Security Risk Assessment Method Research Articles

Vulnerability-oriented risk identification framework for IoT risk assessment

The proliferation of Internet of Things (IoT) systems across diverse applications has led to a notable increase in connected smart devices. Nevertheless, this surge in connectivity has induced a broad spectrum of vulnerabilities and threats, jeopardizing the security and safety of IoT applications. Security risk assessment methods are commonly employed to analyze risks. However, traditional IT and existing IoT-tailored security assessment methods often fail to fully address key IoT aspects: complex assets intercommunication, dynamic system changes, assets’ potential as attack platforms, safety impacts of security breaches, and assets resource constraints. Such oversights lead to significant risks being overlooked in the IoT ecosystem. In this paper, we propose a novel vulnerability-oriented risk identification framework comprising a four-step process as a core element of IoT security risk assessment, applicable to any IoT system. Our process enhances both traditional and IoT-specific security risk assessment methods by providing tailored approaches that address their crucial oversights for comprehensive IoT risk assessment. We validate our process with a case study of an IoT smart healthcare system using a proposed expert-driven approach. The results confirm that our process effectively identifies critical attack scenarios originating from the lack of proper security measures, mobility, and intercommunication processes of IoT devices in the healthcare system. Furthermore, our analysis reveals potential attacks that exploit the IoT devices as platforms to target the backend and user domains. We demonstrate the feasibility of our process for identifying realistic risks by conducting simulations of two derived attack scenarios using the Contiki Cooja network simulator.

Cyber Security Risk Assessment Methods for Smart Healthcare

The perverseness of the Internet of Things (IoT) has reached the healthcare sector, where interconnected medical devices are transforming how we deliver and manage health. These devices, linked wirelessly, create a vast network known as Internet of Medical Things (IoMT), that integrates seamlessly with the broader healthcare system. This interconnected infrastructure facilitates the exchange of massive amounts of patient data, paving the way for a more distributed and data-driven approach to healthcare. In healthcare’s ICT environment rely heavily on electronic health records (EHR), e-prescribing systems and other systems. Protecting this sensitive data necessitates robust cybersecurity measures. Even though data security is an indirect cost, it is crucial for healthcare systems. In general, patient trust in a healthcare system depends on the infrastructure’s ability to protect data from security and privacy threats. A critical component of this strategy is security risk assessment. A risk is an indirect cost borne by those designing these systems. The risk assessment process identifies, evaluates, and prioritizes potential threats to the organization’s assets including hardware and software. By assessing risks before acting, healthcare organizations can effectively allocate resources to mitigate the most critical vulnerabilities. While broadly applicable cyber risk assessment frameworks like NIST, ISO, and OCTAVE exist, they may lack a strong risk between assets, threats and impacts, and controls. Therefore, they do not provide a comprehensive picture for healthcare specifically. A more thorough examination is required to establish a strong association between protected systems, potential threats, and the resulting risks. This paper critically reviews these frameworks and their methodologies and limitations for healthcare cybersecurity. Even though data security is an indirect cost, it is crucial for healthcare systems.

Graph-based two-level indicator system construction method for smart city information security risk assessment

<p>The rapid development of urban informatization has led to a deep integration of advanced information technology into urban life. Many decision-makers are starting to alleviate the adverse effects of this informatization process through risk assessment. However, existing methods cannot effectively analyze internal and hierarchical relationships because of the excessive number of indicators. Thus, it is necessary to construct an indicator's dependency graph and conduct a comprehensive hierarchical analysis to solve this problem. In this study, we proposed a graph-based two-level indicator system construction method. First, a random forest was used to extract the indicators' dependency graph from missing data. Then, spectral clustering was used to separate the graph and form a functional subgraph. Finally, PageRank was used to calculate the prioritization for each subgraph's indicator, and the two-level indicator system was established. To verify the performance, we took China's 25 smart cities as examples. For the simulation of risk level prediction, we compared our method with some machine learning algorithms, such as ridge regression, Lasso regression, support vector regression, decision trees, and multi-layer perceptron. Results showed that the two-level indicator system is superior to the general indicator system for risk assessment.</p>

