Information Security Risk Management Research Articles

ВЫБОР ИНСТРУМЕНТАРИЯ ДЛЯ ОЦЕНКИ РИСКОВ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

The basic requirements for information security risk management systems are formulated, a comparative analysis of the systems is carried out, as a result of which their main advantages and disadvantages are revealed

Investigating information security risk management in Yemeni banks: An CILOS-TOPSIS approach

In today's digital age, the banking sector faces increasing challenges in ensuring operational resilience, protecting customer assets, and maintaining a competitive edge. Prioritizing information security risk management (ISRM) practices is crucial to effectively address these challenges. This paper aims to demonstrate the effectiveness of the multi-criteria decision-making (MCDM) method in evaluating and improving ISRM practices in Yemeni banks. The study employs an integrated CILOS-TOPSIS model, considering two criteria and five sub-criteria, with criteria weights determined using the CILOS method. The results highlight the significance of specific criteria in ISRM, with the existence of a comprehensive business continuity and disaster recovery plan (C2.1) standing out as a top priority (weight: 0.266). Additionally, the frequency of data backups and the presence of an active backup policy (C2.2) and the adequacy of physical security measures (C1.1) are identified as crucial factors (weights: 0.228 and 0.203, respectively). Furthermore, the TOPSIS method is employed to rank 13 banks based on these criteria, revealing the top-performing banks as B10, B4, B13, B1, and B12. Conversely, the 7th, 5th, and 6th ranked banks require attention for improvement. The paper provides comprehensive details on criteria weighting, bank ranking, and recommendations for enhancements. The findings presented in this paper offer valuable insights to decision-makers in the banking sector, enabling them to effectively guide their efforts and allocate resources to areas, controls, and banks that require greater attention.

ЭФФЕКТИВНОСТЬ АВТОМАТИЗИРОВАННОГО УПРАВЛЕНИЯ ТРАНСПОРТНЫМИ СРЕДСТВАМИ В ТРАМВАЙНЫХ СИСТЕМАХ

The intellectualization of water transport is accompanied by an expansion of the landscape of threats to transport security, caused by the characteristics and weaknesses of the technologies being introduced, which are the convergence of information and telecommunication technologies, automated and automatic control technologies and artificial intelligence. The peculiarity of these technologies is working with large volumes of information. Violation of the security of information processed in intelligent systems of water transport (illegal access, modification, deletion and similar unauthorized influence) causes a violation of transport security and, as a consequence, the security of critical information infrastructure and the country’s critical infrastructure, national security. Convergent technologies used in intelligent transport systems are characterized by multiple and poorly formalized manifestations of the consequences of threats. The article presents a model for assessing the risks of information security of intelligent water transport systems, based on the methods of the theory of fuzzy sets and fuzzy logic, the use of which makes it possible to take into account the above-mentioned features of the technologies being implemented. The hierarchical structure of the model and the use of fuzzy set theory and fuzzy logic methods make it possible to adapt the model to various risk criteria, types of input data and the level of detail of risk analysis. For the presented model, a methodology for assessing information security risks has been developed and an example of risk calculation is given. The developed model and methodology are intended to build an information security risk management system for autonomous shipping, implementing technologies of hybrid (augmented, extended) intelligence, providing for the use of artificial intelligence controlled by people.

НЕЧЕТКАЯ СИСТЕМА ОЦЕНКИ РИСКОВ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ ИНТЕЛЛЕКТУАЛЬНЫХ СИСТЕМ ВОДНОГО ТРАНСПОРТА

The intellectualization of water transport is accompanied by an expansion of the landscape of threats to transport security, caused by the characteristics and weaknesses of the technologies being introduced, which are the convergence of information and telecommunication technologies, automated and automatic control technologies and artificial intelligence. The peculiarity of these technologies is working with large volumes of information. Violation of the security of information processed in intelligent systems of water transport (illegal access, modification, deletion and similar unauthorized influence) causes a violation of transport security and, as a consequence, the security of critical information infrastructure and the country’s critical infrastructure, national security. Convergent technologies used in intelligent transport systems are characterized by multiple and poorly formalized manifestations of the consequences of threats. The article presents a model for assessing the risks of information security of intelligent water transport systems, based on the methods of the theory of fuzzy sets and fuzzy logic, the use of which makes it possible to take into account the above-mentioned features of the technologies being implemented. The hierarchical structure of the model and the use of fuzzy set theory and fuzzy logic methods make it possible to adapt the model to various risk criteria, types of input data and the level of detail of risk analysis. For the presented model, a methodology for assessing information security risks has been developed and an example of risk calculation is given. The developed model and methodology are intended to build an information security risk management system for autonomous shipping, implementing technologies of hybrid (augmented, extended) intelligence, providing for the use of artificial intelligence controlled by people.

