Information Security Risk Assessment Research Articles

Network Security Intelligence Center as a combination of SIC and NOC

In modern networks, information security (IS) incidents have become not only numerous and diverse, but more damaging and disruptive. According to 2017 Cyber Attacks Statistics from hackmaggedon.com, among top attacks are malware, account and DNS hijacking, targeted attacks, DDoS, defacements, malvertising, and SQL injection. Various preventive controls based on IS risk assessment results decrease the majority, but not all IS incidents. Any delay and only reactive actions to IS incidents puts organization’s assets under risk. Therefore, an IS incident management system has become an integral part of the whole organization’s governance system. Thus, in this paper, we propose to unite together all advantages of a Security Intelligence Center and a Network Operations Center in a unified Network Security Intelligence Center (NSIC).

The Design and Evaluation of a User-Centric Information Security Risk Assessment and Response Framework

The risk of sensitive information disclosure and modification through the use of online services has increased considerably and may result in significant damage. As the management and assessment of such risks is a well-known discipline for organizations, it is a challenge for users from the general public. Users have difficulties in using, understanding and reacting to security-related threats. Moreover, users only try to protect themselves from risks salient to them. Motivated by the lack of risk assessment solutions and limited impact of awareness programs tailored for users of the general public, this paper aims to develop a structured approach to help in protecting users from threats and vulnerabilities and, thus, reducing the overall information security risks. By focusing on the user and that different users react differently to the same stimuli, the authors developed a user-centric risk assessment and response framework that assesses and communicates risk on both user and system level in an individualized, timely and continuous way. Three risk assessment models were proposed that depend on user-centric and behavior-related factors when calculating risk. This framework was evaluated using a scenario-based simulation of a number of users and results analyzed. The analysis demonstrated the effectiveness and feasibility of the proposed approach. Encouragingly, this analysis provided an indication that risk can be assessed differently for the same behavior based upon a number of user-centric and behavioral-related factors resulting in an individualized granular risk score/level. This granular risk assessment, provided a more insightful evaluation of both risk and response. The analysis of results was also useful in demonstrating how risk is not the same for all users and how the proposed model is effective in adapting to differences between users offering a novel approach to assessing information security risks.

Comparative Study of Information Security Risk Assessment Frameworks

Comparative Study of Information Security Risk Assessment Frameworks

Information Security Risk Assessment Framework for Cloud Computing Environment Using Medical Research Design and Method

Information Security Risk Assessment Framework for Cloud Computing Environment Using Medical Research Design and Method

A Markov-Based Model for Information Security Risk Assessment in Healthcare MANETs

Information security breaches are of major concern for healthcare mobile ad-hoc networks (h-MANETs). In this paper, we propose a model that identifies and assesses risk in an h-MANET deployed by a healthcare institution in a disaster-prone region a priori by modeling the possible routes a hacker might follow to compromise a target. Our model proposes a novel method to compute the transition probability of each hop in the h-MANET. Next, it employs Markov theory to compute the maximum and minimum number of hops required to compromise the target for a given source-target pair. It then determines the vulnerability for all the paths comprising minimum to maximum hops only for each pair by computing their overall transition probability. Finally, our model computes the risk associated with each of these paths. Based on the calculated risk level of each path, the management can recommend an appropriate risk mitigation strategy.

A Support Subset Algorithm and Its Application to Information Security Risk Assessment

A Support Subset Algorithm and Its Application to Information Security Risk Assessment

Information security risk assessment system – «RISK-CALCULATOR»

In order to ensure the reliability of information processing procedures and to achieve the required level of information security, risk management of basic characteristics violations of information security system resources has a special place, such as confidentiality, integrity and accessibility. At the moment, to ensure that most existing systems of information security risks assessment function effectively, an expert support is required. As a result, it increases the cost and time of realization of the specified process. Therefore, it is relevant to develop such systems that will allow to automate the process of information security risks assessment, for example, by using the input values necessary for the operation (for example, CVSS metrics) from the relevant databases. In this regard, the structural-parametric model of the risk assessment system is proposed – “RISK-CALCULATOR”, which, due to the basic structural components (subsystems of primary and secondary data formation), allows to minimize the expert's participation and maximizes the process of formation of the parameters necessary for the assessment. Based on this, a basic algorithm and a software tool have been developed, which, unlike the known ones, uses as input the estimated parameters as CVSS metrics. This provides high flexibility and convenience when assessing the risks of information security systems resources in real time without involving experts in the relevant subject area.

Information Security Risk Assessment in Hospitals.

