Information Security Risk Assessment Research Articles

Development of a Flexible Information Security Risk Model Using Machine Learning Methods and Ontologies

This paper presents a significant advancement in information security risk assessment by introducing a flexible and comprehensive model. The research integrates established standards, expert knowledge, machine learning, and ontological modeling to create a multifaceted approach for understanding and managing information security risks. The combination of standards and expert insights forms a robust foundation, ensuring a holistic grasp of the intricate risk landscape. The use of cluster analysis, specifically applying k-means on information security standards, expands the data-driven approach, uncovering patterns not discernible through traditional methods. The integration of machine learning algorithms in the creation of information security risk dendrogram demonstrates effective computational techniques for enhanced risk discovery. The introduction of a heat map as a visualization tool adds innovation, facilitating an intuitive understanding of risk interconnections and prioritization for decision makers. Additionally, a thesaurus optimizes risk descriptions, ensuring comprehensiveness and relevance despite evolving terminologies in the dynamic field of information security. The development of an ontological model for structured risk classification is a significant stride forward, offering an effective means of categorizing information security risks based on ontological relationships. These collective innovations enhance understanding and management of information security risks, paving the way for more effective approaches in the ever-evolving technological landscape.

Penetration Study of Key Technologies for Cybersecurity Risk Assessment

In recent years, with the frequent occurrence of cyber security incidents, people have paid more attention to it. Information security risk assessment is a very important research topic. This paper gives a brief overview of the theory of cybersecurity risk assessment, focuses on the description of the current mainstream cybersecurity risk assessment methods, classifies and compares the existing methods according to the nature of the methods, and analyses the advantages, disadvantages, and application scope of each method. Finally, the main factors affecting the evaluation results are summarized and refined, and future research hotspots in this field are proposed. Through the empirical analysis of the three factors, the influence of the correlation of the three factors, the uncertainty of the evaluation indexes, and the timeliness of the evaluation on the evaluation results are concluded, which provides a reference for future research on evaluation methods.

Strategic Approaches in Network Communication and Information Security Risk Assessment

Strategic Approaches in Network Communication and Information Security Risk Assessment

FRAMB: A man-machine cooperation risk assessment method for intelligent network information systems

The intelligent network information systems, such as smart grid systems, face many security problems in the aspects of sensing, communication and computing. Information security risk assessment is an important way to assess the threats faced by information systems before risk events occur and ensure the security of assets. However, a comprehensive risk assessment of the system is a very resource-consuming process. Many existing risk assessment methods rely on a large number of experts and computing resources. Their assessment results are vulnerable to the differences in experts’ subjective judgments. Therefore, we propose FRAMB, a novel man-machine collaborative risk assessment method based on fitting upper and lower bounds. Firstly, we present a risk assessment criterion including four categories and sixteen risk factors following the ISO/IEC 27005:2018 standard. On this basis, we present the DFAHP and CM-NN assessment models to obtain the upper and lower bounds of the risk assessment value, which provides a reference for expert assessment. FRAMB integrates the experts’ assessment value and the values of upper and lower bounds, and adjusts the weights of these values to give the final risk assessment value. We introduce the risk assessment process of FRAMB in detail through a case study of the smart grid system risk assessment. We evaluate the effectiveness and accuracy of FRAMB through experiments. The experimental results show that FRAMB can effectively and accurately assess the security risks of the intelligent network information systems.

Оценка рисков информационной безопасности в отраслевой информационной системе на основе теории нечетких множеств и искусственной нейронной сети

Information security risk assessment is a crucial component of industrial management techniques that aids in identifying, quantifying, and evaluating risks in comparison to criteria for risk acceptance and organizationally pertinent objectives. Due to its capacity to combine several parameters to determine an overall risk, the traditional fuzzy-rule-based risk assessment technique has been used in numerous industries. The technique has a drawback because it is used in situations where there are several parameters that need to be evaluated, and each parameter is expressed by a different set of linguistic phrases. In this paper, fuzzy set theory and an artificial neural network (ANN) risk prediction model that can solve the issue at hand are provided. Also developed is an algorithm that may change the risk-related factors and the overall risk level from a fuzzy property to a crisp-valued attribute is developed. The system was trained by using twelve samples representing 70%, 15%, and 15% of the dataset for training, testing, and validation, respectively. In addition, a stepwise regression model has also been designed, and its results are compared with the results of ANN. In terms of overall efficiency, the ANN model (R2= 0.99981, RMSE=0.00288, and MSE=0.00001,) performed better, though both models are satisfactory enough. It is concluded that a risk-predicting ANN model can produce accurate results as long as the training data accounts for all conceivable conditions.