Digital media system design and visual art analysis based on information security

BackgroundWith the growing maturity of Internet technology and 5G transmission technology, digital media systems begin to present more complex scenario applications. Software design security issues are also increasingly evident in digital media systems. This paper analyzes the security issues of digital media system design from the perspective of software protection security. Discussed based on the information security digital media system design and visual art analysis. MethodsThis paper discusses based on the software security protection design and visual art analysis, first proposed the media convergence and information security risk assessment research, including media convergence cognition, information security risk management theory, system information security risk assessment methods and based on the media under the digital certificate. Secondly, the information security algorithm based on digital media technology is studied. From the basic knowledge of digital image, a method of image encryption based on the change of pixel value, the common algorithm of digital image watermarking technology and the encryption technology of digital media are summarized. ResultsExperiments were carried out on three art painting data sets, including Painting91, Oil Painting and Pandora. Compared with the existing label distribution learning methods on the Painting91style dataset, the algorithms SA-IIS and SA-BFGS achieve the classification accuracy of 65.51 % and 66.52 %, respectively. The classification result of the baseline method of VGGNet is 63.89 % on the OilPainting dataset. On the Pandora-style dataset, the classification accuracy of MSCNN1 method is 71.32 %, and the experimental results of CNNF4 method reach 71.76 %. ConclusionThe method proposed in this paper has good application results in different data sets, and the digital media art design system has high reliability and fault tolerance. From the perspective of information security, different index systems have higher security levels.

SEAG: A novel dynamic security risk assessment method for industrial control systems with consideration of social engineering

The development of information and communication technology and its wide application in industrial control systems (ICSs) has brought a growing number of security risks to ICSs. Quantifying and dynamically assessing the security risks of ICSs is of great significance to protect ICSs from cyber attacks. Current risk assessment methods, however, do not take into account social engineering (SE) attacks and the potential cyber-to-physical risks associated with cyber attacks. To address these issues, we propose a novel method for the dynamic security risk assessment of ICSs, called SEAG. Specifically, the scheme first extends and modifies three metrics in the common vulnerability scoring system to four metrics for objectively calculating the exploit probability of SE. Then, we construct the attack graph by relying on the knowledge graph that integrates three kinds of knowledge including SE knowledge, common vulnerability knowledge, and control system knowledge. In addition, we combine real time attack data that causes system performance loss with the industrial protocol function code attack detected by the intrusion detection system to accurately quantify the potential cyber-to-physical risks associated with cyber attacks. This method allows us to dynamically assess the security risks of ICSs in real time. Finally, the method is verified by one simulation testbed, which shows the effectiveness and accuracy of the proposed method for dynamic quantitative evaluating security risks of ICSs.

Design of network information visualization security cognition system based on QSOFM network and FR algorithm

ABSTRACT Network information is complex, there is no lack of hidden risks of information to the user caused by bad effects. But analyzing and evaluating them is complex and requires more diverse and powerful techniques. This research will combine Fruchterman-Reingold (FR) information visualization algorithm and information security risk assessment method based on Quantum self-organizing feature map (QSOFM) network to build information visualization security cognitive system. By introducing quantum neurons into self-organizing feature mapping network (SOFM), a network information security evaluation model is constructed. The system can evaluate the security level of network information and visualize the evaluation results. The experimental results show that the system has fast response speed and strong interactivity. The accuracy of QSOFM algorithm is 86%, 12% higher than the traditional algorithm, which can provide more powerful technical support for the visual security cognition of network information.

