Information Security Risk Assessment Research Articles

A New Approach for Information Security Risk Assessment: Value at Risk

Most of the tools that are used for Information Security (ISEC) risk assessment are qualitative and are not grounded in theory. This paper presents and applies a well-known financial risk theory, Value at Risk (VaR), to the ISEC risk assessment. VaR in its most succinct form is defined as a figure that relates the amount of potential loss in a given portfolio to its probability, and describes the quantile of the projected distribution of losses over a given time period. From the ISEC perspective, VaR summarizes the worst loss due to a security breach over a target horizon, with a given level of confidence. Using this quantitative measure of risk, the best possible balance between risk and cost of providing security to mitigate the risk can be achieved.

Placing computer security at the heart of learning

In this paper we present the approach adopted at the UK’s Open University for teaching computer security to large numbers of students at a distance through supported open learning. We discuss how the production of learning materials at the university has had to change to reflect the ever-increasing rate of technological, legislative and social change within the computing discipline, and how the university has had to rethink the role of the academic in th ec ourse development process. We argue that computer security is best taught starting at th ee arliest level of undergraduate teaching and continuing through in-depth postgraduate study. We discuss our approach which combines the traditional technical aspects of security with discussions on the professional and ethical issues surrounding security and privacy. This approach presents computer security and privacy in the light of relevant legislative and regulatory regimes, thus the students have a firm grounding in the relevant national and international laws. We discuss the importance of international standards for information security risk assessment and management and as well as the relevance of forensic computing to a computer security curriculum. We conclude with an examination of our course development methodology and argue for a practitioner-led approach to teaching.

Developing An IT Risk Assessment Framework

In today’s business environment, almost all information is captured and stored in electronic form. This digital storage of data in a networked environment provides far greater access to information than ever before. But unfortunately, this also exposes the organization to a variety of new threats that can have impact on the confidentiality, integrity, and availability of information. Organizations need a way to understand their information risks and to create new strategies for addressing those risks. A systematic approach to assessing information security risks and developing an appropriate protection strategy is a major component of an effective information security and risk management program. This paper outlines an Analytic Hierarchy Process based approach for analyzing risk factors and sub factors and ascertaining the major areas of security elements where an organization should focus on.

On the role of the Facilitator in information security risk assessment

In organisations where information security has historically been a part of management and for which the risk assessment methodologies have been designed there are established methods for communicating risk. This is the case for example in the banking and military sectors. However in organisations where information security is not embedded into management thinking and where the relationship between information security and the business is less clear-cut, communicating the risks to the business is less straightforward. In such circumstances it has been observed during field research that information security risk assessments frequently output findings to which the business cannot relate and the process is consequently often viewed as a “tick box” exercise, as opposed to one that provides real value to the business. In such a situation the information security risk assessment is divorced from the business process and not embedded into the organisation’s processes or thinking. The research for this paper was undertaken in order to identify what needs to be done in order to ensure that businesses of this type find the risk assessment process valuable in practice.

A strategic modeling technique for information security risk assessment

PurposeThis paper seeks to present a conceptual modeling approach, which is new in the domain of information systems security risk assessment.Design/methodology/approachThe approach is helpful for performing means‐end analysis, thereby uncovering the structural origin of security risks in information systems, and how the root‐causes of such risks can be controlled from the early stages of the projects.FindingsThough some attempts have previously been made to model security risk assessment in information systems using conventional modeling techniques such as data flow diagrams and UML, the previous works have analyzed and modeled the same just by addressing “what” a process is like. However, they do not address “why” the process is the way it is.Originality/valueThe approach addresses the limitation of the existing security risk assessment models by exploring the strategic dependencies between the actors of a system and analyzing the motivations, intents and rationales behind the different entities and activities constituting the system.

A framework for the management of information security risks

This paper looks at the development of a framework for information security risk assessments within an organisation. A risk framework is a convenient and communicable tool that can be used to describe the principles and essential components of the security risk management process of an organisation. The framework shows how significant risks can be identified, assessed and treated. It also explains the measures that can be taken to mitigate or ‘treat’ the risk exposure of the organisation for the future. The risk framework will provide a common language, which can be used by all of the parties that are involved in the process, from the members of the board, through the security and audit staffs, to the end users of the systems, as a vehicle for communication and improved understanding. In addition, a risk framework will provide a high level outline for the way in which an organisation will implement information security risk management and define the roles of the key participants in the process.

Safe teleradiology: Information assurance as project planning methodology

The Georgetown University Medical Center Department of Radiology used a tailored version of OCTAVESM, a self-directed information security risk assessment method, to design a teleradiology system that complied with the regulation implementing the security provisions of the Health Insurance Portability and Accountability Act (HIPAA) of 1996. The system addressed threats to and vulnerabilities in the privacy and security of protected health information. By using OCTAVESM, Georgetown identified the teleradiology program's critical assets, described threats to the assurance of those assets, developed and ran vulnerability scans of a system pilot, evaluated the consequences of security breaches, and developed a risk management plan to mitigate threats to program assets, thereby implementing good information assurance practices. This case study illustrates the basic point that prospective, comprehensive planning to protect the privacy and security of an information system strategically benefits program management as well as system security.

