Threat analysis for information security

An information security method, comprising:

• receiving a data storage request comprising context information associated with storing a data element, wherein the context information identifies a target data storage device;
• determining a security level associated with the target data storage device, wherein the security level is based on security features associated with the target data storage device;
• determining a protection level range based on the determined security level, wherein the protection level range comprises:
• a maximum protection level for a security control;
• and
• a minimum protection level for a security control;
• identifying one or more security controls within the protection level range, wherein:
• each security control is associated with a protection level for data security;
• and
• each security control comprises a hardware configuration for data storage devices;
• and
• outputting the identified one or more security controls.

A computer program comprising executable instructions stored in a non-transitory computer readable medium that when executed by a processor causes the processor to:

• receive a data storage request comprising context information associated with storing a data element, wherein the context information identifies a target data storage device;
• determine a security level associated with the target data storage device, wherein the security level is based on security features associated with the target data storage device;
• determine a protection level range based on the determined security level, wherein the protection level range comprises:
• a maximum protection level for a security control;
• and
• a minimum protection level for a security control;
• identify one or more security controls within the protection level range, wherein:
• each security control is associated with a protection level for data security;
• and
• each security control comprises a hardware configuration for data storage devices;
• and
• output the identified one or more security controls.