Development of a mechanism for information security risk management of transport service provision systems

The object of the study is the process of analysis, assessment, and management of information security risks in transport service provision systems. The problem of applying the information security risk management approach in the activities of transport business entities was investigated. As a result of the application of effective forms, methods, and means of information security risk management based on international standards, a risk management mechanism was developed. The risk assessment process of transport systems has been systematized. This allows business entities in the transport sector to determine ways to prevent and counter information threats and challenges in their activities, both when designing and operating systems for providing transport services. Verification of the devised methodical approach to information security risk management was carried out on an example of the taxi company «Taxifay N». Threats and challenges of the company’s information system were evaluated by an expert method. Based on the results of the analysis of expert risk assessment, it was found that the concordance coefficient (0.86) confirms the high level of agreement of experts’ opinions. As a result, the company’s information security risk management program was developed. The effectiveness of the program was assessed by the efficiency ratio, which was 0.64. This testifies to the effectiveness of the implemented program of measures to manage information security risks. The scope of application may be the activity of business entities that provide transport services to the population, aimed at data storage and processing. The prospect of this study is to expand the list of threats and categories of vulnerabilities depending on the characteristics of the economic activity of various enterprises

Digital media system design and visual art analysis based on information security

BackgroundWith the growing maturity of Internet technology and 5G transmission technology, digital media systems begin to present more complex scenario applications. Software design security issues are also increasingly evident in digital media systems. This paper analyzes the security issues of digital media system design from the perspective of software protection security. Discussed based on the information security digital media system design and visual art analysis. MethodsThis paper discusses based on the software security protection design and visual art analysis, first proposed the media convergence and information security risk assessment research, including media convergence cognition, information security risk management theory, system information security risk assessment methods and based on the media under the digital certificate. Secondly, the information security algorithm based on digital media technology is studied. From the basic knowledge of digital image, a method of image encryption based on the change of pixel value, the common algorithm of digital image watermarking technology and the encryption technology of digital media are summarized. ResultsExperiments were carried out on three art painting data sets, including Painting91, Oil Painting and Pandora. Compared with the existing label distribution learning methods on the Painting91style dataset, the algorithms SA-IIS and SA-BFGS achieve the classification accuracy of 65.51 % and 66.52 %, respectively. The classification result of the baseline method of VGGNet is 63.89 % on the OilPainting dataset. On the Pandora-style dataset, the classification accuracy of MSCNN1 method is 71.32 %, and the experimental results of CNNF4 method reach 71.76 %. ConclusionThe method proposed in this paper has good application results in different data sets, and the digital media art design system has high reliability and fault tolerance. From the perspective of information security, different index systems have higher security levels.

RİSK MANAGEMENT IN İNFORMATİON EXCHANGE

The field of risk management is one of today's most main fields. Risk-free business is not possible. It is necessary to calculate the risks that arise in every business so that it does not create any problems for us later. Although it is not possible to reduce the risk to zero, it is possible to reduce the risk. One of the most utilised areas of the risk term is the risk of informatisation. Ensuring the confidentiality, integrity and transparency of information is one of today's main problems. For this purpose, some standards and standards have been prepared. Some of these standards are ISO 27001 and ISO 31000. With the widespread use of computer networks and the Internet, Information Security has become very important. Since organisations are mostly dependent on information, technology and systems, Information Security is of vital importance and the need to protect information assets from damage arises from this. On the other hand, many companies still do not take adequate and necessary measures in information security. As a result, many companies, including many large and international organisations, are under serious threat. In order to be able to recognise these threats in advance and to reduce the severity of threats, it is necessary to comply with the Risk Management and the whole of the ISO 27001:2022 standard. Today, organisations face a risk in almost every transaction. It is necessary to identify and evaluate the risks that may arise during the functions of the institutions carefully and in detail in advance and to take measures to minimise or completely eliminate these risks. In this article, the steps to be taken to meet the requirements of ISO 27001:2022 Information Security Management System Risk Management are analysed step by step and a software has been developed to enter the data containing these requirements and receive the relevant reports. In this context, the ISO 27000:2018 family referenced by the ISO 27001:2022 Standard has been examined. The ways in which risk analyses can be performed and how risk improvement can be achieved have been investigated. As a result of the study, all these have been brought together in a software and made reportable. The security structure should be established by taking into account the differences of the organisation and the system. Afterwards information security risk management and methods that are not fully detailed in the standard. A documentation by analysing assets under a corporate information processing structure has been created. To create this structure and at the same time to create a dynamic a basic level of information security control software has been produced to provide control. Keywords: Information, information security, risk, risk management, risk analysis.

