Information Security Risk Assessment Research Articles

An analysis of methods for assessing information security risks of financial institutions

The paper presents an analysis of the existing methods for assessing information security risks, their features, advantages and disadvantages, as well as determines the possibility of using such techniques for assessing information security risks in financial institutions. Criteria for comparing information security risk assessment methods have been formed, the advantages and disadvantages of the methods are described. It is shown that, despite the requirements of regulators for assessing information security risks, most of the regulatory documents deal with operational risks. The evaluation of information security risks of credit and financial institutions does not have sufficient regulation and formalization.The authors substantiate the necessity of developing a method for assessing information security risks for credit and financial organizations, taking into account the features of risk assessment inherent to the mentioned organizations. The paper considers the need to create lists of existing threats to the credit and financial sector and their linking to existing vulnerabilities to optimize the process of assessing information security risks. The development of a methodology for assessing information security risks will increase the degree of compliance of credit and financial institutions with the requirements of international, state and industry standards through an optimal set of protection measures and models for evaluating information security risks.

Analysis finformation security risks of aic organizations

The article is devoted to the assessment of information security risks of organizations for the purpose of leveling or reducing them. Approaches to the content, regulatory regulation, methods of analysis and assessment of information risks are considered. Analytical procedures for assessing and managing information security risks for a specific municipal enterprise were performed. The results obtained can be used by municipal enterprises to ensure the security of the information system and sustainable business development.

Genetic Algorithm-Based Power System Information Security Risk Assessment Method

With the innovation and application of new-generation information technologies such as cloud computing, Internet of Things, and mobile Internet, the importance of information security issues has become more prominent. As an important industry linking people’s livelihood, the electric power industry will affect the safe operation of electric power once an information security incident occurs, and even lead to a large-scale blackout. Therefore, studying the information security risk assessment model of electric power enterprises has important theoretical value and practical significance. The purpose of this paper is to study the method of power system information security risk assessment based on genetic algorithm. This paper establishes a security risk quantification model, determines the operating parameters of the genetic algorithm in specific operations based on some literature cases, and compares the results in the literature with those in this paper. Based on a large number of investigations and interviews, this paper conducts research on information security risks, comprehensively considers the threats and vulnerabilities of the system, and analyzes the important impact of information security risks from the internal management, personnel, technology, and systems of electric power enterprises. Factors, the establishment of a power enterprise information security risk evaluation index system, this paper obtains data from actual system evaluation cases, uses multiplication, matrix method, and the genetic algorithm proposed in this paper to calculate the risk quantification model calculation results, and verifies the genetic algorithm the rationality and feasibility of combining with risk assessment, this method has practical application value. Experimental research shows that the risk value calculated by the genetic algorithm based on the risk quantification model proposed in this paper is more than 70% similar to the results calculated by the multiplication method and the matrix method, which proves that the model and calculation method established in this paper can be used. Applied to the specific evaluation implementation process.

Using improved neural network for the risk assessment of information security

Because of the information age, protecting information is very important to satisfy the three main aspects of information security, namely confidentiality, integrity and availability. In this case, information security has become one of the most important problems in information technology. Information security is a very important activity and risk assessment is the kernel of information security. However, most of the current risk assessment activities are comparatively subjective and the performances are not good enough. To understand this problem, we propose the improved neural network for the risk assessment of information security. Basically, it is processed under back-propagation neural network (BPN). Moreover, particle swarm optimization (PSO) is used for fine parameter optimization of BPN. The experimental results show that the proposed algorithm has the best performance among these compared approaches.

Design of vehicle traffic information security risk evaluation index system based on grey evaluation method

The network security problem of vehicle traffic information system is becoming more and more prominent. In order to effectively defend the system, this paper conducts in-depth research on the network security of vehicle traffic information system and proposes an information security risk assessment system for vehicle traffic control center. Specifically, the vehicle traffic control center is divided into components, and the security attributes of each component of the vehicle traffic control center system are constructed. By studying the information interaction process between the vehicle traffic control center and other subsystems, the security attributes of each component are abstracted; Identify the risk value of the component based on the influence of the component’s security attribute on the risk assessment index, aiming to enhance the security defense capability of the vehicle traffic information system.

