Information Security Risk Assessment Research Articles

FRAMB: A man-machine cooperation risk assessment method for intelligent network information systems

The intelligent network information systems, such as smart grid systems, face many security problems in the aspects of sensing, communication and computing. Information security risk assessment is an important way to assess the threats faced by information systems before risk events occur and ensure the security of assets. However, a comprehensive risk assessment of the system is a very resource-consuming process. Many existing risk assessment methods rely on a large number of experts and computing resources. Their assessment results are vulnerable to the differences in experts’ subjective judgments. Therefore, we propose FRAMB, a novel man-machine collaborative risk assessment method based on fitting upper and lower bounds. Firstly, we present a risk assessment criterion including four categories and sixteen risk factors following the ISO/IEC 27005:2018 standard. On this basis, we present the DFAHP and CM-NN assessment models to obtain the upper and lower bounds of the risk assessment value, which provides a reference for expert assessment. FRAMB integrates the experts’ assessment value and the values of upper and lower bounds, and adjusts the weights of these values to give the final risk assessment value. We introduce the risk assessment process of FRAMB in detail through a case study of the smart grid system risk assessment. We evaluate the effectiveness and accuracy of FRAMB through experiments. The experimental results show that FRAMB can effectively and accurately assess the security risks of the intelligent network information systems.

Оценка рисков информационной безопасности в отраслевой информационной системе на основе теории нечетких множеств и искусственной нейронной сети

Information security risk assessment is a crucial component of industrial management techniques that aids in identifying, quantifying, and evaluating risks in comparison to criteria for risk acceptance and organizationally pertinent objectives. Due to its capacity to combine several parameters to determine an overall risk, the traditional fuzzy-rule-based risk assessment technique has been used in numerous industries. The technique has a drawback because it is used in situations where there are several parameters that need to be evaluated, and each parameter is expressed by a different set of linguistic phrases. In this paper, fuzzy set theory and an artificial neural network (ANN) risk prediction model that can solve the issue at hand are provided. Also developed is an algorithm that may change the risk-related factors and the overall risk level from a fuzzy property to a crisp-valued attribute is developed. The system was trained by using twelve samples representing 70%, 15%, and 15% of the dataset for training, testing, and validation, respectively. In addition, a stepwise regression model has also been designed, and its results are compared with the results of ANN. In terms of overall efficiency, the ANN model (R2= 0.99981, RMSE=0.00288, and MSE=0.00001,) performed better, though both models are satisfactory enough. It is concluded that a risk-predicting ANN model can produce accurate results as long as the training data accounts for all conceivable conditions.

ЭФФЕКТИВНОСТЬ АВТОМАТИЗИРОВАННОГО УПРАВЛЕНИЯ ТРАНСПОРТНЫМИ СРЕДСТВАМИ В ТРАМВАЙНЫХ СИСТЕМАХ

The intellectualization of water transport is accompanied by an expansion of the landscape of threats to transport security, caused by the characteristics and weaknesses of the technologies being introduced, which are the convergence of information and telecommunication technologies, automated and automatic control technologies and artificial intelligence. The peculiarity of these technologies is working with large volumes of information. Violation of the security of information processed in intelligent systems of water transport (illegal access, modification, deletion and similar unauthorized influence) causes a violation of transport security and, as a consequence, the security of critical information infrastructure and the country’s critical infrastructure, national security. Convergent technologies used in intelligent transport systems are characterized by multiple and poorly formalized manifestations of the consequences of threats. The article presents a model for assessing the risks of information security of intelligent water transport systems, based on the methods of the theory of fuzzy sets and fuzzy logic, the use of which makes it possible to take into account the above-mentioned features of the technologies being implemented. The hierarchical structure of the model and the use of fuzzy set theory and fuzzy logic methods make it possible to adapt the model to various risk criteria, types of input data and the level of detail of risk analysis. For the presented model, a methodology for assessing information security risks has been developed and an example of risk calculation is given. The developed model and methodology are intended to build an information security risk management system for autonomous shipping, implementing technologies of hybrid (augmented, extended) intelligence, providing for the use of artificial intelligence controlled by people.

