SecAOnto

Security assessment is crucial to the implementation and use of secure web portals. Literature reports studies about knowledge representation models for systems assessment and information security areas; however, there is a lack of conceptual formalization for the security assessment area. The security assessment ontology (SecAOnto) objective is to formalize knowledge on security assessment. It is based on ontologies, taxonomies, vocabularies, glossaries, and market guidelines. This paper presents an application of SecAOnto with the objective of identifying concepts in descriptions of security assessment items; the coverage of security characteristics is determined by using a coverage calculus algorithm. The application of SecAOnto and of the coverage calculus algorithms to the well-known standard ISO/IEC 27001 highlights its expressiveness. The proposal is useful for security experts and researchers in the context of security assessment, as well as to support web-based conceptual architectures.