INFORMATION PROTECTION MODEL BASED ON INFORMATION SECURITY RISK ASSESSMENT FOR SMALL AND MEDIUM-SIZED BUSINESS

This study focuses on the protection of information resources on the basis of risk-oriented approach for small and medium-sized businesses with an emphasis on risk assessment of information security (IS). The analysis of scientific sources allowed to characterize the essence of the risk-oriented approach and to formulate the main provisions for creating a model of information protection based on this technology. The content line of the model focuses on conducting qualitative and quantitative IS risk assessment, namely, SWOT-analysis, statistical method, expert assessment method and Monte Carlo method. The step-by-step procedure of carrying out the stages of analysis and implementation of these methods for IS risk assessment is described. In order to obtain a comprehensive map of IS risks at the initial stage, it is proposed to conduct a SWOT analysis, in particular to identify business weaknesses and external and internal threats. Use a statistical method to quantify IS risk if there are sufficient analytical reports. Otherwise, implement the method of expert assessments. The final step is to generate a script using the Monte Carlo method. To effectively describe the context of each information resource, use the technology of forming multiple pairs "threat - vulnerability". The relevance and possibilities of using this model as a methodology of information for small and medium businesses are substantiated.

Assessment of confidentiality risks of information security of projects based on fuzzy logic

One of the main components of enterprise information security management is its risk assessment. This is especially true for critical infrastructure enterprises and their business partners, including construction companies. However, measuring cybersecurity, even with the current skyrocketing costs of cybersecurity, remains an underdeveloped topic, so developing and agreeing on reliable ways to measure its risks and effectiveness is relevant for research. In many industries, the activities of enterprises are of a design nature and information security management must also be implemented within the framework of the project, which requires further research in this area. Given the incompleteness and vagueness of information about the components of information security, fuzzy logic is actively used in risk assessment models. The article proposes an approach for assessing the risks of violating the confidentiality of documents when solving information security problems of projects. The set of project documents is formalized in the form of a generalized hierarchical structure and the relationship of documents with operations and information systems that are used during operations with documents is determined. Based on the formalized structure of documents, a model has been developed for assessing the risk of violating the confidentiality of a document based on fuzzy logic, which allows one to take into account the incompleteness and blurring of data. The results of the work can be used when making decisions on information security measures for projects at enterprises with project activities, including at critical infrastructure enterprises, IT enterprises, construction companies and others. The proposed approaches can serve as a basis for the development of information technologies to automate the assessment of information security risks of projects.

Research on Information Security Risk Assessment Method Based on Fuzzy Rule Set

With the increasing complexity of the network structure and the increasing size of the network, various network security incidents pose an increasing threat to the security of computer systems and the network. Especially, in the network environment, the diversified intrusion methods and application environment make the security of the network more fragile. In order to improve information security, based on fuzzy rule sets, this paper proposes a fuzzy association rule mining algorithm based on fuzzy matrix and applies it to security event correlation. In addition, this paper combines the embedded system to construct an information security risk assessment system and sets the system performance based on the actual situation. Finally, this paper carries out experimental design to verify the performance of the system and analyzes the experimental results by mathematical statistics. From the experimental research, it can be seen that the system constructed in this paper has a certain effect.

