![](bg3.png)
• The Enterprise Tier which is composed by eight
(8) modules, is responsible for creating and han-
dling all S-PORT primary assets (e.g. cartogra-
phy assets, risk assessment assets, risk manage-
ment assets, S-PORT growing documents). The
first module is the Content Management Module
which is responsible for creating, edit-ing, updat-
ing and publishing all S-PORT primary and pro-
cessed content in a consistent and structured way.
The main modules (Cartography, Risk Assess-
ment, Penetration Testing and Risk Management
modules) are responsible for the implementation
of the S-PORT-RM methodology and they handle
and calculate all the basic entities and results of
risk management procedures (i.e. impact / threat
/ vulnerability/risk values of all ICT assets). The
DR-BC Module communicates with Risk Assess-
ment and Risk Management modules in order to
provide the required functionality for the design,
creation and maintenance of Business Continuity
(BC) and Disaster Recovery (DR) plans, accord-
ing to the SPORT-RM results. The Security Mod-
ule provides the essential communicationbetween
the S-PORT main Platform and the Middleware
System in order to ensure the secure access of the
S-PORT content. Finally the Data Layer Module
contains all the necessary functionalities and re-
quired mechanisms in order to achieve the com-
munication and inter-connection among all the
modules of the Enterprise Tier with the Database
Tier.
• the Database Tier hosts all S-PORT assets (such
as ICT assets, impact categories, possible threats,
vulnerabilities etc.) with their attributes and spe-
cific characteristics.
The second S-PORT entity is the Business Pro-
cess Management System (BPMS), which undertakes
the accountability to identify and depict the business
procedures of critical e-services of PICT, in order to
have graphical representation of them and their pri-
mary assets. BPMS communicates through Middle-
ware System with the Cartography module in order
to have the asset identification and asset interconnec-
tions reporting.
The IAM System is responsible for the identity
and access management, incorporates security mech-
anisms and policies that enhance the S-PORT envi-
ronment with proper authentication and authorization
properties enclosing end-user’s preferences and re-
quirements. Based on the above security procedures,
different S-PORT user roles (i.e. administrators, man-
agers, security team, internal, external users of ports)
have access to specific S-PORT services according to
their business role and requirements.
The final S-PORT entity is the Middleware Sys-
tem (an enterprise service bus - ESB) which is a
lightweight messaging framework, ensuring that the
different S-PORT entities, Main Platform, IAM Sys-
tem and BPM System, communicate through a com-
mon channel and the information exchanged is accu-
rate and in standardised format. Additionally, the use
of the Middleware System enables upgrading / expan-
sion or interconnection to any external entity (service
or system) if deemed necessary by future upgrades of
the environment S-PORT.
S-PORT environment offers a bundle of targeted
services to the PICT users in order to guide them to
securely manage their PICT, according to the PDCA
model (i.e. Plan -establish the ISMS, Do - implement
and operate the ISMS, Check - monitor and review
the ISMS, Act - maintain and improve the ISMS) of
the ISO27001 security standard for the design, im-
plementation and monitoring an Information Security
Management System (ISMS).
Specifically the Risk Assessment Services which
consist of the S-PORT-RM Phases responsible for the
Risk Assessment (i.e. Cartography, Impact Assess-
ment, Threat Assessment, Vulnerability Assessment,
Risk Evaluation Phases) will help PICT users to iden-
tify and evaluate the impacts, threats and vulnerabili-
ties of their IT assets. Each of the above Risk Assess-
ment service are conformed with the ISO27001and
guide PICT users to: identify the values of assets and
their owners, identify users and responsibilities, iden-
tify the threats and vulnerabilities to the IT assets,
evaluate business impacts taking into account the con-
sequences in case of loss of Confidentiality, Integrity
or Availability, estimate the risk level, assess the like-
lihood of a threat, esti-mate the risks level of each It
asset, define the criteria accepting risks.
In addition with these services the Practical Vul-
nerability Assessment Service will help them to iden-
tify the practical vulnerabilities with the use of appro-
priate tools. There exists a pool of different penetra-
tion testing tools appropriate for each asset in order to
find their vulnerabilities.
Furthermore the PICT users will be able to select
the appropriate control / countermeasure according to
the S-PORT-RM algorithm in order to protect their IT
assets (with the use of the Risk Management Service)
ensuring that all security requirements are met.
More specifically with the use of the Security Pol-
icy / BCP Service, the PICT users will be able to de-
sign and keep updated the security policy, business
continuity plan and all the necessary documented pro-
cedures (i.e. control of documents, control of records,
internal audits, corrective actions, preventive actions)
of their Information System.
CollaborativeSecurityManagementServicesforPortInformationSystems
307