CERT's current hypothesis of why and how these controls reduce the problematic behavior of the low-performing IT operation. CERT has also started to extend the model in ways that reflect the improved performance seen by high performers. In the longer term, the hope is that this model will help to specify, explain, and justify a prescriptive process for integrating change and access controls into organizations' business processes in a way that most effectively reduces security risk and increases IT operational effectiveness and efficiency.

Cite This Technical Note

Moore, A., & Antao, R. (2007, March 1). Modeling and Analysis of Information Technology Change and Access Controls in the Business Context. (Technical Note CMU/SEI-2006-TN-040). Retrieved March 29, 2024, from https://doi.org/10.1184/R1/6575642.v1.

@techreport{moore_2007,
author={Moore, Andrew and Antao, Rohit},
title={Modeling and Analysis of Information Technology Change and Access Controls in the Business Context},
month={Mar},
year={2007},
number={CMU/SEI-2006-TN-040},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://doi.org/10.1184/R1/6575642.v1},
note={Accessed: 2024-Mar-29}
}

Moore, Andrew, and Rohit Antao. "Modeling and Analysis of Information Technology Change and Access Controls in the Business Context." (CMU/SEI-2006-TN-040). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, March 1, 2007. https://doi.org/10.1184/R1/6575642.v1.

A. Moore, and R. Antao, "Modeling and Analysis of Information Technology Change and Access Controls in the Business Context," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Note CMU/SEI-2006-TN-040, 1-Mar-2007 [Online]. Available: https://doi.org/10.1184/R1/6575642.v1. [Accessed: 29-Mar-2024].

Moore, Andrew, and Rohit Antao. "Modeling and Analysis of Information Technology Change and Access Controls in the Business Context." (Technical Note CMU/SEI-2006-TN-040). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 1 Mar. 2007. https://doi.org/10.1184/R1/6575642.v1. Accessed 29 Mar. 2024.

Moore, Andrew; & Antao, Rohit. Modeling and Analysis of Information Technology Change and Access Controls in the Business Context. CMU/SEI-2006-TN-040. Software Engineering Institute. 2007. https://doi.org/10.1184/R1/6575642.v1