Information security assessment of wireless sensor networks based on bayesian attack graphs

Network security issues have become increasingly prominent, and information security risk assessment is an important part of network security protection. Security risk assessment based on methods such as attack trees, attack graphs, neural networks, and fuzzy logic has problems such as difficulty in data collection during the assessment process, excessive reliance on expert experience, failure to consider the actual network environment, or ineffective joint application. The qualitative and quantitative information security fuzzy comprehensive evaluation method uses the theory of fuzzy mathematics to better solve the above problems, so that the evaluation method is scientific, comprehensive and operable. To improve the accuracy of information security risk assessment in wireless sensor networks, we propose a fuzzy comprehensive evaluation method based on Bayesian attack graphs. This considers the impact of environmental factors of the assessed system on security risk and the spread of the effects on the Bayesian network. Therefore, this model can reflect possible situations due to network attacks in the wireless sensor network system. The results show that this quantitative evaluation method is applicable to assessing risk in wireless sensor network systems, and the results are more objective and accurate.

Fuzzy Expert System of Information Security Risk Assessment on the Example of Analysis Learning Management Systems

Fuzzy Expert System of Information Security Risk Assessment on the Example of Analysis Learning Management Systems

An Approach for Information Security Risk Assessment in Cloud Environments

Cloud technology has revolutionized the way computational resources are accessed, offering benefits that have led to widespread adoption. The risk of losing important data is one of the reasons why some organizations do not adopt the migration to a public cloud or adopt the par-tial migration of information that is not critical. The process of risk assessment should be done since the initial stage of a project and become a continuous process. It is an essential process that help management structure to take strategic decision about security mechanisms needed to be implemented to avoid information leaks and about the costs and impact of unexpected events. This paper presents the process of information security risk assessment as well as the importance of knowledge of the associated risks. The paper also proposes a model for deter-mining risk of data security according to their importance for the organization, which provides an overview of vulnerabilities and their real impact on assets. Furthermore, the proposed mod-el helps organizations to choose the right methods to ensure the optimal level of security, in line with operational requirements and critical information.

Interpretation model of assessments boundary information security risks

Amendments to the legislation of Ukraine allow building, implementing, and conducting certifications of information protection systems owned by the state, or the requirements for the protection of which are established by law. It is recommended to use the requirements and/or guidelines of international practices that provide for the use of a risk-oriented approach. Thus, the international standard ISO/IES 27001 implemented in Ukraine recommends choosing or developing a method for assessing information security risks. At the same time, the results of the analysis of open sources revealed the absence of models and methods for quantifying their limit values. By informational, we mean the risks associated with the possibility of losses as a result due to violations of the properties of confidentiality, integrity, availability of information. Therefore, the purpose of this article is to develop an interpretive model that will provide the limit values of information security risks. Their quantitative values could be used as criteria at the stage of formation requirements for a comprehensive information security system and / or information security management system. The basis for calculating the value of the risk limit value is the standard deviation of the uncollected profit for the period. If the profit exceeds the planned, then hypothetically during the analysis period there were no incidents that would affect resources. Information risks are a component of the organization's risks. According to the recommendations of ISO/IES 27005, where risk is the effect of uncertainty on the achievement of goals, and the effect is a positive or negative deviation from the expected, the hypothetically obtained standard deviation can be considered an assessment of the impact of information uncertainty of additive information resources on economic results. In addition, assessing the acceptable threshold of information risk of the organization. Thus, an interpretive model for estimating the marginal risks of information security and allowable losses on individual components of threats to the information properties as a formalization of the impact of information uncertainty on financial consequences. This made it possible to quantify these estimates based on available actual economic / cost indicators of information activity in the organization.

