Information System Security Risk Research Articles

FRAMB: A man-machine cooperation risk assessment method for intelligent network information systems

The intelligent network information systems, such as smart grid systems, face many security problems in the aspects of sensing, communication and computing. Information security risk assessment is an important way to assess the threats faced by information systems before risk events occur and ensure the security of assets. However, a comprehensive risk assessment of the system is a very resource-consuming process. Many existing risk assessment methods rely on a large number of experts and computing resources. Their assessment results are vulnerable to the differences in experts’ subjective judgments. Therefore, we propose FRAMB, a novel man-machine collaborative risk assessment method based on fitting upper and lower bounds. Firstly, we present a risk assessment criterion including four categories and sixteen risk factors following the ISO/IEC 27005:2018 standard. On this basis, we present the DFAHP and CM-NN assessment models to obtain the upper and lower bounds of the risk assessment value, which provides a reference for expert assessment. FRAMB integrates the experts’ assessment value and the values of upper and lower bounds, and adjusts the weights of these values to give the final risk assessment value. We introduce the risk assessment process of FRAMB in detail through a case study of the smart grid system risk assessment. We evaluate the effectiveness and accuracy of FRAMB through experiments. The experimental results show that FRAMB can effectively and accurately assess the security risks of the intelligent network information systems.

Application of Big Data Technology in Enterprise Information Security Management and Risk Assessment

Nowadays, the application of enterprise management information has been deeply rooted in daily business activities, and the management risk of enterprise information security (EIS) has also increased. The use of advanced means to provide security protection for it has become the top priority. To optimize the EIS management system, and carry on the risk assessment (RA), firstly, this study analyzes the current situation of the enterprise's internal information management and summarizes the shortcomings and security risks faced by the system. In the era of big data (BD), the security risks of database information systems show a diversified trend. Secondly, to explore the application of BD technology in EIS management, the characteristics of this technology and security control measures for risks are summarized to strengthen the enterprise's information management innovation and implement the application of data security technology.

Cyber security risks of interconnected information systems in intelligent management of microgrid communities

The paper examines ways to form energy communities, analyzes various management structures for such communities, assesses and identifies possible threats and vulnerabilities of information systems (IS), possible failures and failures in IS during cyberattacks, which can lead to errors in the formation of control actions. An approach to reducing the cybersecurity risks of the information infrastructure of the microgrid community is proposed.

Information System Security Risk Management E-Learning Using FMEA in University

The security of information systems in the learning process during the Covid-19 pandemic is very important for educational institutions today, which are based on government regulations that require learning to be done online In order to prevent the transmission of covid-19, people are advised to stay at home, but the learning process must continue In the process of learning system risk is a point that must be considered In online learning, information system security risk management can use the FMEA platform to analyze data security and minimize risks that occur © 2020, World Academy of Research in Science and Engineering All rights reserved

Research on Security and Protection of Grid System Information Communication Network

Smart Grid is the product of deep integration of power system and information network. It applies advanced control technology, communications, information and networking to power systems. In the power generation, transmission, substation, power distribution, power consumption and dispatching, the integrated two-way flow of power flow and information flow is realized in the power grid. The smart grid information exchange is frequent, the coverage is large, the related equipment is complex, and any node may have information security problems, which causes the smart grid to malfunction and cause different degrees of harm to the society. Therefore, information security issues have become an important factor affecting the development of smart grids. This paper discusses the development overview, architecture and key technologies of smart grids and analysis the security risks of current smart grid information systems. Aiming at the information security problem in smart grid information communication system, an access control scheme is proposed to facilitate key management and maintenance, which improves the security of the communication system in the smart grid, enabling the smart grid system to operate more safely and reduce the harm caused by grid damage to society.