ЭФФЕКТИВНОСТЬ АВТОМАТИЗИРОВАННОГО УПРАВЛЕНИЯ ТРАНСПОРТНЫМИ СРЕДСТВАМИ В ТРАМВАЙНЫХ СИСТЕМАХ

The intellectualization of water transport is accompanied by an expansion of the landscape of threats to transport security, caused by the characteristics and weaknesses of the technologies being introduced, which are the convergence of information and telecommunication technologies, automated and automatic control technologies and artificial intelligence. The peculiarity of these technologies is working with large volumes of information. Violation of the security of information processed in intelligent systems of water transport (illegal access, modification, deletion and similar unauthorized influence) causes a violation of transport security and, as a consequence, the security of critical information infrastructure and the country’s critical infrastructure, national security. Convergent technologies used in intelligent transport systems are characterized by multiple and poorly formalized manifestations of the consequences of threats. The article presents a model for assessing the risks of information security of intelligent water transport systems, based on the methods of the theory of fuzzy sets and fuzzy logic, the use of which makes it possible to take into account the above-mentioned features of the technologies being implemented. The hierarchical structure of the model and the use of fuzzy set theory and fuzzy logic methods make it possible to adapt the model to various risk criteria, types of input data and the level of detail of risk analysis. For the presented model, a methodology for assessing information security risks has been developed and an example of risk calculation is given. The developed model and methodology are intended to build an information security risk management system for autonomous shipping, implementing technologies of hybrid (augmented, extended) intelligence, providing for the use of artificial intelligence controlled by people.

НЕЧЕТКАЯ СИСТЕМА ОЦЕНКИ РИСКОВ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ ИНТЕЛЛЕКТУАЛЬНЫХ СИСТЕМ ВОДНОГО ТРАНСПОРТА

The intellectualization of water transport is accompanied by an expansion of the landscape of threats to transport security, caused by the characteristics and weaknesses of the technologies being introduced, which are the convergence of information and telecommunication technologies, automated and automatic control technologies and artificial intelligence. The peculiarity of these technologies is working with large volumes of information. Violation of the security of information processed in intelligent systems of water transport (illegal access, modification, deletion and similar unauthorized influence) causes a violation of transport security and, as a consequence, the security of critical information infrastructure and the country’s critical infrastructure, national security. Convergent technologies used in intelligent transport systems are characterized by multiple and poorly formalized manifestations of the consequences of threats. The article presents a model for assessing the risks of information security of intelligent water transport systems, based on the methods of the theory of fuzzy sets and fuzzy logic, the use of which makes it possible to take into account the above-mentioned features of the technologies being implemented. The hierarchical structure of the model and the use of fuzzy set theory and fuzzy logic methods make it possible to adapt the model to various risk criteria, types of input data and the level of detail of risk analysis. For the presented model, a methodology for assessing information security risks has been developed and an example of risk calculation is given. The developed model and methodology are intended to build an information security risk management system for autonomous shipping, implementing technologies of hybrid (augmented, extended) intelligence, providing for the use of artificial intelligence controlled by people.

Development of a mechanism for information security risk management of transport service provision systems

The object of the study is the process of analysis, assessment, and management of information security risks in transport service provision systems. The problem of applying the information security risk management approach in the activities of transport business entities was investigated. As a result of the application of effective forms, methods, and means of information security risk management based on international standards, a risk management mechanism was developed. The risk assessment process of transport systems has been systematized. This allows business entities in the transport sector to determine ways to prevent and counter information threats and challenges in their activities, both when designing and operating systems for providing transport services. Verification of the devised methodical approach to information security risk management was carried out on an example of the taxi company «Taxifay N». Threats and challenges of the company’s information system were evaluated by an expert method. Based on the results of the analysis of expert risk assessment, it was found that the concordance coefficient (0.86) confirms the high level of agreement of experts’ opinions. As a result, the company’s information security risk management program was developed. The effectiveness of the program was assessed by the efficiency ratio, which was 0.64. This testifies to the effectiveness of the implemented program of measures to manage information security risks. The scope of application may be the activity of business entities that provide transport services to the population, aimed at data storage and processing. The prospect of this study is to expand the list of threats and categories of vulnerabilities depending on the characteristics of the economic activity of various enterprises

Modeling the Process of Evaluation of Information Security Risks and its Methodology by the Application of Computer Systems

The main aim of the article is to study modeling the process of evaluation of information security risks by the application of computer systems. Thus, information security risk assessment and analysis of existing methods of information security risk assessment had been also studied in the article. The term "risk of information security" (IS) applies to the damage that can attack the information technology systems. IS risk is a wide range of potential threats, especially includes data violations, control measures, financial costs, reputation damage, etc. cover issues such as. IS risks include the failure of hardware and software, human errors, spams, viruses and harmful attacks, as well as natural disasters such as fires, cyclones or floods. Security risk assessment determines, assesses and implements key security controls in applications. It also focuses on prevention of software security defects and vulnerabilities. Information security risk is the potential probability of using vulnerabilities of an asset or group of assets as a specific threat to damage the organization.