Background:To date, many efforts have been made to classify information security threats, especially in the healthcare area. However, there are still many unknown risks which may threat the security of health information and their resources especially in the hospitals.Objective:The aim of this study was to assess the risks threatening information security in the hospitals located in one of the northwest cities of Iran.Method:This study was completed in 2014. The participants were information technology managers who worked in the hospitals (n=27). The research instrument was a questionnaire composed of a number of open and closed questions. The content validity of the questionnaire was confirmed, and the reliability of the closed questions was measured by using the test-retest method (r =0.78).Results:The results showed that among the information security risks, fire found to be a high probability/high impact risk factor. Human and physical/environmental threats were among the low probability risk factors. Regarding the information security safeguards used in the hospitals, the results showed that the use of the technical safeguards was the most frequent one (n =22, 91.7%) compared to the administrative (n =21, 87.5%) and the physical safeguards (n =16, 66.7%).Conclusion:The high probability risk factors require quick corrective actions to be taken. Therefore, the underlying causes of such threats should be identified and controlled before experiencing adverse effects. It is also important to note that information security in health care systems needs to be considered at a macro level with respect to the national interests and policies.

Risk Assessment of Enterprises Information Security Based on Fuzzy Set and Entropy Weight

With the accelerate development of information, enterprises are becoming increasingly dependent on information systems, therefore, ensuring information security becomes the core work of enterprises information management. The tradition risk factors are classified into three aspects of asset, vulnerability and threat. This paper adds the security prevention measures as the fourth aspect. After analyzing the four aspects based on the fuzzy set theory, then constructs the membership matrix of factors corresponding to the judge set. The weights of the risk factors are calculated with the entropy theory to reduce the subjectivity bias, integrating the comprehensive risk results to output the risk rating. An example application proves that the method is a feasible and effective method of assessment, the results will have a certain theoretical significance and practical value.

The analysis instrumental methods of identification of risks of information security information and telecommunication systems

The article defines the purpose, direction and objectives of analysis of the main methods of identification of risks of information security information and telecommunication systems. The basis of the system of information security in information and telecommunication systems is based on the risk management process, which involves such main processes as analysis and evaluation. There are a large numbers of assessment methods and tools of information risk management nowadays. This article describes the application of expert systems, which hold a higher risk assessment of information security for different models of information and telecommunication systems and help to avoid violations of the confidentiality, integrity and availability of information. The analysis of the working methods of reporting and the reasons for the occurrence of risks with the economic effectiveness of possible countermeasures is made. The main stages of the assessment and mitigation of information risks in the information infrastructure systems are considered. The procedure of assessment of information risks in accordance with basic international standards is analyzed.

МЕТОДЫ И СРЕДСТВА АНАЛИЗА РИСКОВ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ ПРЕДПРИЯТИЯ

Methods and means of assessing information security risks are considered. The main problems that arise in the process of performing the analysis of the security of an enterprise in the field of information security are shown. A brief review of the existing instrumental solutions to the problems of assessing the risks of information security organizations engaged in various fields of activity is given. The main advantages and disadvantages of methods for risk assessment and software based on these techniques are analyzed. The results of the review are presented, conclusions are made regarding the shortcomings of methods and tools, and the question of the optimal correlation of such concepts as the breadth of applicability of methods and software tools and reliability, accuracy and adequacy of information security risk assessment are considered. We propose new additional stages of risk analysis that allow improving existing methods and eliminating the shortcomings identified during the review.

A framework for estimating information security risk assessment method completeness

In general, an information security risk assessment (ISRA) method produces risk estimates, where risk is the product of the probability of occurrence of an event and the associated consequences for the given organization. ISRA practices vary among industries and disciplines, resulting in various approaches and methods for risk assessments. There exist several methods for comparing ISRA methods, but these are scoped to compare the content of the methods to a predefined set of criteria, rather than process tasks to be carried out and the issues the method is designed to address. It is the lack of an all-inclusive and comprehensive comparison that motivates this work. This paper proposes the Core Unified Risk Framework (CURF) as an all-inclusive approach to compare different methods, all-inclusive since we grew CURF organically by adding new issues and tasks from each reviewed method. If a task or issue was present in surveyed ISRA method, but not in CURF, it was appended to the model, thus obtaining a measure of completeness for the studied methods. The scope of this work is primarily functional approaches risk assessment procedures, which are the formal ISRA methods that focus on assessments of assets, threats, vulnerabilities, and protections, often with measures of probability and consequence. The proposed approach allowed for a detailed qualitative comparison of processes and activities in each method and provided a measure of completeness. This study does not address aspects beyond risk identification, estimation, and evaluation; considering the total of all three activities, we found the “ISO/IEC 27005 Information Security Risk Management” to be the most complete approach at present. For risk estimation only, we found the Factor Analysis of Information Risk and ISO/IEC 27005:2011 as the most complete frameworks. In addition, this study discovers and analyzes several gaps in the surveyed methods.

