diff --git a/report/0_Abstract.tex b/report/0_Abstract.tex index b959efc0a99c098fd218f2834380e51a5812535c..c41283036d9a4d7cace573d826b336cb2208e2d3 100644 --- a/report/0_Abstract.tex +++ b/report/0_Abstract.tex @@ -1,7 +1,7 @@ \section*{Abstract} -There are hundreds of cyber security compliance standards, and many businesses require their partner companies and/or members of their supply chain to comply with numerous standards. Keeping track of each company's compliance to a particular standard is a lengthy and potentially expensive process since it can be very difficult to maintain without the use of an external service or consultant. Most SMEs will be unable to afford this - due to the required time and level of experience, it may not be something a system administrator can do on top of their other responsibilities, and a consultant could be too expensive. +Hundreds of cyber security standards exist, and many businesses require their partner companies and/or members of their supply chain to comply with various and numerous of these standards. Keeping track of each company's compliance to a particular standard is a lengthy and potentially expensive process since it can be very difficult to maintain without the use of an external service or consultant and most SMEs will be unable to afford this. Due to the required time and level of experience it may not be something a system administrator could do in addition to their normal responsibilities leaving only the cost alternative of a specialist consultant. -An engine that automatically generates cyber security compliance forms could provide a low cost, time efficient solution for businesses that need a flexible and customisable way of tracing their partner's compliance (or their own compliance) with multiple standards. +To this end, an engine that automatically generates cyber security compliance forms could provide a low cost, time efficient solution for businesses that need a flexible and customisable way of tracing their partners' compliance (or their own compliance) with multiple standards. -The goal of this project is to create a web application system that will generate and store compliance forms for the end user. The forms will be generated by a user, and accessible to specified partners chosen by the user. This will include the ability to update the forms at a later date. The scope of this project includes cyber security compliance - while this project may be relevant to other forms of compliance, the focus will be on compliance within the cyber security field only, with the potential for future work to explore alternative forms of compliance. \ No newline at end of file +Therefore the goal of this project is to create a web application system that will generate and store compliance forms for a non-technical end user and allow access to chosen partners. The scope of this project focuses on the cyber security field but has the potential, with future work, to explore alternative forms of compliance also. \ No newline at end of file diff --git a/report/1_Introduction.tex b/report/1_Introduction.tex index d6db29b245b8e6a7dcceb766f7d6fd8d1c3b98ae..75c179708ab1af67096f6f475daf3b84aefcde95 100644 --- a/report/1_Introduction.tex +++ b/report/1_Introduction.tex @@ -4,11 +4,12 @@ \chapter{INTRODUCTION} \section{Overview} - Many businesses require their partners to comply with numerous and varied cyber security compliances, of which there are literally hundreds. Cyber supply chain risk management (CSCRM) differs from cyber security, by gaining a higher degree of governance over the company in question, and over its extended enterprise partners, such as all its suppliers and customers. Whereas cyber security only considers security of a technical nature, CSCRM attempts to encompass both managerial and human factors in preventing risks from disrupting IT systems\textquoteright\ operations. \cite{CSCRM} + Many businesses require their partners to comply with numerous and varied cyber security compliances, of which there are literally hundreds. % why are you talking about CSCRM? + Cyber supply chain risk management (CSCRM) differs from cyber security, by gaining a higher degree of governance over the company in question, and over its extended enterprise partners, such as all its suppliers and customers. Whereas cyber security only considers security of a technical nature, CSCRM attempts to encompass both managerial and human factors in preventing risks from disrupting IT systems\textquoteright\ operations. \cite{CSCRM} The following chapter will give an overview of the project\textquoteright s goals and objectives. The subsequent chapters will go on to talk about compliance in cyber security, cyber crime, supply chains and the impacts of security breaches on businesses, use cases, requirements, risks and functionality for the proposed application, followed by the proposed design of the implementation for the application. -\section{Problem} +\section{Identification of the Problem} Keeping track of each company\textquoteright s compliance to a specific standard is a lengthy and potentially expensive task since it can be very difficult to maintain without the use of an external service or consultant. Due to the time and experience level required, it is unlikely to be a task a system administrator would be able to perform in addition to their other responsibilities, and a specialist will, in all likelihood, be too expensive for most SMEs. An automatically generated cyber security compliance form engine, could provide a low cost, time efficient solution for businesses that need a flexible, customisable way of tracking their partner\textquoteright s compliance - or their own compliance - with multiple standards.