НЕЧЕТКАЯ СИСТЕМА ОЦЕНКИ РИСКОВ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ ИНТЕЛЛЕКТУАЛЬНЫХ СИСТЕМ ВОДНОГО ТРАНСПОРТА

The intellectualization of water transport is accompanied by an expansion of the landscape of threats to transport security, caused by the characteristics and weaknesses of the technologies being introduced, which are the convergence of information and telecommunication technologies, automated and automatic control technologies and artificial intelligence. The peculiarity of these technologies is working with large volumes of information. Violation of the security of information processed in intelligent systems of water transport (illegal access, modification, deletion and similar unauthorized influence) causes a violation of transport security and, as a consequence, the security of critical information infrastructure and the country’s critical infrastructure, national security. Convergent technologies used in intelligent transport systems are characterized by multiple and poorly formalized manifestations of the consequences of threats. The article presents a model for assessing the risks of information security of intelligent water transport systems, based on the methods of the theory of fuzzy sets and fuzzy logic, the use of which makes it possible to take into account the above-mentioned features of the technologies being implemented. The hierarchical structure of the model and the use of fuzzy set theory and fuzzy logic methods make it possible to adapt the model to various risk criteria, types of input data and the level of detail of risk analysis. For the presented model, a methodology for assessing information security risks has been developed and an example of risk calculation is given. The developed model and methodology are intended to build an information security risk management system for autonomous shipping, implementing technologies of hybrid (augmented, extended) intelligence, providing for the use of artificial intelligence controlled by people.

Development of a mechanism for information security risk management of transport service provision systems

The object of the study is the process of analysis, assessment, and management of information security risks in transport service provision systems. The problem of applying the information security risk management approach in the activities of transport business entities was investigated. As a result of the application of effective forms, methods, and means of information security risk management based on international standards, a risk management mechanism was developed. The risk assessment process of transport systems has been systematized. This allows business entities in the transport sector to determine ways to prevent and counter information threats and challenges in their activities, both when designing and operating systems for providing transport services. Verification of the devised methodical approach to information security risk management was carried out on an example of the taxi company «Taxifay N». Threats and challenges of the company’s information system were evaluated by an expert method. Based on the results of the analysis of expert risk assessment, it was found that the concordance coefficient (0.86) confirms the high level of agreement of experts’ opinions. As a result, the company’s information security risk management program was developed. The effectiveness of the program was assessed by the efficiency ratio, which was 0.64. This testifies to the effectiveness of the implemented program of measures to manage information security risks. The scope of application may be the activity of business entities that provide transport services to the population, aimed at data storage and processing. The prospect of this study is to expand the list of threats and categories of vulnerabilities depending on the characteristics of the economic activity of various enterprises

Modeling the Process of Evaluation of Information Security Risks and its Methodology by the Application of Computer Systems

The main aim of the article is to study modeling the process of evaluation of information security risks by the application of computer systems. Thus, information security risk assessment and analysis of existing methods of information security risk assessment had been also studied in the article. The term "risk of information security" (IS) applies to the damage that can attack the information technology systems. IS risk is a wide range of potential threats, especially includes data violations, control measures, financial costs, reputation damage, etc. cover issues such as. IS risks include the failure of hardware and software, human errors, spams, viruses and harmful attacks, as well as natural disasters such as fires, cyclones or floods. Security risk assessment determines, assesses and implements key security controls in applications. It also focuses on prevention of software security defects and vulnerabilities. Information security risk is the potential probability of using vulnerabilities of an asset or group of assets as a specific threat to damage the organization.

Exploring the critical success factors of information security management: a mixed-method approach

Purpose Effective information security management (ISM) contributes to building a healthy organizational digital ecology. However, few studies have built an analysis framework for critical influencing factors to discuss the combined influence mechanism of multiple factors on ISM performance (ISMP). This study aims to explore the critical success factors and understand how these factors contribute to ISMP. Design/methodology/approach This study used a mixed-method approach to achieve this study’s research goals. In Study 1, the authors conducted a qualitative analysis to take a series of International Organization for Standardization/International Electrotechnical Commission standard documents as the basis to refine the critical factors that may influence organizations’ ISMP. In Study 2, the authors built a research model based on the organizational control perspective and used the survey-based partial least squares-based structural equation modeling (PLS-SEM) approach to understand the relationships between these factors in promoting ISMP. In Study 3, the authors used the fuzzy set qualitative comparative analysis (fsQCA) method to empirically analyze the complex mechanisms of how the combinations of the factors affect ISMP. Findings The following three research findings are obtained. First, based on the text-based qualitative analysis, the authors refined the critical success factors that may increase ISMP, including information security policies (ISP), top management support (TMS), alignment (ALI), information security risk assessment (IRA), information security awareness (ISA) and information security culture (ISC). Second, the PLS-SEM testing results confirmed TMS is the antecedent variable motivating organization’s formation (ISP) and information control (ISC) approaches; these two types of organization control approaches increase IRA, ISA and ALI and then promote ISMP directly and indirectly. Third, the fsQCA testing results found two configurations that can achieve high ISMP and one driving path that leads to non-high ISMP. Originality/value This study extends knowledge by exploring configuration factors to improve or impede the performances of organizations’ ISM. To the best of the authors’ knowledge, this study is one of the first to explore the use of the fsQCA approach in information security studies, and the results not only revealed causal associations between single factors but also highlighted the critical role of configuration factors in developing organizational ISMP. This study calls attention to information security managers of an organization should highlight the combined effect between the factors and reasonably allocate organizational resources to achieve high ISMP.

