Security Risk Estimation Research Articles

Security Risk Assessment of Healthcare Web Application Through Adaptive Neuro-Fuzzy Inference System: A Design Perspective.

IntroductionThe imperative need for ensuring optimal security of healthcare web applications cannot be overstated. Security practitioners are consistently working at improvising on techniques to maximise security along with the longevity of healthcare web applications. In this league, it has been observed that assessment of security risks through soft computing techniques during the development of web application can enhance the security of healthcare web applications to a great extent.MethodsThis study proposes the identification of security risks and their assessment during the development of the web application through adaptive neuro-fuzzy inference system (ANFIS). In this article, firstly, the security risk factors involved during healthcare web application development have been identified. Thereafter, these security risks have been evaluated by using the ANFIS technique. This research also proposes a fuzzy regression model.ResultsThe results have been compared with those of ANFIS, and the ANFIS model is found to be more acceptable for the estimation of security risks during the healthcare web application development.ConclusionThe proposed approach can be applied by the healthcare web application developers and experts to avoid the security risk factors during healthcare web application development for enhancing the healthcare data security.

Collaborative security risk estimation in agile software development

Purpose Today, agile software development teams in general do not adopt security risk-assessment practices in an ongoing manner to prioritize security work. Protection Poker is a collaborative and lightweight software security risk-estimation technique that is particularly suited for agile teams. Motivated by a desire to understand why security risk assessments have not yet gained widespread adoption in agile development, this study aims to assess to what extent the Protection Poker game would be accepted by agile teams and how it can be successfully integrated into the agile practices. Design/methodology/approach Protection Poker was studied in capstone projects, in teams doing a graduate software security course and in sessions with industry representatives. Data were collected via questionnaires, observations and group interviews. Findings Results show that Protection Poker has the potential to be adopted by agile teams. Key benefits include good discussions on security and the development project, along with increased knowledge and awareness. Challenges include ensuring efficient use of time and gaining impact on the end product. Research limitations/implications Using students allowed easy access to subjects and an ability to collect rich data over time, but at the cost of generalizability to professional settings. Results from interactions with professionals supplement the data from students, showing similarities and differences in their opinions on Protection Poker. Originality/value The paper proposes ways to tackle the main obstacles to the adoption of the Protection Poker technique, as identified in this study.

An efficient security risk estimation technique for Risk-based access control model for IoT

The need to increase information sharing in the Internet of Things (IoT) applications made the risk-based access control model to be the best candidate for both academic and commercial organizations. Risk-based access control model carries out a security risk analysis on the access request by using IoT contextual information to provide access decisions dynamically. Unlike current static access control approaches that are based on predefined policies and give the same result in different situations, this model provides the required flexibility to access system resources and works well in unexpected conditions and situations of the IoT system. One of the main issues to implement this model is to determine the appropriate risk estimation technique that is able to generate accurate and realistic risk values for each access request to determine the access decision. Therefore, this paper proposes a risk estimation technique which integrates the fuzzy inference system with expert judgment to assess security risks of access control operations in the IoT system. Twenty IoT security experts from inside and outside the UK were interviewed to validate the proposed risk estimation technique and build the fuzzy inference rules accurately. The proposed risk estimation approach was implemented and simulated using access control scenarios of the network router. In comparison with the existing fuzzy techniques, the proposed technique has demonstrated it produces precise and realistic values in evaluating security risks of access control operations in the IoT context.

Integrated Circuit Security Risk Management Framework in Government Agencies

The security risk management framework is an essential part of strategic management for government agencies. It allows a government to systematically identify and address the risks associated with its activities to achieve sustainability for different activities of security risk management. The goal of security risk management is to add sustainable value to government activities and reduce the chance of security breaches. Applying security risk management techniques used to government projects can increase the chances of success, help achieve objectives, and assist in finding preventive solutions for future projects. The application of security risk management is profitable for government agencies because it sets specific risk management objectives that are based on the broader overall strategy. It contributes to the achievement of strategic objectives with mechanisms like Spearman's rank correlation coefficient and simple linear regression. These techniques can improve decision-making, planning and implementation of government activities, as well as reduce the negative consequences of present threats. It is recommended to apply the integrated security risk management framework proposed in this paper to increase the effectiveness of security risk management in government agencies. Also using quantitative and intelligent techniques in the analysis and estimation of security risks can help managers to make decisions regarding security issues in government agencies.

Generation of Meta Alerts by Aggregating Intrusion Alerts

Online intrusion detection systems play an important role in protecting IT systems. Tools like Snort, firewall also detect intrusions. Such intrusion detection systems provide feedback in the form of alerts. However, the number of alerts is more in number and often security personnel are confused with such voluminous messages. This makes them difficult to take decision immediately. They take time to analyze the alerts and come to a conclusion for directions for taking actions. The security risk estimation and resolving the security problem depends on quick understanding of alerts. The bulk of alerts given by low level intrusion detection systems make it time consuming to arrive at decisions. To overcome this problem the alerts provided by low level detection systems can be programmatically aggregated and summarized alerts can be given to security personnel so as to enable them to draw conclusions quickly and take required actions. We propose a new technique for the purpose of online alert aggregation based on dynamic, probabilistic model. The solution is based on maximum likelihood approach which is a data stream version. The empirical results revealed that the proposed solution is effective and useful. Index Terms - Online intrusion detection, data streaming, probabilistic model, alert aggregation.

An immunity based network security risk estimation

According to the relationship between the antibody concentration and the pathogen intrusion intensity, here we present an immunity-based model for the network security risk estimation (Insre). In Insre, the concepts and formal definitions of self, nonself, antibody, antigen and lymphocyte in the network security domain are given. Then the mathematical models of the self-tolerance, the clonal selection, the lifecycle of mature lymphocyte, immune memory and immune surveillance are established. Building upon the above models, a quantitative computation model for network security risk estimation, which is based on the calculation of antibody concentration, is thus presented. By using Insre, the types and intensity of network attacks, as well as the risk level of network security, can be calculated quantitatively and in real-time. Our theoretical analysis and experimental results show that Insre is a good solution to real-time risk evaluation for the network security.