ERP-SYSTEM RISK ASSESSMENT METHODS AND MODELS

Context. Because assessing information security risks is a complex and complete uncertainty process, and non-appearance is a major factor influencing the effectiveness of the assessment, is advisable use vague methods and models that are adaptive to noncomputed data. The formation of vague assessments of risk factors is subjective, and risk assessment depends on the practical results obtained in the process of processing the risks of threats that have already arisen during the functioning of the organization and experience of information security professionals.Objective. The object of the study are neural models that combine methods of fuzzy logic and artificial neural net-works and systems, that is, human-like style considerations of fuzzy systems with training and simulation of mental phi novena of neural networks.Method. The paper analyzes modern areas of research in the field of information protection in information systems, methods and technologies of information security risk Assessments, use of vague models to solve problems of information security risk assessment, as well as concept and con-struction of ERP systems and analyze problems of their security and vulnerability.Results. Identified factors influencing risk assessment suggest the use of linguistic variables to describe them and use fuzzy variables to assess their qualities, as well as a system of qualitative assessments. The choice of parameters for the development of the structure of a fuzzy product model of risk assessment and the basis of the rules of fuzzy logical conclusion justified.Conclusions. A vague risk assessment model of ERP systems is considered. You have selected a list of factors that affect information security risk. The methods of assessment of risks of information resources and ERP-systems in general, assessment of financial losses from the implementation of threats, determination of the type of risk according to its assessment for the formation of recommendations for their processing in order to maintain the level of protection of the ERP-system are considered. The list of linguistic variable models is considered. The structure of the database of fuzzy product rules – MISO-structure is selected. Fuzzy variable models are considered.

봉쇄와 보안장비 수준평가를 통한 정보보호 위험평가 개선 연구

봉쇄와 보안장비 수준평가를 통한 정보보호 위험평가 개선 연구

Information Security Risk Analysis Methods for Healthcare Systems

Information and risk analysis in healthcare system is an important issue in the modern technological growth. There are many systems implemented for information security and risk management for information protection. Proper guidance is needed to select the system as all the systems concentrate on information security of healthcare system. The information threats and risk are increasing, and all the issues are integrated to the vulnerabilities producing risk for the healthcare security. The healthcare system process structure and variation are advocated, in which operating performance indication is based on risk scaling factor so that dynamic information security risk analysis is needed. This paper is proposed for information security risk analysis in which the resources, risk threats, vulnerabilities that control the healthcare system. The paper compares the various inputs and outputs are needed by different systems of information security risk assessment and analysis that accurately presents the information security risk. At present, large number of information security risk analysis methodologies are present in the worldwide. Important and efficient methodologies are considered for comparison and quantitative purpose to choose most suitable methodology for healthcare system.

Combination of D-AHP and Grey Theory for the Assessment of the Information Security Risks of Smart Grids

As a modern power infrastructure, smart grids have great advantages over traditional power grids, but their effective operation is largely restricted by information security. Hence, a smart grid information security risk assessment (ISRA) method is proposed. This method combines D numbers to improve the classical analytic hierarchy process (D-AHP) independent of experts’ subjective qualitative assessment and then integrated with grey theory which does not require complete and unambiguous information. First, we establish a smart grid ISRA system according to the characteristics and development reality of smart grid technology. The proposed system includes 5 first-level indexes as an intelligent terminal, a wireless communication channel, password security, application code and embedded system, and corresponding 13 secondary indexes. Second, a D-AHP method aimed at the uncertainty of human subjective judgment and fuzziness of language assessment is used to obtain the weight of each index. The D-AHP method is then combined with the grey assessment matrix solved by grey theory, to obtain the comprehensive assessment value and corresponding risk grade. With a smart grid demonstration project in Suzhou, China, as an example, an empirical study is carried out using expert scoring. The comprehensive assessment risk value is 3.8199, and the corresponding risk level is moderate. The results of this work could serve as a reference for the information security protection of smart grids.

The Validity of Information Security Risk Assessment Methods for Organizations

Based on statistical data, a contradiction is shown between an increase in financial investments in the information security (IS) of organizations and a steady increase in the number of IS incidents caused by internal users. A conclusion is made about the cognitive vulnerability and low degree of validity of modern IS risk assessment methods. Stereotypes have been identified, the result of which are cognitive errors in assessing IS risks: the priority of technical protection of information from external threats of IS over organizational and technical protection from internal threats; distrust of the internal client, perception of it exclusively as an object of tough managerial influence, ignoring its subjective role in IS management; restriction of work with personnel within the IS management system with one-time measures and static criteria for assessing human risks and inattention to systemic measures and dynamic, situational criteria. The necessity of updating standards for IS risk management, as well as the development of new methods and tools for assessing, IS risks based on rejecting outdated stereotypes, is substantiated.