Assessing information security risk in dual-use health information systems

This paper explores assessing the relationship between mission risk and information assurance risk in complex, dual-use information systems. Project Sentinel Collaboratory conducted a prospective information security risk assessment using the OCTAVE sm to help plan protection for a special information system that supported patient care in a multi-hospital network and medical surveillance for the Washington, DC region. Although the two missions function compatibly during baseline operations, conditions of heightened alert uncover incompatibilities that threaten both information and mission assurance.

Organizing Safety: Conditions for Successful Information Assurance Programs

Organizations must continuously seek safety. When considering computerized health information systems, "safety" includes protecting the integrity, confidentiality, and availability of information assets such as patient information, key components of the technical information system, and critical personnel. "High Reliability Theory" (HRT) argues that organizations with strong leadership support, continuous training, redundant safety mechanisms, and "cultures of high reliability" can deploy and safely manage complex, risky technologies such as nuclear weapons systems or computerized health information systems. In preparation for the Health Insurance Portability and Accountability Act (HIPAA) of 1996, the Office of the Assistant Secretary of Defense (Health Affairs), the Offices of the Surgeons General of the United States Army, Navy and Air Force, and the Telemedicine and Advanced Technology Research Center (TATRC), US Army Medical Research and Materiel Command sponsored organizational, doctrinal, and technical projects that individually and collectively promote conditions for a "culture of information assurance." These efforts include sponsoring the "P3 Working Group" (P3WG), an interdisciplinary, tri-service taskforce that reviewed all relevant Department of Defense (DoD), Miliary Health System (MHS), Army, Navy and Air Force policies for compliance with the HIPAA medical privacy and data security regulations; supporting development, training, and deployment of OCTAVE(sm), a self-directed information security risk assessment process; and sponsoring development of the Risk Information Management Resource (RIMR), a Web-enabled enterprise portal about health information assurance.

Organizing Safety: Conditions for Successful Information Assurance Programs

Organizations must continuously seek safety. When considering computerized health information systems, "safety" includes protecting the integrity, confidentiality, and availability of information assets such as patient information, key components of the technical information system, and critical personnel. "High Reliability Theory" (HRT) argues that organizations with strong leadership support, continuous training, redundant safety mechanisms, and "cultures of high reliability" can deploy and safely manage complex, risky technologies such as nuclear weapons systems or computerized health information systems. In preparation for the Health Insurance Portability and Accountability Act (HIPAA) of 1996, the Office of the Assistant Secretary of Defense (Health Affairs), the Offices of the Surgeons General of the United States Army, Navy and Air Force, and the Telemedicine and Advanced Technology Research Center (TATRC), US Army Medical Research and Materiel Command sponsored organizational, doctrinal, and technical projects that individually and collectively promote conditions for a "culture of information assurance." These efforts include sponsoring the "P3 Working Group" (P3WG), an interdisciplinary, tri-service taskforce that reviewed all relevant Department of Defense (DoD), Miliary Health System (MHS), Army, Navy and Air Force policies for compliance with the HIPAA medical privacy and data security regulations; supporting development, training, and deployment of OCTAVEsm, a self-directed information security risk assessment process; and sponsoring development of the Risk Information Management Resource (RIMR), a Web-enabled enterprise portal about health information assurance.

Assessing information security risk in healthcare organizations of different scale

This paper will discuss the execution of Operationally Critical, Threat, Asset and Vulnerability Evaluations (OCTAVE sm) at three healthcare organizations of different scale, complexity and geographic location. Each conducted their evaluations with similar objectives; execution of a Risk Assessment to meet HIPAA security rule requirements. A comparison of results identified technical and organizational observations common to all three organizations, suggesting that these issues may be prevalent throughout the industry. The resource limits of organizations and the time required to implement effective protection strategies and mitigation plans significantly influenced decisions regarding which risks were ultimately selected for mitigation, deferral, or acceptance. The evaluation of risks in terms of organizational impact was found to be critically important and was the most influential factor considered when prioritizing risks for mitigation. This observation supports the concept of a decentralized decision-making approach to information security in the healthcare industry, allowing organizations to prioritize risks for mitigation according to their own criteria. The utilization of an industry-recognized risk assessment methodology such as OCTAVE provided an element of due diligence to the process while allowing each organization the freedom to consider their own unique circumstances, tailor the methodology and document their decisions accordingly.

Safe teleradiology: information assurance as a project planning methodology

The Department of Radiology, Georgetown University Medical Center executed OCTAVE sm, a self-directed information security risk assessment process, as a method for comprehensively planning a new teleradiology system. Originally designed to evaluate retrospectively the organizational and technical risks to the confidentiality, integrity and availability of existing information management programs, Georgetown surmised that OCTAVE sm should be useful as a prospective planning tool to build information assurance into the teleradiology program from its start. Georgetown also wondered how approaching system planning from the perspective of information assurance would affect the general program planning and development. Implementing the OCTAVE sm process, Georgetown identified the teleradiology program's critical assets, described threats to the assurance of those assets, developed and ran vulnerability scans of a system pilot, evaluated the consequences of security breaches for patients, the teleradiology program and Georgetown and developed a risk management plan to mitigate threats to program assets and implement good information assurance practices in program management. As a result, Georgetown built a teleradiology program that complies with regulatory efforts such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and integrates health information assurance into the program's core.