Information Security Risk Evaluation Research Articles

The assessment of smart city information security risk in China based on zGT2FSs and IAA method

The continuous expansion of the construction scale of smart city has reconstructed the urban information pattern. How to maintain the stability of information security while giving full play to the role of information sharing is a practical problem that must be solved for the sustainable development of smart city. Based on the information ecology theory, this paper construct the smart city information security risk evaluation system from six aspects. Then, zGT2FSs is established based on type-2 fuzzy set theory and IAA method, which fully considers the internal and external uncertainty of expert decision-making. According to the calculation results, the key influencing factors of information security risk of smart city are analyzed to provide suggestions and guidance for the formulation of information security control in the process of smart city construction in China.

Genetic Algorithm-Based Power System Information Security Risk Assessment Method

With the innovation and application of new-generation information technologies such as cloud computing, Internet of Things, and mobile Internet, the importance of information security issues has become more prominent. As an important industry linking people’s livelihood, the electric power industry will affect the safe operation of electric power once an information security incident occurs, and even lead to a large-scale blackout. Therefore, studying the information security risk assessment model of electric power enterprises has important theoretical value and practical significance. The purpose of this paper is to study the method of power system information security risk assessment based on genetic algorithm. This paper establishes a security risk quantification model, determines the operating parameters of the genetic algorithm in specific operations based on some literature cases, and compares the results in the literature with those in this paper. Based on a large number of investigations and interviews, this paper conducts research on information security risks, comprehensively considers the threats and vulnerabilities of the system, and analyzes the important impact of information security risks from the internal management, personnel, technology, and systems of electric power enterprises. Factors, the establishment of a power enterprise information security risk evaluation index system, this paper obtains data from actual system evaluation cases, uses multiplication, matrix method, and the genetic algorithm proposed in this paper to calculate the risk quantification model calculation results, and verifies the genetic algorithm the rationality and feasibility of combining with risk assessment, this method has practical application value. Experimental research shows that the risk value calculated by the genetic algorithm based on the risk quantification model proposed in this paper is more than 70% similar to the results calculated by the multiplication method and the matrix method, which proves that the model and calculation method established in this paper can be used. Applied to the specific evaluation implementation process.

Design of vehicle traffic information security risk evaluation index system based on grey evaluation method

The network security problem of vehicle traffic information system is becoming more and more prominent. In order to effectively defend the system, this paper conducts in-depth research on the network security of vehicle traffic information system and proposes an information security risk assessment system for vehicle traffic control center. Specifically, the vehicle traffic control center is divided into components, and the security attributes of each component of the vehicle traffic control center system are constructed. By studying the information interaction process between the vehicle traffic control center and other subsystems, the security attributes of each component are abstracted; Identify the risk value of the component based on the influence of the component’s security attribute on the risk assessment index, aiming to enhance the security defense capability of the vehicle traffic information system.

Dynamic Expert System-Based Geographically Adapted Malware Risk Evaluation Method

Fast development of information systems and technologies while providing new opportunities for people and organizations also make them more vulnerable at the same time. Information security risk assessment helps to identify weak points and preparing mitigation actions. The analysis of expert systems has shown that rule-based expert systems are universal, and because of that can be considered as a proper solution for the task of risk assessment automation. But to assess information security risks quickly and accurately, it is necessary to process a large amount of data about newly discovered vulnerabilities or threats, to reflect regional and industry specific information, making the traditional approach of knowledge base formation for expert system problematic. This work presents a novel method for an automated expert systems knowledge base formation based on the integration of data on regional malware distribution from Cyberthreat real-time map providing current information on newly discovered threats. In our work we collect the necessary information from the web sites in an automated way, that can be later used in a relevant risk calculation. This paper presents method implementation, which includes not only knowledge base formation but also the development of the prototype of an expert system. It was created using the JESS expert system shell. Information security risk evaluation was performed according to OWASP risk assessment methodology, taking into account the location of the organization and prevalent malware in that area.

CPS Information Security Risk Evaluation Based on Blockchain and Big Data

CPS Information Security Risk Evaluation Based on Blockchain and Big Data

A Hierarchical Information System Risk Evaluation Method Based on Asset Dependence Chain

The current information security risk evaluation methods are only concerned with the risk of system components, rarely based on risk perspective. Thus, it is difficult to meet different levels of information security risk comprehension such as the operational staff and the organization's manager. This paper proposes a hierarchical risk evaluation method based on asset dependence chain to quantify the hierarchical risk, the information systems security risks are divided into three levels: the component level, system level and organizational level. By analyzing the assets dependence in three levels, a business systems-information systems-system components assets dependence chain is formed. In the end, a hierarchical risk calculation method is presented. The risk analysis result can reflect the level of security risk evaluation needs more comprehensively and objectively.

A Scenario-Based Information Security Risk Evaluation Method

Risk evaluation is the core process of information security risk management. An effective risk evaluation can protect organizations and maintain their abilities to carry out missions and activities against threats as well as helping to implement controls and safeguards that are actually needed. While the traditional information security risk evaluation approaches are lack of granular analysis and clear expression of security characteristics of risk, such as the possibility, attack path, and business impact. This paper presents the scenario-based information security risk evaluation method, based on the thought of Advanced Persistent Threat (APT) attack, by constructing risk scenario, evaluate information system security risk status. The separation analysis of the technical impact and business impact contribute to the technicians and business decision makers to grasp system risk status from their respective responsibilities. In the end of the paper, we propose a practical risk scenario construction example, which provides scientific and effective guidance for the preparation of a risk evaluation report.

A Bayesian Assessment Method of Network Risk

Based on system analysis of information security risk factors and evaluation process, aiming at the uncertainty information is difficult to quantify the evaluation process, Bayesian network inference algorithm, and combined with the inference rules of conditional probability matrix is given by expert knowledge of Bayesian network, the evaluation model of information security risk. Finally an instance of the risk assessment approach on the model is analyzed which demonstrates the rationality and feasibility of this method. So it provides a new method for information security assessment.

Grey Evaluation Method on Security Risk Assessment of Power Information System

As information technology is widely used in electric power field, security risks penetrate into all aspects of electricity production and operation, meanwhile, complexity of electric power information system make it's very difficult to guard against security risk. Information security risk assessment is the foundation and the precondition of information system security. In this paper, combining long-term power information security supervision practice, we give a multi - hierarchy and multi - attribute index system of information security risk evaluation, and point out these indexes are characterized with grey, fuzzy and difficult to quantify. Then, the analytic hierarchy process (AHP) and the theory of grey system are introduced in setting up a comprehensive evaluation model, we obtain the final score using the information fusion of different experts. Additionally, an application example is used to illustrate the availability of the proposed evaluation method. The result shows that grey evaluation which combines advantages of the qualitative and quantitative methods can be applied to risk evaluate of information system more accurately and scientifically. Meanwhile the evaluation results can help supervisors judge which is the necessity to improve.