Personal Information Security Risk Assessment for E-Waste Recycling Based on Fuzzy–GRA–TOPSIS and FMEA

Personal Information Security Risk Assessment for E-Waste Recycling Based on Fuzzy–GRA–TOPSIS and FMEA

Digital media system design and visual art analysis based on information security

BackgroundWith the growing maturity of Internet technology and 5G transmission technology, digital media systems begin to present more complex scenario applications. Software design security issues are also increasingly evident in digital media systems. This paper analyzes the security issues of digital media system design from the perspective of software protection security. Discussed based on the information security digital media system design and visual art analysis. MethodsThis paper discusses based on the software security protection design and visual art analysis, first proposed the media convergence and information security risk assessment research, including media convergence cognition, information security risk management theory, system information security risk assessment methods and based on the media under the digital certificate. Secondly, the information security algorithm based on digital media technology is studied. From the basic knowledge of digital image, a method of image encryption based on the change of pixel value, the common algorithm of digital image watermarking technology and the encryption technology of digital media are summarized. ResultsExperiments were carried out on three art painting data sets, including Painting91, Oil Painting and Pandora. Compared with the existing label distribution learning methods on the Painting91style dataset, the algorithms SA-IIS and SA-BFGS achieve the classification accuracy of 65.51 % and 66.52 %, respectively. The classification result of the baseline method of VGGNet is 63.89 % on the OilPainting dataset. On the Pandora-style dataset, the classification accuracy of MSCNN1 method is 71.32 %, and the experimental results of CNNF4 method reach 71.76 %. ConclusionThe method proposed in this paper has good application results in different data sets, and the digital media art design system has high reliability and fault tolerance. From the perspective of information security, different index systems have higher security levels.

Fuzzy Logic and Its Application in the Assessment of Information Security Risk of Industrial Internet of Things

This article addresses the issue of information security in the Industrial Internet of Things (IIoT) environment. Information security risk assessment in the IIoT is complicated by several factors: the complexity and heterogeneity of the system, the dynamic nature of the system, the distributed network infrastructure, the lack of standards and guidelines, and the increased consequences of security breaches. Given these factors, information security risk assessment in the IIoT requires a comprehensive approach adapted to the peculiarities and requirements of a particular system and industry. It is necessary to use specialized risk assessment methods and to take into account the context and peculiarities of the system. The method of information security risk assessment in the IIoT, based on the mathematical apparatus of fuzzy set theory, is proposed. This paper analyzes information security threats for IIoT systems, from which the most significant criteria are selected. The rules, based on which decisions are made, are formulated in the form of logical formulas containing input parameters. Three fuzzy inference systems are used: one to estimate the probability of threat realization, another to estimate the probable damage, and a final one to estimate the information security risk for the IIoT system. Based on the proposed method, examples of calculating the information security risk assessment in the IIoT environment are provided. The proposed scientific approach can serve as a foundation for creating expert decision support systems for designing IIoT systems.

Integrating NIST and ISO Cybersecurity Audit and Risk Assessment Frameworks into Cameroonian Law

This paper reviews cybersecurity laws and regulations in Cameroon, focusing on cybersecurity and information security audits and risk assessments. The importance of cybersecurity risk assessment and the implementation of security controls to cure deficiencies noted during risk assessments or audits is a critical step in developing cybersecurity resilience. Cameroon's cybersecurity legal framework provides for audits but does not explicitly enumerate controls. Consequently, integrating relevant controls from the NIST frameworks and ISO Standards can improve the cybersecurity posture in Cameroon while waiting for a comprehensive revision of the legal framework. NIST and ISO are internationally recognized as best practices in information security systems and cybersecurity risk management. This paper highlights the lack of specific international law provisions addressing cybersecurity audits and risk assessments. Overall, the paper highlights the importance of continuous risk assessment and monitoring, implementation of security controls, and compliance with organizational policies, relevant laws and regulations to ensure the adequate protection of information systems. Finally, the paper underscores the importance of improving Cameroon's cybersecurity regulations by integrating provisions from NIST and ISO.

Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review

Traditional information security risk assessment (RA) methodologies and standards, adopted by information security management systems and frameworks as a foundation stone towards robust environments, face many difficulties in modern environments where the threat landscape changes rapidly and new vulnerabilities are being discovered. In order to overcome this problem, dynamic risk assessment (DRA) models have been proposed to continuously and dynamically assess risks to organisational operations in (near) real time. The aim of this work is to analyse the current state of DRA models that have been proposed for cybersecurity, through a systematic literature review. The screening process led us to study 50 DRA models, categorised based on the respective primary analysis methods they used. The study provides insights into the key characteristics of these models, including the maturity level of the examined models, the domain or application area in which these models flourish, and the information they utilise in order to produce results. The aim of this work is to answer critical research questions regarding the development of dynamic risk assessment methodologies and provide insights on the already developed methods as well as future research directions.

Design of network information visualization security cognition system based on QSOFM network and FR algorithm

ABSTRACT Network information is complex, there is no lack of hidden risks of information to the user caused by bad effects. But analyzing and evaluating them is complex and requires more diverse and powerful techniques. This research will combine Fruchterman-Reingold (FR) information visualization algorithm and information security risk assessment method based on Quantum self-organizing feature map (QSOFM) network to build information visualization security cognitive system. By introducing quantum neurons into self-organizing feature mapping network (SOFM), a network information security evaluation model is constructed. The system can evaluate the security level of network information and visualize the evaluation results. The experimental results show that the system has fast response speed and strong interactivity. The accuracy of QSOFM algorithm is 86%, 12% higher than the traditional algorithm, which can provide more powerful technical support for the visual security cognition of network information.

Assessment of information security risks of automated system using neuro-fuzzy logic

Objective. Automated systems are widely used in production, and an important criterion for their reliability is information security. The aim of the study is to provide a balance between possible losses as a result of the implementation of threats and the cost of protection tools that reduce risks using neuro-fuzzy logic.Method. The developed model is based on the use of fuzzy logic.Result. A model of integrated information security risk assessment has been obtained, which can be practically applied for a comprehensive analysis of the effectiveness of organizing a protection system for automated systems operating in various fields of activity. The risk indicators of information security of an automated system, described with the help of linguistic variables, are revealed. Based on these indicators, information security risk assessments were obtained from the state of: software; technical support; information support; organizational and methodological support; the level of training and motivation of employees. The fuzzy production rules of the model are formulated to determine the integrated assessment of the information security of an automated system, providing a full account of all factors that have a significant impact on the level of security of an automated system.Conclusions. A feature of the proposed approach is the formalization of the assessment process, reducing the level of subjectivity in the formation of risk assessments.

The Application of Big Data and Artificial Intelligence Technology in Enterprise Information Security Management and Risk Assessment

With the development of digitalization and Internet technology, enterprise information security is facing more and more challenges. Many enterprises have begun to adopt big data (BD) and artificial intelligence (AI) technology for risk assessment (RA) and prediction to effectively manage information security risks. This article discusses the application of BD and AI technology in enterprise information security management (ISM) and RA from two aspects. Firstly, the mobile payment signature scheme based on number theory research unit is used to improve the security of the mobile payment system. This scheme uses lattice algorithms to achieve fast key generation, signing, and verification and can resist traditional cryptographic attacks. Secondly, a set of enterprise ISM and RA system is established, including risk identification, RA, monitoring and early warning, emergency response, and other links. BD and AI technology is used to analyze internal and external data to provide accurate RA results to achieve automated RA.

РАЗРАБОТКА ПРОГРАММЫ УПРАВЛЕНИЯ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТЬЮ В КОНФИГУРАЦИИ 1С: ПРЕДПРИЯТИЕ 8.3

An integrated approach to information security management is presented in the form of processes on the decomposition diagram of the IDEF0 model. The analysis of possible damage to information assets is recommended to be carried out according to two groups of criteria with the involvement of experts, based on qualitative scales. Expert analysis of information security threats and vulnerabilities through which they can be implemented is proposed to be carried out in conjunction with the use of qualitative scales, taking into account the presence of implemented control mechanisms in the organization. The results of the analysis are expressed in the form of the total level of the vulnerability group. A matrix for determining the magnitude of information security risk is constructed. The obtained qualitative estimates are compared with the quantitative indicator of the average annual damage and calibrated. As a marker of the effectiveness of protective mechanisms, it is proposed to choose the return on investment ratio. In order to increase the efficiency and convenience of conduct-ing an expert assessment of information security risks, automating the processing of the results ob-tained during the examination, as well as calculations on which the decision-maker can rely, a program was created in the configuration 1C: Enterprise 8.3