Exploring the critical success factors of information security management: a mixed-method approach

Purpose Effective information security management (ISM) contributes to building a healthy organizational digital ecology. However, few studies have built an analysis framework for critical influencing factors to discuss the combined influence mechanism of multiple factors on ISM performance (ISMP). This study aims to explore the critical success factors and understand how these factors contribute to ISMP. Design/methodology/approach This study used a mixed-method approach to achieve this study’s research goals. In Study 1, the authors conducted a qualitative analysis to take a series of International Organization for Standardization/International Electrotechnical Commission standard documents as the basis to refine the critical factors that may influence organizations’ ISMP. In Study 2, the authors built a research model based on the organizational control perspective and used the survey-based partial least squares-based structural equation modeling (PLS-SEM) approach to understand the relationships between these factors in promoting ISMP. In Study 3, the authors used the fuzzy set qualitative comparative analysis (fsQCA) method to empirically analyze the complex mechanisms of how the combinations of the factors affect ISMP. Findings The following three research findings are obtained. First, based on the text-based qualitative analysis, the authors refined the critical success factors that may increase ISMP, including information security policies (ISP), top management support (TMS), alignment (ALI), information security risk assessment (IRA), information security awareness (ISA) and information security culture (ISC). Second, the PLS-SEM testing results confirmed TMS is the antecedent variable motivating organization’s formation (ISP) and information control (ISC) approaches; these two types of organization control approaches increase IRA, ISA and ALI and then promote ISMP directly and indirectly. Third, the fsQCA testing results found two configurations that can achieve high ISMP and one driving path that leads to non-high ISMP. Originality/value This study extends knowledge by exploring configuration factors to improve or impede the performances of organizations’ ISM. To the best of the authors’ knowledge, this study is one of the first to explore the use of the fsQCA approach in information security studies, and the results not only revealed causal associations between single factors but also highlighted the critical role of configuration factors in developing organizational ISMP. This study calls attention to information security managers of an organization should highlight the combined effect between the factors and reasonably allocate organizational resources to achieve high ISMP.

Graph-based two-level indicator system construction method for smart city information security risk assessment

<p>The rapid development of urban informatization has led to a deep integration of advanced information technology into urban life. Many decision-makers are starting to alleviate the adverse effects of this informatization process through risk assessment. However, existing methods cannot effectively analyze internal and hierarchical relationships because of the excessive number of indicators. Thus, it is necessary to construct an indicator's dependency graph and conduct a comprehensive hierarchical analysis to solve this problem. In this study, we proposed a graph-based two-level indicator system construction method. First, a random forest was used to extract the indicators' dependency graph from missing data. Then, spectral clustering was used to separate the graph and form a functional subgraph. Finally, PageRank was used to calculate the prioritization for each subgraph's indicator, and the two-level indicator system was established. To verify the performance, we took China's 25 smart cities as examples. For the simulation of risk level prediction, we compared our method with some machine learning algorithms, such as ridge regression, Lasso regression, support vector regression, decision trees, and multi-layer perceptron. Results showed that the two-level indicator system is superior to the general indicator system for risk assessment.</p>

Personal Information Security Risk Assessment for E-Waste Recycling Based on Fuzzy–GRA–TOPSIS and FMEA

Personal Information Security Risk Assessment for E-Waste Recycling Based on Fuzzy–GRA–TOPSIS and FMEA

Methods for determining the categories of cyber incidents and assessing information security risks

The article is devoted to the study of categories of cyber incidents and their prioritization in the context of information security. It discusses the main sources that provide information about cyber threats and defines their role in detecting and analyzing incidents, and provides tools for collecting and analyzing data. The concepts of event, incident, and crime and the relationship between them are discussed. The author provides a classification of various types of cyber threats, how they are coded, their characteristics and impact on information systems. Examples of the use of cyber incident classification are given. The authors of the article also consider specific types of cyber incidents that may occur in various fields of activity and the threats they pose to various information systems. The necessity and methods of determining priorities in responding to cyber threats are substantiated, which allows for the effective allocation of resources and the implementation of preventive cyber security measures. The approach to assessing and classifying incidents according to their possible impact on the organization's activities, information security and ability to recover from cyber attacks is revealed. The article highlights various approaches and methodologies for identifying and managing information security risks, including the use of standards, models and assessment tools. This article is a resource for cybersecurity professionals, researchers, and executives interested in risk management and information asset protection in today's digital environment.

