Security Risk Management Model Research Articles

Developing a security risk management model for commercial private game reserves in the Limpopo Province of South Africa

ABSTRACT This article explores the potential contribution that security risk assessments and a security programme on commercial private game reserves in the Limpopo Province of South Africa can make to ensure the safety and security, not only of their visitors, but also of the wildlife and natural assets of a game reserve. Not all commercial private game reserves can afford an extensive security programme and the person in charge may not be a security and/or a risk management expert, therefore the need arises for the development of a fundamental and straightforward security programme.

Organisational characteristics as antecedents of enterprise security risk management adoption in Kenya’s accredited universities

ABSTRACT Academic institutions today are experiencing a legion of security risks that are increasingly impeding their mission of producing high-quality graduates, guarding reason and educational integrity, and ultimately advancing human civilisation. The Enterprise Security Risk Management (ESRM) model represents a potential solution to the dynamic threats that accredited universities face today. However, ESRM adoption is largely absent, slow, and inconsistent in Kenya’s accredited universities. Only a few attempts have been made to understand what drives security risk management adoption in these universities. Based on seven in-depth interviews with Chief Security Officers across larger accredited universities in Kenya and utilising an overarching innovation adoption model, we examine the organisational predictors of ESRM adoption in these universities. Within the limitations of this study, the data collected highlight the fundamental role of university executive commitment, security governance, and security risk management training in enhancing the diffusion of ESRM systems in universities. We have discussed managerial implications and suggested future research directions.

Safety Of Public Hospitals In South Africa

Public hospitals are regularly confronted by safety and security breaches that expose employees, patients, and visitors to serious and violent crimes such as assault, rape, murder and theft. Furthermore, assets such as computer equipment, medical files, medical equipment, and medicines are frequently stolen from state hospitals. This paper is aimed at is aimed at identifying security gaps and shortcomings in the provision of security services so that recommendations can be formulated to address the assessed risks and other threats. Furthermore, the paper described the effectiveness of safety and security measures that are currently employed in public hospitals. A qualitative study was conducted at five public hospitals in the province of Gauteng. Data was collected through one-on-one in-depth interviews with 30 key participants who were selected through purposive sampling. Additionally, safety and security documents were analysed, followed by observation of security personnel in the control rooms. The research confirmed that inadequate security systems regarding perimeter fences, closed‑circuit television and trained security personnel at the research sites made it difficult to deter, detect and detain perpetrators. Furthermore, the use of a Security Risk Management Model developed specifically for public hospitals during this research is recommended.

Information Security Risk Management Model for Big Data

In the current society of rapid expansion of information, big data have achieved vigorous development in all walks of life, considerably promoting data transmission and information sharing. Meanwhile, individuals are becoming increasingly reliant on big data and the Internet, but at the same time, the threat of information security posed by big data is becoming increasingly visible. As a result, how to protect the information security of big data has piqued the interest of both government and businesses. The essence of information security management is risk management, which is closely related to each other. Therefore, this study focuses on the following two aspects of research work. On the one hand, most existing risk management models merely describe risk management in the abstract from a macro-level, and they lack research on risk assessment, making them ineffective. This research builds a novel information security risk management model on the basis of existing risk management models based on the concept of multidimensional risk management. To achieve multidimensional dynamic management of big data risks and to keep them within an acceptable range as much as possible, the model is divided into five levels and two dimensions. On the other hand, this research also optimizes and improves the fuzzy mathematical analysis method and proposes a fuzzy comprehensive assessment method as the core algorithm for the risk assessment layer in the model. As a post-event risk assessment method, the advantage of this method is that it can comprehensively consider factors affecting risk and can quantify some assessment factors in the real network to achieve an effective combination of qualitative and quantitative, thereby providing a basis for decision-making in risk analysis and risk control. Finally, the effectiveness of the risk model in the real application is verified by example analysis, and it is intended that the study work would provide assistance and assurance for big data information security management.