Problems of risk management in the field of information security

Objective. The purpose of the study is to collect publicly available information to identify the main problems that hinder the effective management of information security risks in the business sector.Method. The following research methods are used: systematization, description and analysis. The necessary data are formed on the basis of information obtained from the analysis of the regulatory framework and research in the field.Result. In this paper, the relevance of the issue under consideration was substantiated; the significant effectiveness of the risk-based approach in information security management was noted. The key stages of the information security risk management process were described. Next, the main problems of information security risk management for all stages of the holistic process are identified.Conclusion. The conducted research is of an overview nature. The materials presented in the paper can serve as a basis for further research on the topic, as well as for the formation of recommendations for resolving the identified problems.

Assessment of Higher Education Information Security Risk Management Practices in Tanzania

This study assessed the information security risk management practices in in Tanzanian Higher Education Institutions (HEIs). It employed the sequential explanatory research design. Out of 51 HLIs in Tanzania, the study selected 10 HEIs from Dar es Salaam. The researchers computed the sample estimation through the Cochran’s formula for large population with a precision level of ±10 percentage and confidence level of 95%. The actual sample size was 96 ICT professionals in terms of ICT directors, network administrators, system administrators, ICT support staff and lecturers of ICT. The study used a closed-ended questionnaire, which had Yes/No questions and a structured interview, which collect qualitative data. Quantitative data analysis from the questionnaire was done through descriptive statistics using the SPSS whereas qualitative data from interviews was analyzed using the thematic analysis approach. The study uncovered a notable absence of risk management frameworks and inadequate integration of procedures within institutional strategies. While some HEIs demonstrated effective safeguarding of sensitive information, others required enhancements. The study recommend that HEIs should establish formal risk management frameworks and integrate them strategically into institutional plans. To bridge the implementation gap, HEIs should prioritize comprehensive training, require management support and tailor practices according to their specific contexts.

INFORMATION SECURITY RISK MANAGEMENT DESIGN OF SUPERVISION MANAGEMENT INFORMATION SYSTEM AT XYZ MINISTRY USING NIST SP 800-30

SIMWAS is an information system at the XYZ Ministry that is used to manage supervisory activities and follow up on supervisory results. SIMWAS is an important asset that contains all internal control business processes, but in practice, SIMWAS information security risks have not been managed properly. To overcome these problems, information security risk management is needed at SIMWAS. This study aims to design and analyze SIMWAS information security risk management using the NIST SP 800-30 framework. NIST SP 800-30 focuses on a particular infrastructure and its boundaries. Since the purpose is to perform a technical risk analysis of the core IT infrastructure, it is highly prescriptive. It has nine primary steps to conduct risk assessment. The NIST SP 800-30 framework is used to design and analyze SIMWAS information security risks by identifying threats, vulnerabilities, impacts, likelihoods, and recommendations for controls. SIMWAS information security risk assessment is carried out by analyzing data obtained from the results of interviews, observations, and document reviews. The results of this study show that SIMWAS information security has four low-level risks, eight moderate-level risks, and five high-level risks. Very low and low risk levels are acceptable according to the risk appetite of the business owner, but moderate, high, and very high-risk levels require risk avoidance, risk transfer and risk reduction. The XYZ Ministry need to carry out residual risk analysis and cost-benefit analysis from implementing controls in each risk scenarios.

Information Security Risk Management in Yemeni Banks: An Evaluation of Current Practices

Information Security Risk Management in Yemeni Banks: An Evaluation of Current Practices

Manajemen Resiko Keamanan Aset Informasi Pada Puskesmas Pancur Batu Tuntungan

Information security risk management is an important aspect of managing information systems at the Pancur Batu Health Center. This study aims to identify threats and risks that may occur to IT assets, as well as provide recommendations for appropriate risk management. The method used is ISO 27005/2011. The results of the study show that the overall security risk of IT assets is moderate and relatively small. The main recommendations given are the implementation of asset management policies and SOPs. Further research development will focus on assessing and managing existing threat risks to maintain good service.