An integrated conceptual model for information system security risk management supported by enterprise architecture management

Risk management is today a major steering tool for any organisation wanting to deal with information system (IS) security. However, IS security risk management (ISSRM) remains a difficult process to establish and maintain, mainly in a context of multi-regulations with complex and inter-connected IS. We claim that a connection with enterprise architecture management (EAM) contributes to deal with these issues. A first step towards a better integration of both domains is to define an integrated EAM-ISSRM conceptual model. This paper is about the elaboration and validation of this model. To do so, we improve an existing ISSRM domain model, i.e. a conceptual model depicting the domain of ISSRM, with the concepts of EAM. The validation of the EAM-ISSRM integrated model is then performed with the help of a validation group assessing the utility and usability of the model.

Research of Information System Security Risk Management based on Probability Model and Security Entropy

Nowadays, there is a big challenge on the security risk of information system with the rapid development of network. Computer viruses have brought great intimidation on information systems, which made the loss of worldwide information security moving up. Therefore, more and more people focus on the security problem of information systems, which need our appropriate protection. At first, the principle approach from security risk identification to risk management is proposed. Secondly, an information system security risk management algorithm based on probability model and security entropy is described in detail. Thirdly, a particular system is selected as the example. The whole risk of information system security is modelled and computed according to the risk management computing formula. In accordance with the example, the applicability and feasibility of the probability model is verified. The method proposed in this paper provides some use of reference in the risk management of information system security and execution of security measures.

Analysis of Power Network Behavior Security Analysis Technology

Nowadays, with the rapid development of science and technology, network information technology is widely applied to various enterprise departments. In order to meet the increasing social needs, power companies have also built power network information systems. The establishment of the network information system has been put into use, which has greatly improved the efficiency of the power enterprise. However, the security risks of network information systems have followed. Once the network is damaged by the attack, it will cause the power system to fail to operate normally, which will inevitably cause significant losses. Power system information security issues threaten the security of the power system and the entire power industry. Studying the information security of power systems, how to protect the power information network from threats, how to ensure the safe and stable supply of electricity to the whole society, and striving to develop a safe and effective power network information system is an important issue facing the development of information technology.

Implementation of the process approach to managing risks of information security in the NIST documents

The methodological foundations of activity of the National Institute of Standards and Technology of the United States (NIST) are explored. The focus is on the process approach to developing recommendations, manuals, guidelines, framework documents. The principles established by such documents direct the activities of organizations to manage information security risks. In this article analyzes methodical documents on information security, cyber security and computer security aimed to help select a set of security control measures. In particular, this analysis relates to such stages of work of the protection of information. First, the classification of information and information systems. Secondly, the application of the basic rules relating to organizational measures for information protection. Thirdly, it is the implementation of selective control measures of protection, which are appropriate and adequate to a certain information system. The explored methodical documents NIST provides practical advices to specialists in information protection for decrease the risks of information security. The use of the methodical documents NIST in the United States is mandatory for government agencies and organizations. The security system developed on their basis is aimed at reducing the security risks of information and information systems for any organizations, and not only the state form of ownership. The proposed basic protection measures can be adapted for practical application with minor modifications. Creating an effective, individual, integrated system of information security is an important task, which is based on the process of managing information security risks. The security system will save both the profitability of the organization and its reputation by reducing the risks of information security.

Information System Security Risk Evaluation Model Based on Improved Dempster-Shafer Evidence Theory

To deal with the uncertainty of information system security risk evaluation, a risk evaluation model combining Dempster-Shafer evidence theory and grey relational analysis is proposed. In this model, an evaluation index system is established. The risk evaluation rate of information system security is educed by using improved Dempster-Shafer theory. For each risk rating, the Basic Probability Assignment(BPA) function in Dempster-Shafer theory is get by calculating the grey relational grades, so the difficult issue of determining the BPA with Dempster-Shafer theory is solved. The Dempster-Shafer fusion strategy was applied to fuse the evaluation ratings in different data sources for evaluation conclusion. Finally, a case proves that the method is feasible and effective.

How Much Matter Probabilities in Information Security Quantitative Risk Assessment?