A Case Study of Introducing Security Risk Assessment in Requirements Engineering in a Large Organization

Software products are increasingly used in critical infrastructures, and verifying the security of these products has become a necessary part of every software development project. Effective and practical methods and processes are needed by software vendors and infrastructure operators to meet the existing extensive demand for security. This article describes a lightweight security risk assessment method that flags security issues as early as possible in the software project, namely during requirements analysis. The method requires minimal training effort, adds low overhead, and makes it possible to show immediate results to affected stakeholders. We present a longitudinal case study of how a large enterprise developing complex telecom products adopted this method all the way from pilot studies to full-scale regular use. Lessons learned from the case study provide knowledge about the impact that upskilling and training of requirements engineers have on reducing the risk of malfunctions or security vulnerabilities in situations where it is not possible to have security experts go through all requirements. The case study highlights the challenges of process changes in large organizations as well as the pros and cons of having centralized, distributed, or semi-distributed workforce for security assurance in requirements engineering.

New security risk assessment and genetic algorithms-based methods to optimize risk reduction countermeasures for cultural heritage siteS

Welcome to the WIT Press eLibrary - the home of the Transactions of the Wessex Institute collection, providing on-line access to papers presented at the Institute's prestigious international conferences and from its State-of-the-Art in Science & Engineering publications.

Analysis of computer network security risk assessment methods

.

A Security Risk Assessment Method Based on Improved FTA-IAHP for Train Position System

The positioning system based on satellite navigation can meet the requirements of CTCS-4 train control, improve the transportation efficiency, reduce the operation and maintenance costs, which is the trend of train positioning system in the future, and the security risk assessment is of great significance to the future application of this system. In this paper, combined with the self-developed train positioning system based on satellite navigation, and an improved fault tree-interval analytic hierarchy process (FTA-IAHP) method for evaluating the safety risk of train positioning system is proposed. Firstly, a security risk assessment model based on FTA-IAHP is established by combining FTA and IAHP. Secondly, two judgment matrices are constructed by using the basic events and structural importance based on FTA, and the IAHP model based on expert scoring, the difference between FTA and IAHP is adjusted by combining the weighting factor. The new method of trial of weighting can determine the degree of each factor in the system fault. This method has great significance to the safety design and protection of the new train positioning system based on satellite navigation.

Security risk assessment and visualization study of key nodes of sea lanes: case studies on the Tsugaru Strait and the Makassar Strait.

Key nodes of sea lanes are important hubs for global trade and cargo transportation and play important roles in ensuring the safety of maritime transportation and maintaining the stability of the global supply chain. The safety guarantee of key nodes of sea lanes is facing more risks and higher requirements currently because the global shipping industry is gradually recovering. This paper focuses on key nodes of sea lanes, conducting regional security risk assessment and risk spatial scale visualization. A set of security risk assessment and visualization study methods for key nodes of sea lanes is constructed, which includes constructing a security risk assessment index system of key nodes of sea lanes with 25 indicators selected from three risk categories (hazard, vulnerability and exposure, and mitigation capacity) and using geospatial analysis to form the multi-criteria spatial mapping layers and then creating comprehensive risk layers to realize the risk visualization in the strait area by weighted overlaying based on the combined weights calculated by Analytic Hierarchy Process and Grey Relational Analysis. After taking the Tsugaru Strait and Makassar Strait as case studies, the results show that the comprehensive risk layers can effectively present the spatial distribution of security risks of key nodes of sea lanes, reflecting the spatial changes of risk levels (i.e., very low, low, medium, high and very high) and the methods can precisely identify and analyze crucial factors affecting the security risk of key nodes. These findings may strengthen the risk prevention and improve the safety of the navigation environment in the strait to ensure the safety and stability of maritime trade.

A Rice Security Risk Assessment Method Based on the Fusion of Multiple Machine Learning Models

With the accelerated digital transformation, food security data is exponentially growing, making it difficult to process and analyze data as the primary challenge for food security risk regulation. The promotion of “big data + food” safety supervision can effectively reduce supervision costs and improve the efficiency of risk detection and response. In order to improve the utilization of testing data and achieve rapid risk assessment, this paper proposes a rice security risk assessment method based on the fusion of multiple machine learning models, and conducts experimental validation based on rice hazard detection data from 31 provinces in China excluding Hong Kong, Macao and Taiwan in 2018. The model comparison verifies that the risk assessment model shows better performance than other mainstream machine learning algorithms, and its evaluation accuracy is as high as 99.54%, which verifies that the model proposed in this paper is more stable and accurate, and can provide accurate and efficient decision-making basis for regulatory authorities.