ПРОБЛЕМЫ УПРАВЛЕНИЯ РИСКАМИ В СФЕРЕ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

The deals in issues of the risk management in the field of information security (IS). It considers the main factors that can lead to a violation of information security requirements, such as vulnerabilities in the system, human errors and actions of intruders, various approaches to IS risk management, including technical and organizational measures. Special attention is paid to the importance of the risk management system for business in general and for individual organizations in particular. The article offers practical recommendations for managing IS risks and evaluating the effectiveness of such a system. The results and conclusions presented in the article can be used to optimize the IS risk management system in organizations of various industries. An important aspect emphasized in the article is the ongoing adapting and updating the risk management system in information security according to the changing situation and technological development. Through the suggested recommendations and assessments of the effectiveness of the IS risk management system, organizations can improve their ability to prevent security incidents, minimize data loss, protect reputation and comply with legal requirements. Ultimately, an effective IS risk management system becomes an integral part of the business strategy, contributing to sustainable development and ensuring long-term success.

GENERALIZED RISK ASSESSMENT PROCEDURE FOR SOFTWARE TESTING OF LEGALLY REGULATED MEASURING INSTRUMENTS

The legal metrology covers measuring instruments (MI), the measurement results of which are used in calculations for consumed energy resources, in the fields of information protection, security, environmental protection, etc. Most modern MIs use microcontrollers or are controlled by computers. The software (SW) of such MIs provides an opportunity not only to automate the processes of measurement and calculation of results but also to ensure long-term storage and data transfer. The manufacturer is responsible for investigating and assessing all possible risks related to the MI SW. The task of the conformity assessment body is to assess the conformity of MIs adequately in general and software, in particular, to the established requirements based on the analysis of risk classes. Standards for information security risk management, information technology security assessment, and information technology security assessment criteria consider only general issues of software security and risk assessment without taking into account the scope of its application. The existing regulatory documents on software risk management were considered. Modern methods of assessing the risks of the MI SW were studied. To assess the risks of software of legally regulated MIs, a general classification of threats and vulnerabilities of MI SW was made. For choosing threats that affect functionality, only those that affect metrological characteristics during measurement are taken into account. Possible manifestations of the impact of threats on stored data can be their distortion or destruction, and transmissions of data can be data distortion during transmission or data loss due to a break in the telecommunications connection. A proposed simplified risk assessment methodology for assessing the compliance of MI SW without statistical data on the probabilities of threats and the amount of harm from the implementation of threats is presented. Risk is defined as the probability of harm due to a certain vulnerability, taking into account the conditional amount of harm.

Information security risk management terminology and key concepts

Language is the foundation for any communication and the vocabulary used has a decisive influence on the ability of the communication partners to clearly understand each other. In Information Security Risk Management (ISRM), the terminology used is often dictated by industry standards and frameworks. However, there is no universally accepted terminology, which makes collaboration difficult for professionals and researchers alike. This publication compares the terminology defined by frequently used frameworks, such as ISO and NIST, in the field of ISRM. It examines the terms and inherent concepts of each terminology, compares the notion of risk and derives a concept diagram based on the most important key concepts. The result facilitates a common understanding of ISRM across frameworks and organisational boundaries, thus enables further research, discussion, intra- and inter-firm communication.

ANALYSIS OF RELIGIOUS COURT INFORMATION SECURITY RISK MANAGEMENT USING THE OCTAVE ALLEGRO METHOD (CASE STUDY OF KEDIRI CITY)

Ease of access can be pros and cons for all information system applications, because it increases the possibility of someone hacking the information system. Therefore, a risk assessment or risk assessment of information systems is needed to identify and understand the risks involved in accessing them. One of the risk assessment methods that analyzes the risk profile of information assets using the OCTAVE Allegro method. The purpose of this study was to determine the results of the analysis of security risk management on information systems at the Religious Courts of the City of Kediri. The recommendation process is a follow-up to the risk assessment in the form of controls in ISO/IEC 27002:2013 which focuses on clause 9. Access Control. This research uses a literature study approach . The literature review was carried out by looking for references to information security risk management analysis using the OCTAVE Allegro method, research material books and research journals to assist in the preparation of this research proposal. The theory taken from the reference mainly refers to the OCTAVE Allegro method. Based on the results of the research conducted, the researchers got 10 areas of attention that will be given control recommendations based on ISO/IEC 27002:2013.