The starting point of this research essay is a critical review of two methods to conduct a quantitative analysis of information systems security risks: 1) Management of Risk: Guidance for Practitioners and 2) a cost model based on annual loss expectancy. We are focusing on these methods with a perspective that highlights the limits of both empiricism and the theoretical elements that underlie them. From an epistemological point of view we have considered the logical syntax of the two models, the semantics included in statements and the pragmatics of the scientific discourse: the use of models to demonstrate the risk assessment thesis, to solve the problems of risks in the human judgment versus mathematical calculus controversy. The major issues that we are discussing in this article imply various perspectives on scientific criteria, the choice among various theories and the structuring of problems proposed to be solved. We argue that the models that have been developed so far, the top-down approach (which involves well defined and well understood rules), as well as the demonstrations based on the induction method, cannot be applied in a lot of scenarios, because information systems, considered as a complex whole made up of various components, is primarily not a positivistic science solely described by mathematics. The main research question to be answered in this paper is: What are the limits of knowledge in probabilistic computations for information systems security risk assessment? Our purpose is to demonstrate the epistemological limits of the two models and the error of generalizing probability calculus using the interpretive approach.

A Security Risk Analysis Method for Information System Based on Information Entropy

According to the problem of the uncertain information is difficult to quantify in information systems security risk analysis process, proposed an information system security risk analysis method based on information entropy. This method use information entropy to measure the risk of information systems, introduce the information entropy theory, and get the value of the risk of various risk factors with the combination of qualitative analysis and quantitative calculation, to evaluate the risk factors of concern in the system and take appropriate control measures. The paper constructs an informa- tion system security risk analysis model and through the case analysis verified the proposed method can be effectively ap- plied to information system security risk analysis.

Managing security risks for inter-organisational information systems: a multiagent collaborative model

Information sharing across organisations is critical to effectively managing the security risks of inter-organisational information systems. Nevertheless, few previous studies on information systems security have focused on inter-organisational information sharing, and none have studied the sharing of inferred beliefs versus factual observations. In this article, a multiagent collaborative model (MACM) is proposed as a practical solution to assess the risk level of each allied organisation’s information system and support proactive security treatment by sharing beliefs on event probabilities as well as factual observations. In MACM, for each allied organisation’s information system, we design four types of agents: inspection agent, analysis agent, control agent, and communication agent. By sharing soft findings (beliefs) in addition to hard findings (factual observations) among the organisations, each organisation’s analysis agent is capable of dynamically predicting its security risk level using a Bayesian network. A real-world implementation illustrates how our model can be used to manage security risks in distributed information systems and that sharing soft findings leads to lower expected loss from security risks.

Big Data Based on Fuzzy Grey Information System Security Intrusion Detection Research

With the rapid development of computer networktechnology, and also can be used as well as the increasing number of users ofcomputer network, how to effectively guarantee the network information securitybecomes a key technology of computer network. This paper through the literatureinvestigation method to build the information system security risk evaluationindex system, and combining the expert evaluation process could not get all theinformation in the information system security, a method of information systemsecurity risk assessment is put forward. Was carried out on the key technologyof information system based on big data discussion and analysis, and brieflyintroduces its development prospects. Secondly illustrates the necessity ofintrusion detection, and the concept of intrusion detection and the model isgiven. Finally summarizes many kinds of intrusion detection method and thesystem structure, discusses the existing problems of this field and theresearch direction in the future.

A Hierarchical Information System Risk Evaluation Method Based on Asset Dependence Chain

The current information security risk evaluation methods are only concerned with the risk of system components, rarely based on risk perspective. Thus, it is difficult to meet different levels of information security risk comprehension such as the operational staff and the organization's manager. This paper proposes a hierarchical risk evaluation method based on asset dependence chain to quantify the hierarchical risk, the information systems security risks are divided into three levels: the component level, system level and organizational level. By analyzing the assets dependence in three levels, a business systems-information systems-system components assets dependence chain is formed. In the end, a hierarchical risk calculation method is presented. The risk analysis result can reflect the level of security risk evaluation needs more comprehensively and objectively.