Performance Verification of Bayesian Network–Based Security Risk Management and Control System for Power Trading Institutions

Risk in power trading is unavoidable for various reasons. The impact of this risk would vary based on the trading characteristics that mainly depend on the market design and power purchase agreements. So, a security risk management and control system for power trading institutions based on a Bayesian network is designed to reduce the risk of power trading projects. As a part of the network, we first provided the overall architecture of the risk management and control system, which includes a malicious network behaviour detection module, controller selection module, data transmission module, and management and control result visualisation module. Second, the hardware test design was implemented by analysing each module’s working principle and function. Based on the hardware design of the system, the regression analysis method is used to evaluate the risk of power transactions, followed by market fluctuation prediction to obtain the prediction result induced risks. The relationship between security risks and risk-influencing factors is analysed using the Bayesian network. The initial list of risks is established, the uncertain risk factors are reasoned, and the security risk management and control model of power trading institutions is tested to achieve the goal of risk management and control. The experimental results show that this method’s risk management and control efficiency are high. At the same time, this method effectively realised comprehensive risk identification by reducing the loss to power enterprises and has near-practical application value.

Digital Innovation Risk Management Model of Discrete Manufacturing Enterprise Based on Big Data Analysis

At present, most risk management work mainly relies on manpower, and manpower relies on the professional knowledge of relevant skilled workers to discover hidden safety risks in production activities. This article combines relevant big data theories and 4V characteristics to analyze and investigate safety production and big data, study data structure, data source and data type. Using 5W1H scientific big data and applications, this analysis method analyzes the theoretical basis, applications and beneficiaries of big data related to safety production, some of which are application links and important theoretical issues. Secondly, it studies the security risk management model based on big data, proposes a risk management model based on big data, the technical basis of big data and the idea of a three-dimensional model, and applies the systematic space method, which is reflected in three aspects of risk management. In the end, a risk identification model based on big data, a risk assessment classification model, and a risk early warning and pre-control model are defined.

IoT in Banking: The trends, threats, and solution

The Internet of Things is the next step of the digital revolution that will change consumers' lives. The Internet of Things promises to be a worthy representative of an open course in technology, economics, and culture. IoT, without a doubt, has a promising future. The modern consumer actions and uses represent inescapable digital transformations for banking institutions. Emerging digital world developments guide all banking services' digital transformation. However, the security threats of using IoT in banking are increasing. Cybercriminals such as hacking, corruption, and financial violence, data breaches, and financial expenditure risks will continue to trouble the use of IoT in banking. Therefore, this research aims to study the banking industry's existing IoT uses, issues, and challenges in adopting the IoT in the banking industry. IoT threats are highlighted in this paper. This article sets out a model dimension of the process monitoring framework for IoT security risk management. Other than that, this paper also studies the existing security risk management model of IoT in banking. Moreover, preventive IoT protection initiatives and approaches to enhance IoT protection by implementing blockchain technology and Control Model Information Structure are addressed in this article

Strategic Dimensions of Information Security Risk Management

Information security is thus a big threat to the survival of enterprises. In all context and forms, it is an imperative to provide adequate safeguards and measures to management the risk arising from flow of information and data. The business models of organizations are highly dependent on flow of information during the business processes. The management of information security has several perspectives. In this paper, the legal, quality and human resource perspectives have been discussed. The Information Security Risk Management Model must balance these perspectives to optimize for best value derived out of it.

IoT Security Risk Management Model for Secured Practice in Healthcare Environment

The emerging of Internet of Things (IoT) technologies for unified and interconnected medical devices and sensors has changed the scenario in the healthcare industry. However, with the ‘openness’ of the distributed environment and medical devices, IoT will be the point of a breach where attackers are able to identify vulnerabilities and subsequently launch their attacks. This becomes high risk to the healthcare environment which may cause a big impact on its security measure. Nonetheless, the benefits of IoT solution in healthcare are undeniable. To address this issue, this study proposes an IoT Security Risk Management Model for Secured Practice in Healthcare Environment. This study reviewed all IoT risks from related works and has selected one Malaysian government hospital as a case study. From the findings, a model was formulated which consist of three parts, the Healthcare IoT Risk Management, the Hospital Performance Indicator for Accountability (HPIA) and the implementation phases. As a result, a priori model was successfully developed and yet to be validated by the case study participants in the next stage.

