Information Security Risk Analysis Research Articles

Development of a mechanism for information security risk management of transport service provision systems

The object of the study is the process of analysis, assessment, and management of information security risks in transport service provision systems. The problem of applying the information security risk management approach in the activities of transport business entities was investigated. As a result of the application of effective forms, methods, and means of information security risk management based on international standards, a risk management mechanism was developed. The risk assessment process of transport systems has been systematized. This allows business entities in the transport sector to determine ways to prevent and counter information threats and challenges in their activities, both when designing and operating systems for providing transport services. Verification of the devised methodical approach to information security risk management was carried out on an example of the taxi company «Taxifay N». Threats and challenges of the company’s information system were evaluated by an expert method. Based on the results of the analysis of expert risk assessment, it was found that the concordance coefficient (0.86) confirms the high level of agreement of experts’ opinions. As a result, the company’s information security risk management program was developed. The effectiveness of the program was assessed by the efficiency ratio, which was 0.64. This testifies to the effectiveness of the implemented program of measures to manage information security risks. The scope of application may be the activity of business entities that provide transport services to the population, aimed at data storage and processing. The prospect of this study is to expand the list of threats and categories of vulnerabilities depending on the characteristics of the economic activity of various enterprises

Modeling the Process of Evaluation of Information Security Risks and its Methodology by the Application of Computer Systems

The main aim of the article is to study modeling the process of evaluation of information security risks by the application of computer systems. Thus, information security risk assessment and analysis of existing methods of information security risk assessment had been also studied in the article. The term "risk of information security" (IS) applies to the damage that can attack the information technology systems. IS risk is a wide range of potential threats, especially includes data violations, control measures, financial costs, reputation damage, etc. cover issues such as. IS risks include the failure of hardware and software, human errors, spams, viruses and harmful attacks, as well as natural disasters such as fires, cyclones or floods. Security risk assessment determines, assesses and implements key security controls in applications. It also focuses on prevention of software security defects and vulnerabilities. Information security risk is the potential probability of using vulnerabilities of an asset or group of assets as a specific threat to damage the organization.

Analisis Resiko Keamanan Informasi Website Repository Digital Library Menggunakan Framework ISO/IEC 27001 & 27002: Studi Kasus Perguruan tinggi X

The continuous evolution of digital repositories in the era of globalization, especially in context of higher education digital libraries, poses security risks that raise concerns among users. Existence of sensitive user data that requires protection by universities adds to this concern. This research aims to conduct comprehensive analysis of information security risks associated with digital library repository websites. This research seeks to identify potential vulnerabilities, threats that could compromise the confidentiality, integrity and availability of digital assets stored in repositories. Through detailed risk analysis, this research provides actionable insights and recommendations to improve the information security posture of digital libraries using the ISO/IEC 27001 and 27002 IT governance framework specifically tailored to information security standards. This research uses a literature review and interviews with responsible parties at the University of X's digital library repository. Findings show that the use of tools such as Acunetix helps identify vulnerabilities in web repositories. Risk mitigation in digital library web repositories involves the application of ISO/IEC 27001, 27002 standards, which results in specific risk mitigation actions. For example, universities should create policies to monitor information technology assets, ensuring regular monitoring to protect technology assets. In addition, for Database Management System (DBMS) management (e.g., MySQL, PostgreSQL, Oracle, Ms SQL Server), colleges must facilitate easy access and storage of information. By implementing the recommendations obtained from this research, higher education institutions can ensure safe environment for users accessing digital library web repositories, thereby reducing concerns about the security of their information.

Анализ рисков информационной безопасности в пищевой промышленности с использованием системы нечеткого вывода

Recently, different attempts have been made to characterize information security threats, particularly in the industrial sector. Yet, there have been a number of mysterious threats that could jeopardize the safety of food processing industry data, information, and resources. This research paper aims to increase the efficiency of information security risk analysis in food processing industrial information systems, and the participants in this study were experts in executive management, regular staff, technical and asset operators, third-party consultancy companies, and risk management professionals from the food processing sector in Sub-Saharan Africa. A questionnaire and interview with a variety of questions using qualitative and quantitative risk analysis approaches were used to gather the risk identifications, and the fuzzy inference system method was also applied to analyze the risk factor in this paper. The findings revealed that among information security concerns, electronic data in a data theft threat has a high-risk outcome of 75.67%, and human resource management (HRM) in a social engineering threat has a low-risk impact of 26.67%. Thus, the high-probability risk factors need quick action, and the risk components with a high probability call for rapid corrective action. Finally, the root causes of such threats should be identified and controlled before experiencing detrimental effects. It's also important to note that primary interests and worldwide policies must be taken into consideration while examining information security in food processing industrial information systems.