Module for expected losses assessing in the information security risk management system of a construction company

The article examines the problem of the expected losses effective assessment in a construction company upon materialization of information security threats. One of the ways to partially solve this problem is proposed. It is suggested to improve the capabilities of the respective module of the risk management system, which provides the user with a human-machine toolkit for expert assessment of expected losses. This toolkit consists of several stages. The toolkit considers the most effective evaluation scenario given the existing situational decision-making conditions. In order to ensure the operation of the module, the informational and logical connections between the evaluation stages are also defined and the apparatus for the formation of various evaluation scenarios is designed. In addition, to increase the accuracy of the results and increase the flexibility of the proposed algorithm, the possibility of selecting the evaluation scenario by the user with the appropriate role is provided. Since the paper considers the problem of multi-criteria evaluation, the hierarchy of criteria is formalized, and the weight of their influence on the calculation results is also taken into account. When building a logical-mathematical apparatus, the possibility of realizing various types of threats to various information assets (IA) of the enterprise is also considered. The assessment of the consequences of information security threats can be carried out at different levels: general and distributed, taking into account various indicators such as violations of confidentiality, integrity and availability of information. The methods of direct expert evaluation, analytic hierarchy process (AHP), Delphi, linear convolution of criteria, probabilistic modeling are used in the development of the logico-mathematical apparatus. A qualitative-quantitative scale is used to formalize expert judgments. The necessary roles of experts for effective evaluation have been defined. Summarization of experts' assessments is carried out with control of the adequacy of the degree of logic and dispersion of the opinions of each expert, in accordance with the established requirements for the degree of agreement of the opinions of a group of experts. Competence of the experts is also taken into account during assessment.

Impact of Implementation of Information Security Risk Management and Security Controls on Cyber Security Maturity (A Case Study at Data Management Applications of XYZ Institute)

Information security is an important concern for governments and industry due to the increase in cyber attacks during Covid-19. The government is obliged to maintain information security in implementing an Electronic-Based Government System following Presidential Regulation of the Republic of Indonesia Number 95 of 2018. To overcome this problem, the XYZ Institute needs an approach to implementing information security risk management and information security controls. This study aims to risk identification, risk analysis, risk evaluation, risk treatment, risk acceptance, risk control, and analysis of cyber security maturity gaps in the domain of governance, identification, protection, detection, and response. ISO/IEC 27005:2018 as guidance for conducting risk assessments. The code of practice for information security control uses the ISO/IEC 27002:2013 standard and assessing maturity using the cyber security maturity model version 1.10 developed by the National Cyber and Crypto Agency of the Republic of Indonesia. The results show that the cyber maturity value increased from 3.19 to 4.06 after implementing 12 new security controls.

CAESAR8: An agile enterprise architecture approach to managing information security risks

In theory, implementing an Enterprise Architecture (EA) should enable organizations to increase the accuracy of information security risk assessments. In reality, however, organizations struggle to fully implement EA frameworks because the requirements for implementing an EA and the benefits of commercial frameworks are unclear, and the overhead of maintaining EA artifacts is unacceptable, especially for smaller organizations. In this paper, we describe a novel approach called CAESAR8 (Continuous Agile Enterprise Security Architecture Review in 8 domains) that supports dynamic and holistic reviews of information security risks in IT projects. CAESAR8’s nonlinear design supports continuous reassessment of information security risks, based on a checklist that assesses the maturity of security considerations in eight domains that often cause information security failures. CAESAR8 assessments can be completed by multiple stakeholders independently, thus ensuring consideration of their tacit knowledge while preventing groupthink. Our evaluation with experienced industry professionals showed that CAESAR8 successfully addresses real-world problems in information security risk management, with significant benefits particularly for smaller organizations.

Information Security Risk Management Model for Big Data

In the current society of rapid expansion of information, big data have achieved vigorous development in all walks of life, considerably promoting data transmission and information sharing. Meanwhile, individuals are becoming increasingly reliant on big data and the Internet, but at the same time, the threat of information security posed by big data is becoming increasingly visible. As a result, how to protect the information security of big data has piqued the interest of both government and businesses. The essence of information security management is risk management, which is closely related to each other. Therefore, this study focuses on the following two aspects of research work. On the one hand, most existing risk management models merely describe risk management in the abstract from a macro-level, and they lack research on risk assessment, making them ineffective. This research builds a novel information security risk management model on the basis of existing risk management models based on the concept of multidimensional risk management. To achieve multidimensional dynamic management of big data risks and to keep them within an acceptable range as much as possible, the model is divided into five levels and two dimensions. On the other hand, this research also optimizes and improves the fuzzy mathematical analysis method and proposes a fuzzy comprehensive assessment method as the core algorithm for the risk assessment layer in the model. As a post-event risk assessment method, the advantage of this method is that it can comprehensively consider factors affecting risk and can quantify some assessment factors in the real network to achieve an effective combination of qualitative and quantitative, thereby providing a basis for decision-making in risk analysis and risk control. Finally, the effectiveness of the risk model in the real application is verified by example analysis, and it is intended that the study work would provide assistance and assurance for big data information security management.