Digital media system design and visual art analysis based on information security

BackgroundWith the growing maturity of Internet technology and 5G transmission technology, digital media systems begin to present more complex scenario applications. Software design security issues are also increasingly evident in digital media systems. This paper analyzes the security issues of digital media system design from the perspective of software protection security. Discussed based on the information security digital media system design and visual art analysis. MethodsThis paper discusses based on the software security protection design and visual art analysis, first proposed the media convergence and information security risk assessment research, including media convergence cognition, information security risk management theory, system information security risk assessment methods and based on the media under the digital certificate. Secondly, the information security algorithm based on digital media technology is studied. From the basic knowledge of digital image, a method of image encryption based on the change of pixel value, the common algorithm of digital image watermarking technology and the encryption technology of digital media are summarized. ResultsExperiments were carried out on three art painting data sets, including Painting91, Oil Painting and Pandora. Compared with the existing label distribution learning methods on the Painting91style dataset, the algorithms SA-IIS and SA-BFGS achieve the classification accuracy of 65.51 % and 66.52 %, respectively. The classification result of the baseline method of VGGNet is 63.89 % on the OilPainting dataset. On the Pandora-style dataset, the classification accuracy of MSCNN1 method is 71.32 %, and the experimental results of CNNF4 method reach 71.76 %. ConclusionThe method proposed in this paper has good application results in different data sets, and the digital media art design system has high reliability and fault tolerance. From the perspective of information security, different index systems have higher security levels.

Fuzzy Logic and Its Application in the Assessment of Information Security Risk of Industrial Internet of Things

This article addresses the issue of information security in the Industrial Internet of Things (IIoT) environment. Information security risk assessment in the IIoT is complicated by several factors: the complexity and heterogeneity of the system, the dynamic nature of the system, the distributed network infrastructure, the lack of standards and guidelines, and the increased consequences of security breaches. Given these factors, information security risk assessment in the IIoT requires a comprehensive approach adapted to the peculiarities and requirements of a particular system and industry. It is necessary to use specialized risk assessment methods and to take into account the context and peculiarities of the system. The method of information security risk assessment in the IIoT, based on the mathematical apparatus of fuzzy set theory, is proposed. This paper analyzes information security threats for IIoT systems, from which the most significant criteria are selected. The rules, based on which decisions are made, are formulated in the form of logical formulas containing input parameters. Three fuzzy inference systems are used: one to estimate the probability of threat realization, another to estimate the probable damage, and a final one to estimate the information security risk for the IIoT system. Based on the proposed method, examples of calculating the information security risk assessment in the IIoT environment are provided. The proposed scientific approach can serve as a foundation for creating expert decision support systems for designing IIoT systems.

Integrating NIST and ISO Cybersecurity Audit and Risk Assessment Frameworks into Cameroonian Law

This paper reviews cybersecurity laws and regulations in Cameroon, focusing on cybersecurity and information security audits and risk assessments. The importance of cybersecurity risk assessment and the implementation of security controls to cure deficiencies noted during risk assessments or audits is a critical step in developing cybersecurity resilience. Cameroon's cybersecurity legal framework provides for audits but does not explicitly enumerate controls. Consequently, integrating relevant controls from the NIST frameworks and ISO Standards can improve the cybersecurity posture in Cameroon while waiting for a comprehensive revision of the legal framework. NIST and ISO are internationally recognized as best practices in information security systems and cybersecurity risk management. This paper highlights the lack of specific international law provisions addressing cybersecurity audits and risk assessments. Overall, the paper highlights the importance of continuous risk assessment and monitoring, implementation of security controls, and compliance with organizational policies, relevant laws and regulations to ensure the adequate protection of information systems. Finally, the paper underscores the importance of improving Cameroon's cybersecurity regulations by integrating provisions from NIST and ISO.