Risk Analysis of Information Security in Balikpapan International Airport Service Desk Plus (SDP) Using The Octave Allegro Method

Indonesia, as a developing country, is not exempt from the advancements in information and communication technology. However, these advancements in information and communication technology can bring negative impacts, such as an increasing threat of misuse. SDP (Service Desk Plus) is a system that serves as a management tool for IT services, facilitating employees from various departments in requesting services and reporting ICT (Information Communication Technology) incidents. SDP has faced challenges or obstacles that have hindered its optimal use, such as IT services experiencing downtime, inaccessible ICT services, and SDP users frequently sharing usernames and passwords. Based on these threats, it is necessary to conduct a further analysis of information security risks regarding the security of implementing SDP centrally using the OCTAVE Allegro method. OCTAVE Allegro is a framework that utilizes the OCTAVE approach with a primary focus on information assets, designed to provide faster results without requiring in-depth knowledge of risk assessment. The results of this research identified three risks that can be mitigated, namely user data password errors with a relative risk score of 27, internet downtime with a relative risk score of 31, and file intrusion with a relative risk score of 38, considering the likelihood of threats occurring. Additionally, there is one accepted risk, which is the input error of incident data, with a relative risk score of 19.

Analysis and assessment of information security risks for sustainable development of the oil and gas industry

The problem of ever-evolving and growing risks never ceases to be an issue. Organizations in the oil and gas industry need to spend more and more money on protection, look for more qualified workers or train their staff on various innovations in this field. After many foreign vendors left the Russian market due to sanctions, threats that were minor have become more dangerous. Since even the most common risk in the form of, for example, a phishing link can become a big problem if it is partially disabled or there is no full protection of the functionality. Therefore, it is necessary to create their own software, their own methods of assessing risk events in information security, which will correspond to different areas of risk situations and at the same time have the quality of services, good functionality, not high cost and excellent quality. This article discusses a new unified method of information security containing the positive qualities of other methods and standards for assessing information security risks, but with the elimination of their shortcomings with the possibility of application in organizations of the oil and gas industry.

Information security risk analysis in the networks of the industrial internet of things

With the rapid development of the Industrial Internet of Things (IIoT), there has been a need to respond quickly, detect and prevent intrusions. These problems are especially relevant due to the projected growth in IIoT users. Risk assessment is an important part of the process of creating information security systems, including industrial complexes. The aim of this work is to develop a practical model for assessing information security risks in industrial Internet of Things networks. The proposed model is based on a simple additive weighting method and fuzzy logic. Fuzzy logic is appropriate for risk assessment and represents practical results. The implementation of the process of fuzzy modeling of the rule base is carried out by using the specialized package Fuzzy Logic Toolbox of the MATLAB software tool.

Methodology of information security risk analysis based on quantitative assessment of damages in information and technical systems bodies of the internal affairs

Objective. Assessment of the consequences of the occurrence of damage cases in the information and technical systems (ITS) of the internal affairs bodies (ATS) requires the use of an analysis of the risks of damage as a result of the implementation of information security threats.Method. In order to analyze the processes occurring in the ITS, as a rule, mathematical modeling is used. For ITS, due to the high technological complexity, high costs for the acquisition, maintenance of equipment and payment of wages to employees, it is necessary to apply the procedure for analyzing the risks of ITS ITS. The security of the functioning of the ITS ITS is normative, since at the moment the method of quantitative assessment of damages is insufficiently developed. The development of this scientific application would make it possible to establish the appropriate value of the indicator of the permissible risk of the implementation of threats to information security. Analytical and mathematical modeling using the apparatus of queuing systems. Result. A technique for analyzing the risks of information security violations based on a quantitative assessment of the damages of the ITS of ATS is given. Conclusion. The direction of this study is relevant and requires further elaboration in order to improve the method for assessing the occurrence of damage in the ITS of the internal affairs bodies.