Analytical verification expressions of linguistic variables for information security risk assessment systems

Analytical verification expressions of linguistic variables for information security risk assessment systems

Information Security Risk Assessment Model Based on Computing with Words

The basis for company IT infrastructure security is information security risks assessment of IT services. The increased complexity, connectivity and rapid changes occurring in IT services make it impossible to apply traditional models of quantitative/qualitative risk assessment. Existing quantitative assessment models are time-consuming, at the same time, qualitative assessment models do not take into account the subjective expert assessments and the uncertainty of risk factors. This paper presents the new information security risk assessment model for IT services based on computing with words. The model methodology is based on OWASP risk rating methodology for web applications. To evaluate risk factors, it is proposed to use dictionary consisting of 16/32 granular terms (words). Problems of uncertainty in perceptual assessments of risk factors are taken into account using methods of the theory of discrete interval type-2 fuzzy sets and systems.

Prioritizing and Ranking the Big Data Information Security Risk Spectrum

Big data research brings in a lot of research interest and excitement from both industry and academia. While several research works have addressed the characteristics, technology and business application of big data, less literature has addressed the information security risk assessment of big data, to which this paper contributes to. This research work shows a big data information security risk spectrum comprised of 25 well-defined risk factors into seven constructs that are prioritized and ranked. The unique contribution of the paper is the mix of analytic hierarchy process, one of the most popular multi-criteria decision-making methods with the Delphi technique, another popular group decision-making technique. The results state that new-age technology risk factors like data brokering, global exposure to personal data, lack of governance-based security design are the top three risk factors which are considered from the standpoint of security, privacy and governance in big data management.

Information Security Risk Assessment: A Method Comparison

Numerous methods for information security risk assessment (ISRA) are available, yet there is little guidance on how to choose one. Through a comprehensive risk identification, estimation, and evaluation framework, the author evaluates the practical application of three ISRA methods in terms of tasks required, user experience, and results.

Research based on tools investigation of security risk assessment according to the information systems resources

One of the main stages of integrated systems construction for protecting information resources is risk assessment. Often, specialists of the companies to increase the efficiency of information security pay attention to the choice of adequate tools of information security risks assessment that will meet the relevant requirements. Nowadays there is a wide range of such tools. For their rational choice, a variety of risk assessment tools have been investigated to determine the set of necessary comparative characteristics. According to the mentioned means, taking into account the known analytical-synthetic tuple model of risk characteristics, a tuple is formed, which makes it possible due to the certain parameters, to unify the process of comparative analysis of such means. This will enhance the effectiveness of the choice implementation to solve the corresponding tasks of information security.

Risk aware intelligent system for insider threat detection

Information security risk assessment has a major role in assessing the security posture of any organisation. Risk assessment is mostly performed with focus on the external threats to the information assets rather than the insider threats. Insider attacks are caused by the insiders with privileged access rights to the information assets. Traditional security controls like encryption and policy-based access control used in organisations fail to identify the malicious insider activity. Therefore, fighting insider threats is a tough task for organisations since it is important to have a balance between the grant of required privileges to the users, and identification of malicious access by them. This paper proposes an intelligent risk aware decision support system that identifies the presence insider threats and their intensity in an organisation by quantifying the risk to assets and behaviour monitoring of users who access those assets.

Security Risk Assessment in Internet of Things Systems

Information security risk assessment methods have served us well over the past two decades. They have provided a tool for organizations and governments to use in protecting themselves against pertinent risks. As the complexity, pervasiveness, and automation of technology systems increases and cyberspace matures, particularly with the Internet of Things (IoT), there is a strong argument that we will need new approaches to assess risk and build trust. The challenge with simply extending existing assessment methodologies to IoT systems is that we could be blind to new risks arising in such ecosystems. These risks could be related to the high degrees of connectivity present or the coupling of digital, cyber-physical, and social systems. This article makes the case for new methodologies to assess risk in this context that consider the dynamics and uniqueness of the IoT while maintaining the rigor of best practice in risk assessment.

Risk aware intelligent system for insider threat detection

Information security risk assessment has a major role in assessing the security posture of any organisation. Risk assessment is mostly performed with focus on the external threats to the information assets rather than the insider threats. Insider attacks are caused by the insiders with privileged access rights to the information assets. Traditional security controls like encryption and policy-based access control used in organisations fail to identify the malicious insider activity. Therefore, fighting insider threats is a tough task for organisations since it is important to have a balance between the grant of required privileges to the users, and identification of malicious access by them. This paper proposes an intelligent risk aware decision support system that identifies the presence insider threats and their intensity in an organisation by quantifying the risk to assets and behaviour monitoring of users who access those assets.