An integrated conceptual model for information system security risk management supported by enterprise architecture management

Risk management is today a major steering tool for any organisation wanting to deal with information system (IS) security. However, IS security risk management (ISSRM) remains a difficult process to establish and maintain, mainly in a context of multi-regulations with complex and inter-connected IS. We claim that a connection with enterprise architecture management (EAM) contributes to deal with these issues. A first step towards a better integration of both domains is to define an integrated EAM-ISSRM conceptual model. This paper is about the elaboration and validation of this model. To do so, we improve an existing ISSRM domain model, i.e. a conceptual model depicting the domain of ISSRM, with the concepts of EAM. The validation of the EAM-ISSRM integrated model is then performed with the help of a validation group assessing the utility and usability of the model.

A review of game theory approach to cyber security risk management

Cyber security is among the most complex and rapidly evolving issues and has been the focus of present day organizations. Cyber security risk management is the process of managing or reducing potentially harmful and uncertain events that posse as threats to cyber security. It involves looking at what could go wrong on the cyber space and deciding on ways to prevent or minimize their occurrences or effects. One of the prominent cyber security risk management techniques is the Game Theoretic Approach (GTA), which focuses on the use of resources, internal controls, information sharing, technical improvements, behavioral or organizational scale-ups and cyber insurance for cyber risk management. This paper presents a review of game theoretic-based model for cyber security risk management. Specifically, issues on modeling, some related works and significance of game theoretic approach to cyber security risk management are presented. Findings from the review revealed the peculiarities and specificity of each model. It is also revealed that the models are just evolving and require much improvement. Keywords: Cyber Security, Risk Management, Game Theory, Model

Towards a Business-Driven Process Model for Knowledge Security Risk Management

The purpose of this paper is to introduce a model to manage knowledge security risks in organizations. Knowledge security risk management is a sensemaking process that should be carried out by managers, and the proposed model works as a tool for the sensemaking process. The model is illustrated with an analytical case example. The process model helps to identify knowledge security risks and provides a comprehensive approach to evaluating and balancing the costs and benefits of knowledge sharing and knowledge risk management. The paper addresses calls for research on the emerging topic of knowledge security and the important topic of new knowledge sharing tools from the combined perspectives of business benefits and risk management. The results presented in this paper are preliminary and conceptual, and further research on the topic is suggested. The process model proposed in this paper can be a valuable tool for practitioners aiming to develop knowledge sharing practices in companies, and at the same time need to consider the security of knowledge.

A situation awareness model for information security risk management

Information security risk management (ISRM) is the primary means by which organizations preserve the confidentiality, integrity and availability of information resources. A review of ISRM literature identified deficiencies in the practice of information security risk assessment that inevitably lead to poor decision-making and inadequate or inappropriate security strategies. In this conceptual paper, we propose a situation aware ISRM (SA-ISRM) process model to complement the information security risk management process. Our argument is that the model addresses the aforementioned deficiencies through an enterprise-wide collection, analysis and reporting of risk-related information. The SA-ISRM model is adapted from Endsley's situation awareness model and has been refined using our findings from a case study of the US national security intelligence enterprise.

A Cooperative Model for IS Security Risk Management in Distributed Environment

Given the increasing cooperation between organizations, the flexible exchange of security information across the allied organizations is critical to effectively manage information systems (IS) security in a distributed environment. In this paper, we develop a cooperative model for IS security risk management in a distributed environment. In the proposed model, the exchange of security information among the interconnected IS under distributed environment is supported by Bayesian networks (BNs). In addition, for an organization's IS, a BN is utilized to represent its security environment and dynamically predict its security risk level, by which the security manager can select an optimal action to safeguard the firm's information resources. The actual case studied illustrates the cooperative model presented in this paper and how it can be exploited to manage the distributed IS security risk effectively.