Research on Information Security Risk Analysis and Prevention Technology of Network Communication Based on Cloud Computing Algorithm

Data communication network must use telephone, cable or optical fiber as transmission medium and computer as information receiving, output and communication tool. Customers can not only process the received information, but also realize information sharing through the network. With the wide application of network communication in daily life, network security issues have higher requirements. In order to solve the problems of subjectivity, long modeling time and low classification accuracy of information security risk assessment methods, this paper first proposes an intelligent information security risk assessment method based on decision tree. Compared with other classification algorithms such as support vector machine, the decision tree classification algorithm has no requirement for data category distribution, and has good classification effect and fast speed. Finally, this paper introduces the security measures in network data communication for reference only.

A Method of Simplifying the Asset Dependency Cycle in Security Risk Analysis

In recent years, one obstacle to information security risk analysis is the complexity of asset dependency. Developing research tends to produce models with great complexity and some that do not involve dependency cycles, make the model difficult to implement. This research developed the idea of compound nodes to produce a modular risk analysis that simplify the asset dependency cycle. This study uses the following assumptions: aimed at quantitative assessments, values based on likelihood, and based on graph basic models. The stages of the method consist of identification of cyclic in the initial model, reconstructing cyclic graph into acyclic graph, and reconstruction of cyclic sub graph into acyclic sub graph. Through an illustrative example, this research produces a method that helps facilitate understanding the complexity of asset dependencies in risk analysis.

E-commerce supply chain management mode based on management information security

In the era of high informationization, supply chain management, as a symbol of a management era, brings us not only a new management tool, but also more importantly, updated management concepts and replanning, design, and ways to optimize business processes. The purpose of this article is to study the current information security issues that are common in China’s supply chain, such as the weak awareness of information security among corporate employees; the widespread disregard of information security management; the lack of a unified information security strategic planning and prevention mechanism; adverse selection risks and various defeats. In the specific application, starting from the overall business needs of the supply chain, referring to the framework of the supply chain information security system, through assessment and risk analysis, the security needs of the supply chain and its nodes are defined, and finally the e-commerce supply based on management information security is developed. Chain management mode. The experimental data show that the e-commerce supply chain management model based on management information security can effectively improve e-commerce operation efficiency and improve security performance. Experimental data show that the management mode of e-commerce supply chain management improves the security efficiency of e-commerce by about 20% and the operating efficiency by about 15%. The development of e-commerce is instructive.

Method for Attack Tree Data Transformation and Import Into IT Risk Analysis Expert Systems

Information technology (IT) security risk analysis preventatively helps organizations in identifying their vulnerable systems or internal controls. Some researchers propose expert systems (ES) as the solution for risk analysis automation since risk analysis by human experts is expensive and timely. By design, ES need a knowledge base, which must be up to date and of high quality. Manual creation of databases is also expensive and cannot ensure stable information renewal. These facts make the knowledge base automation process very important. This paper proposes a novel method of converting attack trees to a format usable by expert systems for utilizing the existing attack tree repositories in facilitating information and IT security risk analysis. The method performs attack tree translation into the Java Expert System Shell (JESS) format, by consistently applying ATTop, a software bridging tool that enables automated analysis of attack trees using a model-driven engineering approach, translating attack trees into the eXtensible Markup Language (XML) format, and using the newly developed ATES (attack trees to expert system) program, performing further XML conversion into JESS compatible format. The detailed method description, along with samples of attack tree conversion and results of conversion experiments on a significant number of attack trees, are presented and discussed. The results demonstrate the high method reliability rate and viability of attack trees as a source for the knowledge bases of expert systems used in the IT security risk analysis process.