A Model of Information Security Awareness for Assessing Information Security Risk for Emerging Technologies

Information systems (IS) that interconnect emerging technologies have rendered organizations increasingly vulnerable to emerging information technology (IT) attacks. Drawing on IS concepts such as systems and cybernetic theory, technological threat avoidance theory (TTAT) and general deterrence theory (GDT), this study develops an IS security (ISS) risk model that contributes to an understanding of information security awareness (ISA) and the assessment of ISS risk. Results indicate that technical knowledge, organizational impact and attacker assessment generate significant positive path coefficients with ISA. However, the constructs organizational impact and attacker assessment generated stronger path coefficients with ISA than technical knowledge. Research model results also indicate that ISA is strongly associated with ISS risk.

A Scenario-Based Information Security Risk Evaluation Method

Risk evaluation is the core process of information security risk management. An effective risk evaluation can protect organizations and maintain their abilities to carry out missions and activities against threats as well as helping to implement controls and safeguards that are actually needed. While the traditional information security risk evaluation approaches are lack of granular analysis and clear expression of security characteristics of risk, such as the possibility, attack path, and business impact. This paper presents the scenario-based information security risk evaluation method, based on the thought of Advanced Persistent Threat (APT) attack, by constructing risk scenario, evaluate information system security risk status. The separation analysis of the technical impact and business impact contribute to the technicians and business decision makers to grasp system risk status from their respective responsibilities. In the end of the paper, we propose a practical risk scenario construction example, which provides scientific and effective guidance for the preparation of a risk evaluation report.

A Cooperative Model for IS Security Risk Management in Distributed Environment

Given the increasing cooperation between organizations, the flexible exchange of security information across the allied organizations is critical to effectively manage information systems (IS) security in a distributed environment. In this paper, we develop a cooperative model for IS security risk management in a distributed environment. In the proposed model, the exchange of security information among the interconnected IS under distributed environment is supported by Bayesian networks (BNs). In addition, for an organization's IS, a BN is utilized to represent its security environment and dynamically predict its security risk level, by which the security manager can select an optimal action to safeguard the firm's information resources. The actual case studied illustrates the cooperative model presented in this paper and how it can be exploited to manage the distributed IS security risk effectively.

Classification of Security Threats in Information Systems

Information systems are frequently exposed to various types of threats which can cause different types of damages that might lead to significant financial losses. Information security damages can range from small losses to entire information system destruction. The effects of various threats vary considerably: some affect the confidentiality or integrity of data while others affect the availability of a system. Currently, organizations are struggling to understand what the threats to their information assets are and how to obtain the necessary means to combat them which continues to pose a challenge. To improve our understanding of security threats, we propose a security threat classification model which allows us to study the threats class impact instead of a threat impact as a threat varies over time. This paper addresses different criteria of information system security risks classification and gives a review of most threats classification models. We define a hybrid model for information system security threat classification in order to propose a classification architecture that supports all threat classification principles and helps organizations implement their information security strategies.

A Method for Information Security Risk Aassessment Based on Fuzzy Operator

To address the security risks of information systems to make accurate quantitative assessment of problems in the OWA operator and based on gray theory DHGF algorithm is proposed based on combining advantages of both information security risk assessment methodology. Information security risk assessment based on an a priori sample value index depth of excavation, the use of the basic methods of OWA operator, objective indicators derived property rights, and the use of gray theory for assessing the value of integration. This approach will be applied to information security risk assessment, to ensure the objectivity of the evaluation results, while reducing dependence on the assessed value of integrity, to solve the traditional information security risk assessment methodology for index data have special requirements, it is difficult strictly objective and quantitative problems. Assessment examples show the effectiveness of the method and objectivity.