INFORMATION SECURITY RISK MANAGEMENT DESIGN OF SUPERVISION MANAGEMENT INFORMATION SYSTEM AT XYZ MINISTRY USING NIST SP 800-30

SIMWAS is an information system at the XYZ Ministry that is used to manage supervisory activities and follow up on supervisory results. SIMWAS is an important asset that contains all internal control business processes, but in practice, SIMWAS information security risks have not been managed properly. To overcome these problems, information security risk management is needed at SIMWAS. This study aims to design and analyze SIMWAS information security risk management using the NIST SP 800-30 framework. NIST SP 800-30 focuses on a particular infrastructure and its boundaries. Since the purpose is to perform a technical risk analysis of the core IT infrastructure, it is highly prescriptive. It has nine primary steps to conduct risk assessment. The NIST SP 800-30 framework is used to design and analyze SIMWAS information security risks by identifying threats, vulnerabilities, impacts, likelihoods, and recommendations for controls. SIMWAS information security risk assessment is carried out by analyzing data obtained from the results of interviews, observations, and document reviews. The results of this study show that SIMWAS information security has four low-level risks, eight moderate-level risks, and five high-level risks. Very low and low risk levels are acceptable according to the risk appetite of the business owner, but moderate, high, and very high-risk levels require risk avoidance, risk transfer and risk reduction. The XYZ Ministry need to carry out residual risk analysis and cost-benefit analysis from implementing controls in each risk scenarios.

When Security Risk Assessment Meets Advanced Metering Infrastructure: Identifying the Appropriate Method

Leading risk assessment standards such as the NIST SP 800-39 and ISO 27005 state that information security risk assessment (ISRA) is one of the crucial stages in the risk-management process. It pinpoints current weaknesses and potential risks, the likelihood of their materializing, and their potential impact on the functionality of critical information systems such as advanced metering infrastructure (AMI). If the current security controls are insufficient, risk assessment helps with applying countermeasures and choosing risk-mitigation strategies to decrease the risk to a controllable level. Although studies have been conducted on risk assessment for AMI and smart grids, the scientific foundations for selecting and using an appropriate method are lacking, negatively impacting the credibility of the results. The main contribution of this work is identifying an appropriate ISRA method for AMI by aligning the risk assessment criteria for AMI systems with the ISRA methodologies’ characteristics. Consequently, this work makes three main contributions. First, it presents a comprehensive comparison of multiple ISRA methods, including OCTAVE Allegro (OA), CORAS, COBRA, and FAIR, based on a variety of input requirements, tool features, and the type of risk assessment method. Second, it explores the necessary conditions for carrying out a risk assessment for an AMI system. Third, these AMI risk assessment prerequisites are aligned with the capabilities of multiple ISRA approaches to identify the best ISRA method for AMI systems. The OA method is found to be the best-suited risk assessment method for AMI, and this outcome paves the way to standardizing this method for AMI risk assessment.

Application of Big Data Technology in Enterprise Information Security Management and Risk Assessment

Nowadays, the application of enterprise management information has been deeply rooted in daily business activities, and the management risk of enterprise information security (EIS) has also increased. The use of advanced means to provide security protection for it has become the top priority. To optimize the EIS management system, and carry on the risk assessment (RA), firstly, this study analyzes the current situation of the enterprise's internal information management and summarizes the shortcomings and security risks faced by the system. In the era of big data (BD), the security risks of database information systems show a diversified trend. Secondly, to explore the application of BD technology in EIS management, the characteristics of this technology and security control measures for risks are summarized to strengthen the enterprise's information management innovation and implement the application of data security technology.

Identification of Network Vulnerabilities through IISRA Framework

Abstract: As the globe transitions to complicated networks and as we move towards digitization, its worth is rising daily. Working in an organization across a network and the internet creates vulnerabilities. As is well known, data is a crucial component of every organization and must be safeguarded from threats. The attackers' job is to try and take advantage of the networks by using these weaknesses. When organizations use the Internet, intranets, and related technologies more frequently, system security becomes one of the key considerations. Network security protects computer systems from unauthorized threats and breaches, which lowers the likelihood that confidential information may be stolen. The organization will feel more secure if these vulnerabilities are closed up in the systems and network well in advance of an attack. The availability of numerous technologies for network vulnerability assessment enables organizations to thwart potential attacks. In this research paper, we have developed an Integrated Information Security Risk Assessment (IISRA) Framework for identification of Network Vulnerabilities. We have implemented this IISRA Framework on real computing environment of an organization.