Information Security Risk Analysis Methods for Healthcare Systems

Information and risk analysis in healthcare system is an important issue in the modern technological growth. There are many systems implemented for information security and risk management for information protection. Proper guidance is needed to select the system as all the systems concentrate on information security of healthcare system. The information threats and risk are increasing, and all the issues are integrated to the vulnerabilities producing risk for the healthcare security. The healthcare system process structure and variation are advocated, in which operating performance indication is based on risk scaling factor so that dynamic information security risk analysis is needed. This paper is proposed for information security risk analysis in which the resources, risk threats, vulnerabilities that control the healthcare system. The paper compares the various inputs and outputs are needed by different systems of information security risk assessment and analysis that accurately presents the information security risk. At present, large number of information security risk analysis methodologies are present in the worldwide. Important and efficient methodologies are considered for comparison and quantitative purpose to choose most suitable methodology for healthcare system.

Network Information Security Risk Assessment Based on Artificial Intelligence

With the development of society and the progress of human civilization, science and technology are more and more widely used in people’s daily production and life, and artificial intelligence technology is also more and more widely used in this era. With the advent of the information age, the development of the network is faster and faster, and the popularization rate is higher and higher. The network information security problem has gradually become a hot issue of social concern question. With the increasingly open network environment, network attack tools become easier to obtain, more automated, more intelligent, which poses a huge challenge to information security protection. Therefore, in order to deal with the network information security problems in this information age, this paper studies the method of network information security risk assessment and analysis based on artificial intelligence, through in-depth study of network information security, simulate attacks on network information, so as to find the weakness of the current network information security system. In the research, a large number of network information security vulnerabilities are found by simulating the attack of network information, so as to repair the vulnerabilities one by one. Through the analysis, this paper studies the Content Filtering Gateway filtering system to filter out 94.8% of the virus and garbage, improve the network information security rate.

Automated Expert System Knowledge Base Development Method for Information Security Risk Analysis

Information security risk analysis is a compulsory requirement both from the side of regulating documents and information security management decision making process. Some researchers propose using expert systems (ES) for process automation, but this approach requires the creation of a high-quality knowledge base. A knowledge base can be formed both from expert knowledge or information collected from other sources of information. The problem of such approach is that experts or good quality knowledge sources are expensive. In this paper we propose the problem solution by providing an automated ES knowledge base development method. The method proposed is novel since unlike other methods it does not integrate ontology directly but utilizes automated transformation of existing information security ontology elements into ES rules: The Web Ontology Rule Language (OWL RL) subset of ontology is segregated into Resource Description Framework (RDF) triplets, that are transformed into Rule Interchange Format (RIF); RIF rules are converted into Java Expert System Shell (JESS) knowledge base rules. The experiments performed have shown the principal method applicability. The created knowledge base was later verified by performing comparative risk analysis in a sample company.

ПРОВЕДЕННЯ SWOT-АНАЛІЗУ ОЦІНЮВАННЯ ІНФОРМАЦІЙНИХ РИЗИКІВ ЯК ЗАСІБ ФОРМУВАННЯ ПРАКТИЧНИХ НАВИЧОК СТУДЕНТІВ СПЕЦІАЛЬНОСТІ 125 КІБЕРБЕЗПЕКА

This article examines the problem of implementing active teaching methods for students majoring in 125 Cybersecurity. The study of qualitative analysis of information security risks (IS) is presented on the example of studying the discipline "Risk Theory", namely the use of SWOT-analysis tools for risk assessment in the field of IS of small and medium business. General relevance and possibilities of using SWOT-analysis in the field of IS risk to study the internal environment of the organization, its strengths and weaknesses with the definition of enterprise strategies in the external environment: confronting threats to secure information (confidentiality, availability and integrity), and other its development. Based on scientific sources, the main research of the definition is analyzed: IS risks, risk analysis and their quality assessment. The content and procedure of SWOT-analysis are described. Using forms of group work and active methods (trainings) in the educational process, the basic factors for SWOT-analysis of the virtual organization "Internet Provider" were created, methodical expert assessments were conducted to identify the primary features of these factors, the analysis of the results was obtained.It is proved that the introduction of this technology in the educational process promotes the development of theoretical knowledge and the formation and development of practical skills of future specialists in information and cyber security

