Review of international information security standards. The role of information security standards
With the development of information technology, there is a need to standardize requirements in the field of information security. The main task of information security standards is to create a basis for interaction between manufacturers, consumers and certification specialists. Each of these groups has its own interests and views on the problem of information security.
Manufacturers need standards as a means of comparing the capabilities of their products, and in applying the certification procedure as a mechanism for evaluating their properties, as well as in standardizing a certain set of safety requirements that could limit the imagination of the customer of a particular product and force him to choose requirements from this set.
Consumers are interested in a methodology that allows them to choose a product that meets their needs and solves their problems in a timely manner, for which they need a safety assessment scale and a tool with which they can formulate their requirements to manufacturers.
Certification specialists consider standards as a tool that allows them to assess the level of security provided by the system and provide consumers with the opportunity to make an informed choice. Certification specialists are interested in clear and simple criteria, as they must give a reasonable answer to users whether the product meets their needs or not. Ultimately, they are the ones who take responsibility for the safety of a product that has received a safety level qualification and has passed certification.
Thus, information security standards face a difficult task to create an effective mechanism for interaction between all parties.