Security Risk Assessment and Prevention Methods of E-Banking, (A Case Study of Senegal)

The new information technologies have become an important factor in the financial services sector and with the advent of electronic technologies, electronic banking has become an important element in almost every business. The banking sector is one of the most significant developments in this area. The e-banking has become popular because of its convenience and flexibility, and also transaction related benefits like speed, efficiency, accessibility, etc. In recent years many Senegalese banks have started to offer internet banking services to their customers. Electronic banking systems provide them with easy access to banking services. However, the electronic banking systems have associated information security threats and risks. Electronic banking, security threats and risks that impact both the banks and the banking customers. The purpose of our research is to study the potential risks of e-banking in Senegal, evaluate the risks, and then put forward prevention plans. Based on detailed literature review, a research model was developed. A qualitative research approach was used to get better understanding of these issues. The empirical data were collected from the residents of Senegal by using questionnaires. Data analyses were done in accordance with the research questions and research model. Finally, the results from respondent data and conclusion were drawn by answering the research questions. Keywords: Electronic Banking, Security, Risks, Senegal, safety. DOI: 10.7176/JIEA/12-1-01 Publication date: March 31 st 2022

A fuzzy DRBFNN-based information security risk assessment method in improving the efficiency of urban development.

The rapid development of urban informatization is an important way for cities to achieve a higher pattern, but the accompanying information security problem become a major challenge restricting the efficiency of urban development. Therefore, effective identification and assessment of information security risks has become a key factor to improve the efficiency of urban development. In this paper, an information security risk assessment method based on fuzzy theory and neural network technology is proposed to help identify and solve the information security problem in the development of urban informatization. Combined with the theory of information ecology, this method establishes an improved fuzzy neural network model from four aspects by using fuzzy theory, neural network model and DEMATEL method, and then constructs the information security risk assessment system of smart city. According to this method, this paper analyzed 25 smart cities in China, and provided suggestions and guidance for information security control in the process of urban informatization construction.

Research on Information Security Risk Analysis and Prevention Technology of Network Communication Based on Cloud Computing Algorithm

Data communication network must use telephone, cable or optical fiber as transmission medium and computer as information receiving, output and communication tool. Customers can not only process the received information, but also realize information sharing through the network. With the wide application of network communication in daily life, network security issues have higher requirements. In order to solve the problems of subjectivity, long modeling time and low classification accuracy of information security risk assessment methods, this paper first proposes an intelligent information security risk assessment method based on decision tree. Compared with other classification algorithms such as support vector machine, the decision tree classification algorithm has no requirement for data category distribution, and has good classification effect and fast speed. Finally, this paper introduces the security measures in network data communication for reference only.

Cyber security risk assessment method for SCADA system

ABSTRACT Nowadays SCADA is very important for controlling large systems like pipeline, industrial manufacture, power plant as well as in the communication system. For controlling a large system by making human machine interface (HMI) its needs to connect over a network like WAN or internet. So the SCADA system involves an issue called cyber security. Cyber security risk assessment for digital instrumentation and control system has become more crucial in the development of a new system and operation of the existing system. The cyber attack on the SCADA system could compromise the system as well as damage the components and impact the financial on the process or invoke an unwanted command. In this paper, we propose a risk assessment method which includes system analysis, attack modeling and analysis, penetrate the system. This will show the impact on the system. At long last countermeasures are distinguished for the development of digital security.