An Extension of Business Process Model and Notation for Security Risk Management

Business process modelling is one of the major aspects in the modern information system development. Recently business process model and notation (BPMN) has become a standard technique to support this activity. Typically the BPMN notations are used to understand enterprise's business processes. However, limited work exists regarding how security concerns are addressed during the management of the business processes. This is a problem, since both business processes and security should be understood in parallel to support a development of the secure information systems. In the previous work we have analysed BPMN with respect to the domain model of the IS security risk management (ISSRM) and showed how the language constructs could be aligned to the concepts of the ISSRM domain model. In this paper the authors propose the BPMN extensions for security risk management based on the BPMN alignment to the ISSRM concepts. We illustrate how the extended BPMN could express assets, risks and risk treatment on few running examples related to the Internet store regarding the asset confidentiality, integrity and availability. Our proposal would allow system analysts to understand how to develop security requirements to secure important assets defined through business processes. The paper opens the possibility for business and security model interoperability and the model transformation between several modelling approaches (if these both are aligned to the ISSRM domain model).

A Data-driven Assessment Model for Information Systems Security Risk Management

In this paper, a data-driven assessment model for information systems security risk management is proposed based on the knowledge from observed cases and domain experts. In the model, genetic algorithm is applied to search the rules of security risk identification based on historical data. For identifying the causal relationships of risk factors and predict the occurrence probability of security risk, a Bayesian network (BN) is developed. Structure learning and parameter learning are utilized to integrate the database of observed cases with domain expert experience in the development of the BN. The significance of the work is that the model provides more objective and visible support for security risk assessment in the information systems.

Professional Security Management and Investigation for the New Competitive Advantage

This paper is mainly associated with setting out an agenda for the transformation of security by creating a new framework for a security system, which can maximise its effectiveness. Noticeably, this research shows empirically that crimes are getting a major cost to organisations, which if reduced by security and investigations could reap substantial rewards to the finances of an organisation. However, the problem is that the delivery of security is frequently delegated to personnel (e.g. security guards) with limited training, inadequate education, and no real commitment to professionalism - 'sub-prime' security, finally causing security failures. Therefore, if security can be enhanced to reduce the crime cost, this will produce financial benefits to business, and consequently could produce a competitive advantage. For this, the paper basically draws upon Luke's theoretical framework for deconstructing 'power' into three dimensions. Using this three-dimensional approach, the paper further sets out a model of how security can be enhanced, utilising a new Security Risk Management (SRM) model, and how can this SRM model create competitive advantage in business. Finally, this paper ends with the six strategies needed to enhance the quality of security: refiguring as SRM, Professional Staff, Accurate Measurement, Prevention, Cultural Change, and Metrics.

Fuzzy OWA model for information security risk management

One of the methods for information security risk assessment is the substantiated choice and realization of countermeasures against threats. A situational fuzzy OWA model of a multicriteria decision making problem concerning the choice of countermeasures for reducing information security risks is proposed. The proposed model makes it possible to modify the associated weights of criteria based on the information entropy with respect to the aggregation situation. The advantage of the model is the continuous improvement of the weights of the criteria and the aggregation of experts’ opinions depending on the parameter characterizing the aggregation situation.

Contextualizing human security: A ‘deprivation–vulnerability’ approach

Devising a more precise operational definition of human security has been elusive, hampering efforts to create an effective global framework. This article develops a framework for operationalizing a development-oriented approach to human security that establishes clear research and policy priorities. The analysis stakes out a middle ground between expansive and narrower human security approaches revealing they are not as polarized as sometimes portrayed, and argues that human security and human development are distinct but complementary; whereas the former is a relative condition and the latter is a longer-term process. The paper proposes a deprivation–vulnerability approach to human security, based on the analysis of threats and vulnerabilities conditioned by deprivations and exclusions, and takes initial steps at developing a human security risk management model that initially prioritizes populations more vulnerable to harm.