Security Risk Analysis Process Research Articles

Method for Attack Tree Data Transformation and Import Into IT Risk Analysis Expert Systems

Information technology (IT) security risk analysis preventatively helps organizations in identifying their vulnerable systems or internal controls. Some researchers propose expert systems (ES) as the solution for risk analysis automation since risk analysis by human experts is expensive and timely. By design, ES need a knowledge base, which must be up to date and of high quality. Manual creation of databases is also expensive and cannot ensure stable information renewal. These facts make the knowledge base automation process very important. This paper proposes a novel method of converting attack trees to a format usable by expert systems for utilizing the existing attack tree repositories in facilitating information and IT security risk analysis. The method performs attack tree translation into the Java Expert System Shell (JESS) format, by consistently applying ATTop, a software bridging tool that enables automated analysis of attack trees using a model-driven engineering approach, translating attack trees into the eXtensible Markup Language (XML) format, and using the newly developed ATES (attack trees to expert system) program, performing further XML conversion into JESS compatible format. The detailed method description, along with samples of attack tree conversion and results of conversion experiments on a significant number of attack trees, are presented and discussed. The results demonstrate the high method reliability rate and viability of attack trees as a source for the knowledge bases of expert systems used in the IT security risk analysis process.

A Security Risk Analysis Method for Information System Based on Information Entropy

According to the problem of the uncertain information is difficult to quantify in information systems security risk analysis process, proposed an information system security risk analysis method based on information entropy. This method use information entropy to measure the risk of information systems, introduce the information entropy theory, and get the value of the risk of various risk factors with the combination of qualitative analysis and quantitative calculation, to evaluate the risk factors of concern in the system and take appropriate control measures. The paper constructs an informa- tion system security risk analysis model and through the case analysis verified the proposed method can be effectively ap- plied to information system security risk analysis.

RFID 시스템에서의 태그 보안을 위한 경량화 프로토콜의 분석

RFID 는 유비쿼터스 환경하에서 필수불가결한 기술이 되도 있다. 그러나 RFID 의 본질적인 단점으로 인하여 프라이버시와 같은 보안적인 취약점을 기자고 있다. 따라서 본 논문에서는 RFID 시스템의 관점하에서 태그에서의 보안적인 취약점 및 이럴 해결하기 위한 여러 가지의 프로토콜에서의 문제점을 분석하였다. 최근에는 반도체 공정 기술의 발전과 경량화프로토콜의 발전으로 인하여 태그에서의 보안성이 향상되고 있는 중이다. Radio Frequency Identification(RFID) has been considered as an key infrastructure for the ubiquitous society. However, due to the inherent drawbacks, RFID causes var- ious security threats like privacy problems, tag cloning, etc. This paper analyses the security risk analysis process from the perspective of the RFID tag life cycle, identify the tag usage process, identify the associated vulnerability and threat to the confidentiality, integrity and availability of the information assets and its implications for privacy, and the mitigate the risks.

A Practical Security Risk Analysis Process and Tool for Information System

While conventional business administration-based information technology management methods are applied to the risk analysis of information systems, no security risk analysis techniques have been used in relation to information protection. In particular, given the rapid diffusion of information systems and the demand for information protection, it is vital to develop security risk analysis techniques. Therefore, this paper will suggest an ideal risk analysis process for information systems. To prove the usefulness of this security risk analysis process, this paper will show the results of managed, physical and technical security risk analysis that are derived from investigating and analyzing the conventional information protection items of an information system.