An analysis of methods for assessing information security risks of financial institutions

The paper presents an analysis of the existing methods for assessing information security risks, their features, advantages and disadvantages, as well as determines the possibility of using such techniques for assessing information security risks in financial institutions. Criteria for comparing information security risk assessment methods have been formed, the advantages and disadvantages of the methods are described. It is shown that, despite the requirements of regulators for assessing information security risks, most of the regulatory documents deal with operational risks. The evaluation of information security risks of credit and financial institutions does not have sufficient regulation and formalization.The authors substantiate the necessity of developing a method for assessing information security risks for credit and financial organizations, taking into account the features of risk assessment inherent to the mentioned organizations. The paper considers the need to create lists of existing threats to the credit and financial sector and their linking to existing vulnerabilities to optimize the process of assessing information security risks. The development of a methodology for assessing information security risks will increase the degree of compliance of credit and financial institutions with the requirements of international, state and industry standards through an optimal set of protection measures and models for evaluating information security risks.

Research on Multi-Target Network Security Assessment with Attack Graph Expert System Model

With the rapid development of the Internet, network attacks often occur, and network security is widely concerned. Searching for practical security risk assessment methods is a research hotspot in the field of network security. Network attack graph model is an active detection technology for the attack path. From the perspective of the attacker, it simulated the whole network attack scenario and then presented the dependency among the vulnerabilities in the target network in the way of directed graph. It is an effective tool for analyzing network vulnerability. This paper describes in detail the common methods and tools of network security assessment and analyzes the construction of theoretical model of attack graph, the optimization technology of attack graph, and the research status of qualitative and quantitative analysis technology of attack graph in network security assessment. The attack graph generated in the face of large-scale network is too complex to find the key vulnerability nodes accurately and quickly. Optimizing the attack graph and solving the key attack set can help the security manager better understand the security state of the nodes in the network system, so as to strengthen the security defense ability and guarantee the security of the network system. For all kinds of loop phenomena of directed attribute attack graph, the general method of eliminating loop is given to get an acyclic attack graph. On the basis of acyclic attack graph, an optimization algorithm based on path complexity is proposed, which takes atomic attack distance and atomic weight into consideration, and on the basis of simplified attack graph, minimum-cost security reinforcement is carried out for the network environment. Based on the ant colony algorithm, the adaptive updating principle of changing pheromone and the local searching strategy of the adaptive genetic algorithm are proposed to improve the ant colony algorithm. The experimental results show that compared with the ant colony algorithm, the improved ant colony algorithm can speed up the process of solving the optimal solution. When the number of attack paths is large, the advantages of the improved ant colony algorithm in solving accuracy and late search speed are more obvious, and it is more suitable for large-scale networks.

Novel security models, metrics and security assessment for maritime vessel networks

In the past few years, maritime vessels have become computerized and connected to the internet. However, with this technology, critical systems based on-board ships that manage the vessel’s navigation system, radar, cargo management system, etc have become more prone to cyber-attacks. Moreover, attackers are now becoming aware of the vulnerabilities associated with such maritime vessel systems. As a result, it is of vital importance to manage and secure the maritime vessel networks against cyber-attacks, but there is a lack of capabilities to efficiently manage the identifications of vulnerabilities, security risk assessment, and evaluate the effectiveness of countermeasures. Hence, we propose a novel framework and security risk modeling and assessment method to evaluate the security of maritime vessel networks. We develop (1) a security model for maritime vessels to capture probabilistic events, vulnerabilities, and network configurations of vessel components; (2) propose an approach to assess the network with a single function, multiple functions, and the inter-dependencies between the functions as attack goal(s); (3) adopt three well-defined security metrics with the proposed model to evaluate possible attacks and/or threats; and (4) compare the effectiveness of cyber-defense strategies based on different attack scenarios on the maritime vessel network. Besides, we perform sensitivity analysis based on temporal and permanent connections that are associated with the vessels’ systems to understand the effect of the connections on security. Our results demonstrate the applicability and usability of the proposed model for finding potential attack paths, assessing security, and mitigating the impact of cyber-attacks and threats on a vessel network.

Research on Network Security Risk Assessment Method Based on Improved AHP

Aiming at the problem that the data cannot pass the consistency test in the analytic hierarchy process (AHP), an improved AHP is proposed. The implementation scheme of the improved AHP based on D-S evidence theory and gray theory is designed, and matlab is used for simulation experiment. The results show that the improved method can effectively enhance the reliability of network security risk assessment results.