Construction of Human Motivational Profiles by Observation for Risk Analysis

This study aimed at analyzing the extent to which publicly observable pieces of information representing stakeholders' past and current choices can be utilized for the construction of motivational profiles. Motivation is operationalized by the theory of Basic Human Values, which organizes 10 values capturing distinct aspects of human motivation into a hierarchical order. The construction of motivational profiles for individual stakeholders is motivated by the need to enhance the existing decision-maker model in the Conflicting Incentives Risk Analysis (CIRA) method. This study utilized an online questionnaire to collect responses from participants (n = 331) about a wide range of habits and personal items that are easily observable in various contexts by an analyst. The validity of the set of observables as surrogate predictors of the motivational profiles is evaluated by various methods (i.e., comparison to previous results, cross-validation of models, comparison to test-retest reliability of the psychometric instrument) and techniques (calculation of prediction interval for individual profile scores). The assessment of the uncertainties associated with predicting motivational profiles is explored in detail. Additionally, an example illustrates how the profiles can be utilized for the assessment of action desirability (i.e., prediction of behavior) based on the utility calculations established in CIRA. The results contribute to an improved understanding about the accuracy with which human stakeholder motivation can be inferred from public observables and utilized within the context of information security risk analysis.

Improving information security risk analysis by including threat-occurrence predictive models

Protecting information is a crucial issue in today society, in both work and home environments. Over the years, different tools and technologies have contributed to safeguarding information, including risk analysis methodologies developed to evaluate the risk of threat materialization despite security measures. Traditional risk analysis methodologies base risk computation on, among other parameters, the frequency of occurrence of threats, which is gathered from available historical data. However, as new safeguards are implemented, and vulnerability potential changes, threat frequencies may also change.To take into account the current state of an organization’s system as well as historical data, we propose to substitute past threat frequency by the probability of a threat occurring in the future. To compute this future threat probability, we use regression models, validated by a risk analysis for a Spanish SME based on Magerit (Spanish adaptation of ISO/IEC 27005). The results show that the future probability of each threat can be calculated with accuracy, precision, sensitivity and specificity rates above 70%.Obtaining a more realistic risk estimate (reflecting to the current state of vulnerabilities) is translated into the adoption of better and more efficient safeguards that reduce losses and improve information security in a business.

Risk and Vulnerability Analyses for the protection of Information for Future communication security Based Neural Networks

Information security risk analysis has increased the number of complex issues of information security, requiring the participation of specialists in different areas of knowledge. This leads to inability of such systems to evaluate the security state of computer system thoroughly.Present paper on the intellectual to risk analysis and vulnerability of information systems. The aim of the study is to eliminate subjectivity in the assessment of risks and reduction of time for the process of risk analysis and vulnerability of the computer system. The mathematical tools of artificial neural network and probabilistic attack tree were used in the research. In order to evaluate the efficiency of the developed system, the security assessment for the Windows systems was performed. As the result the conformity between the real security of the information system and the assigned evaluations was proved.
 
 © 2018 JASET, International Scholars and Researchers Association

AHP\u2013TOPSIS integration extended with Pythagorean fuzzy sets for information security risk analysis

Risk analysis (RA) contains several methodologies that object to ensure the protection and safety of occupational stakeholders. Multi attribute decision-making (MADM) is one of the most important RA methodologies that is applied to several areas from manufacturing to information technology. With the widespread use of computer networks and the Internet, information security has become very important. Information security is vital as institutions are mostly dependent on information, technology, and systems. This requires a comprehensive and effective implementation of information security RA. Analytic hierarchy process (AHP) and technique for order preference by similarity to ideal solution (TOPSIS) are commonly used MADM methods and recently used for RA. In this study, a new RA methodology is proposed based on AHP–TOPSIS integration extended with Pythagorean fuzzy sets. AHP strengthened by interval-valued Pythagorean fuzzy numbers is used to weigh risk parameters with expert judgment. Then, TOPSIS with Pythagorean fuzzy numbers is used to prioritize previously identified risks. A comparison of the proposed approach with three approaches (classical RA method, Pythagorean fuzzy VIKOR and Pythagorean fuzzy MOORA) is also provided. To illustrate the feasibility and practicality of the proposed approach, a case study for information security RA in corrugated cardboard sector is executed.