Network Information Security Risk Assessment Based on Artificial Intelligence

With the development of society and the progress of human civilization, science and technology are more and more widely used in people’s daily production and life, and artificial intelligence technology is also more and more widely used in this era. With the advent of the information age, the development of the network is faster and faster, and the popularization rate is higher and higher. The network information security problem has gradually become a hot issue of social concern question. With the increasingly open network environment, network attack tools become easier to obtain, more automated, more intelligent, which poses a huge challenge to information security protection. Therefore, in order to deal with the network information security problems in this information age, this paper studies the method of network information security risk assessment and analysis based on artificial intelligence, through in-depth study of network information security, simulate attacks on network information, so as to find the weakness of the current network information security system. In the research, a large number of network information security vulnerabilities are found by simulating the attack of network information, so as to repair the vulnerabilities one by one. Through the analysis, this paper studies the Content Filtering Gateway filtering system to filter out 94.8% of the virus and garbage, improve the network information security rate.

Study of Artificial Neural Networks in Information Security Risk Assessment

Objective: The principle of a more comprehensive information capital and organization in the information age and maintain it is very important in this research We decided to use the themes of artificialintelligence algorithms to identify information security risks and impact of Planning for security Reduce risk. Methodology: For this purpose we examined the IT organization referred to security measures based onthe Chkl sets the standard view and review the information we collect to attack the sources of information were both Clustering and classification of the information packet and a peak of the nightsaw the need of each one have for the probability of error And To Won According to the results of security measures and reduce the likelihood of attacks was effective in reducing dangerous attacks of the clustering of similar results, and they used the systemshows the data integrity of the system may be Drnha the data on the different organizational and (c) of Adhsaz the impact of security measures to assess. Results: The results of this research can help managers in assessing and rating the risk to information security in the organization of the system designed in this study may be Impact of security measures on the reduction of information security risksshow. Conclusion: after presentation of the organization and review the data and information available and the resources to implement the research model of this study in order to improve results and compliance with the the coin real information below to copy the proposed change found Login to have consisted of real attacks Statistics information to the relevant organization in order to carry out the investigation after the observation and study of the statistics Vvyzhgy attacks the nervous system sorted them by teaching the necessary research to cthe night of the the security risk information by using the algorithm of the themes of artificial intelligence 68 M to be in this way given the number 87789 in the neural network C of the conjugate graded 69 to 10 layers, and 5 percent were trained in control and test data.

Adopting ISO/IEC 27005:2011-based Risk Treatment Plan to Prevent Patients Data Theft

The concern raised in late 2017 regarding 46.2 million mobile device subscribers’ data breach had the Malaysian police started an investigation looking for the source of the leak. Data security is fundamental to protect the assets or information by providing its confidentiality, integrity and availability not only in the telecommunication industry but also in other sectors. This paper attempts to protect the data of a patient-based clinical system by producing a risk treatment plan for its software products. The existing system is vulnerable to information theft, insecure databases, needy audit login and password management. The information security risk assessment consisting of identifying risks, analyzing and evaluating them were conducted before a risk assessment report is written down. A risk management framework was applied to the software development unit of the organization to countermeasure these risks. ISO/IEC 27005:2011 standard was used as the basis for the information security risk management framework. The controls from Annex A of ISO/IEC 27001:2013 were used to reduce the risks. Thirty risks have been identified and 7 high-level risks for the product have been recognized. A risk treatment plan focusing on the risks and controls has been developed for the system to reduce these risks in order to secure the patients’ data. This will eventually enhance the information security in the software development unit and at the same time, increase awareness among the team members concerning risks and the means to handle them.