Intelligent decision support system for assessing information security risks of ICS

The relevance of the article is due to the need to ensure information security of industrial control systems (ICS). Loss of control over industrial facilities can lead to undesirable consequences in a particular subject of the state or affect the economic indicators of the country as a whole as well as compromise the safety of the population. In this regard, this article aims to improve the procedure for quantitative assessment of information security risks as a necessary component of an integrated approach to ensuring information security, which helps to assess the feasibility of information security violation scenarios and identify their possible consequences for building an effective protection system. The architecture of a research prototype of an intelligent decision support system and a software implementation of tools for automating the modeling of attack scenarios and assessing the information security risks of ICS have been developed, the use of which makes it possible to increase the reliability and efficiency of information security risk assessment and, consequently, the choice of effective countermeasures at all stages of an industrial facility life cycle and its complex protection systems. The materials of the article are of practical value for information security specialists at all stages of the life cycle of distributed information and control systems of industrial facilities. Актуальность статьи обусловлена необходимостью обеспечения информационной безопасности (ИБ) автоматизированных систем управления технологическими процессами (АСУ ТП) промышленных объектов. Потеря управления над промышленными объектами может привести к нежелательным последствиям в отдельном субъекте государства или отразиться на экономических показателях страны в целом, а также снизить безопасность жизнедеятельности населения. В связи с этим данная статья направлена на совершенствование процедуры количественной оценки рисков нарушения ИБ как необходимой составляющей комплексного подхода к обеспечению ИБ, позволяющей оценить реализуемость сценариев нарушения ИБ и выявить их возможные последствия для построения эффективной системы защиты. Разработана архитектура исследовательского прототипа интеллектуальной системы поддержки принятия решений и программная реализация инструментальных средств автоматизации моделирования сценариев атак и оценки рисков нарушения ИБ АСУ ТП промышленных объектов, применение которых позволяет повысить достоверность и оперативность оценки рисков нарушения ИБ и, следовательно, эффективность выбора контрмер на всех этапах жизненного цикла промышленного объекта и его комплексной системы защиты. Материалы статьи представляют практическую ценность для специалистов по ИБ на всех этапах жизненного цикла распределенных информационно-управляющих систем промышленных объектов.

Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review

Traditional information security risk assessment (RA) methodologies and standards, adopted by information security management systems and frameworks as a foundation stone towards robust environments, face many difficulties in modern environments where the threat landscape changes rapidly and new vulnerabilities are being discovered. In order to overcome this problem, dynamic risk assessment (DRA) models have been proposed to continuously and dynamically assess risks to organisational operations in (near) real time. The aim of this work is to analyse the current state of DRA models that have been proposed for cybersecurity, through a systematic literature review. The screening process led us to study 50 DRA models, categorised based on the respective primary analysis methods they used. The study provides insights into the key characteristics of these models, including the maturity level of the examined models, the domain or application area in which these models flourish, and the information they utilise in order to produce results. The aim of this work is to answer critical research questions regarding the development of dynamic risk assessment methodologies and provide insights on the already developed methods as well as future research directions.

Design of network information visualization security cognition system based on QSOFM network and FR algorithm

ABSTRACT Network information is complex, there is no lack of hidden risks of information to the user caused by bad effects. But analyzing and evaluating them is complex and requires more diverse and powerful techniques. This research will combine Fruchterman-Reingold (FR) information visualization algorithm and information security risk assessment method based on Quantum self-organizing feature map (QSOFM) network to build information visualization security cognitive system. By introducing quantum neurons into self-organizing feature mapping network (SOFM), a network information security evaluation model is constructed. The system can evaluate the security level of network information and visualize the evaluation results. The experimental results show that the system has fast response speed and strong interactivity. The accuracy of QSOFM algorithm is 86%, 12% higher than the traditional algorithm, which can provide more powerful technical support for the visual security cognition of network information.

Assessment of information security risks of automated system using neuro-fuzzy logic

Objective. Automated systems are widely used in production, and an important criterion for their reliability is information security. The aim of the study is to provide a balance between possible losses as a result of the implementation of threats and the cost of protection tools that reduce risks using neuro-fuzzy logic.Method. The developed model is based on the use of fuzzy logic.Result. A model of integrated information security risk assessment has been obtained, which can be practically applied for a comprehensive analysis of the effectiveness of organizing a protection system for automated systems operating in various fields of activity. The risk indicators of information security of an automated system, described with the help of linguistic variables, are revealed. Based on these indicators, information security risk assessments were obtained from the state of: software; technical support; information support; organizational and methodological support; the level of training and motivation of employees. The fuzzy production rules of the model are formulated to determine the integrated assessment of the information security of an automated system, providing a full account of all factors that have a significant impact on the level of security of an automated system.Conclusions. A feature of the proposed approach is the formalization of the assessment process, reducing the level of subjectivity in the formation of risk assessments.