Security Risk Analysis Research Articles

An Ontology-Based Dynamic Attack Graph Generation Approach for the Internet of Vehicles

With the development of automobile intelligence, the security of the Internet of Vehicles has become a key factor that affects the development of intelligent vehicles. However, existing security risk analysis methods for the IoV either focus only on certain levels, such as the component level, or perform only a static analysis. This paper proposes a dynamic attack graph generation method for the IoV to identify and visually display the security risks caused by the associated vulnerabilities in an IoV system. First, using the actual architecture of the IoV, this paper shows how to model the security elements and their relationships in the IoV system and proposes a network security ontology model for this system. Second, it shows how to construct a reasoning rule base according to the causal relationship between the vulnerabilities using the Semantic Web Rule Language Finally, in view of the rapid change in the network topology of the IoV, a dynamic attack graph generation algorithm based on an ontology reasoning engine is proposed, which can effectively reduce the overhead caused by the changes in the attack graph. The effectiveness of the algorithm is demonstrated through an actual security event scenario and a constructed scenario. The experimental results show that the algorithm can dynamically and accurately display the network attack graph of the IoV. The proposed method is helpful in globally analyzing the threat caused by the combined exploitation of the vulnerabilities in an IoV system and risk management.

Model‐based risk assessment evaluation

Risk assessment (RA) belongs to the core parts of an organizational risk management process. The primary goals of a RA are the identification, estimation and prioritization of risk(s) to organizational operations. The existing quantitative analysis of RA is focusing on the risk factors, that is, threat or vulnerability. However, the quantitative metrics of the assessment have not been formally defined and modeled yet. Consequently, it is essential to define a formal model and relevant security metrics for RA within an organization. In this study, we will use a complete lattice to analyze risk factors. Moreover, a formal model will be defined to describe the RA process. The reachability of the model will be discussed. Quantitative metrics will be defined to provide insight on the risk estimation. The model can be expressed using colored Petri nets. This study can assist chief information security officers analyze security risks in their organizations and help them balance the security budget in their organizations.

Анализ рисков и разработка механизмов их снижения при реализации ФНТП развития сельского хозяйства России

Abstract. The preparation of the work is related to the low level of publication activity regarding the issues of research on the risks of scientific and technological development of agriculture, on the one hand, and the growing need for the formation of practical recommendations on risk management for the development of departmental information systems designed to implement state programs for the scientific and technological development of agriculture. This document presents the assessment and analysis of risk management elements in the Federal Scientific and Technical Program for Agricultural Development for 2017–2025 (FSTP). The purpose of the article is to analyze the range of risk management entities, the types of risks identified in the regulatory legal framework governing the scientific and technological support of agricultural development and procedural measures for their management, as well as the inclusion of risks of scientific and technological development of agriculture in the system of risks to food security. An analysis of food security risks was carried out in regulatory documents, new risk formulations in the updated Food Security Doctrine were clarified. Attention is paid to problematic issues of risk interpretation in the FSTP, which require scientific discussion and amendments to regulatory documents. For the first time, the definition of the risk of scientific and technological development of agriculture in the context of the FSTP was formulated. The work identified and considered the risks of the upper level of scientific and technical development of agriculture in connection with food security, the risks of achieving the results of the FSTP, the risks of achieving the result of the main activities of the FSTP subprogrammes. Methods. Methodically, the work is based on an expert method and analysis of documentation. The scientific novelty consists in developing an integrated approach to the analysis of risks of scientific and technological development of agriculture. The result of the work is the identified relationships of the analyzed risks and recommendations for improving the methodological apparatus of risk management in the area under consideration.

Analyzing Security Risks in Cyber-Physical Manufacturing Systems with Actor–Network Theory

Abstract This article suggests that actor–network theory (ANT) can reveal unique challenges and consequences of cyberattacks in manufacturing. As an approach, ANT rejects the dualism that often separates humans and nonhumans, recognizing the active role of both in affecting events. Our approach adds an important new perspective to an existing body of research that focuses on analyzing vulnerabilities in cyberspace instead of their ramifications in the material world. Drawing on the case study of a faulty airbag inflator in an automobile, we use concepts and vocabularies drawn from ANT to discuss the consequences of attacks in manufacturing, such as viewing altered products as actants with agency to alter subsequent networks (e.g., when a manufactured part is integrated into an automotive vehicle). By tracing the movement of specific materials and products through networks it is possible to elucidate how cyberattacks not only impact cyber-physical systems themselves, but also reverberate into a multitude of broader impacts, potentially endangering physical safety, shaping public opinion, and influencing economic markets. Our examination of one particular context draws on existing work that has brought ANT and cybersecurity in dialogue, but we extend this work by focusing on the role of “translation” and “depunctualization” across the lifecycle of a cyberattack in manufacturing. This analysis stresses the need for sector-specific examinations of cyberthreats, while also demonstrating the value of interdisciplinary methods like ANT that do not reify artificial dualisms in addressing for conceptualizing security risks in cyber-physical manufacturing systems.

Security Risk Analysis in IoT Systems through Factor Identification over IoT Devices

IoT systems contribute to digital transformation through the development of smart concepts. However, the IoT has also generated new security challenges that require security tools to be adapted, such as risk analysis methodologies. With this in mind, the purpose of our study is based on the following question: Which factors of IoT devices should be considered within risk assessment methodologies? We have addressed our study with a 4-phase design-research methodology (DRM) that allows us, based on systematic literature review, to experiment and draw upon expert judgment; as a final product, we obtain a risk assessment methodology based on the characteristics of IoT devices. At the end of this study, we establish seven main constructs—Organization, Risk Behaviors, Dependency, Attack Surface, Susceptibility, Severity and Uncertainty—over which security risk in IoT systems can be evaluated.

Information security risk analysis in the networks of the industrial internet of things

With the rapid development of the Industrial Internet of Things (IIoT), there has been a need to respond quickly, detect and prevent intrusions. These problems are especially relevant due to the projected growth in IIoT users. Risk assessment is an important part of the process of creating information security systems, including industrial complexes. The aim of this work is to develop a practical model for assessing information security risks in industrial Internet of Things networks. The proposed model is based on a simple additive weighting method and fuzzy logic. Fuzzy logic is appropriate for risk assessment and represents practical results. The implementation of the process of fuzzy modeling of the rule base is carried out by using the specialized package Fuzzy Logic Toolbox of the MATLAB software tool.

An investigation study for risk calculation of security vulnerabilities on android applications

Applications within mobile devices, although useful and entertaining, come with security risks to private information stored within the device such as name, address, and date of birth. Standards, frameworks, models, and metrics have been proposed and implemented to combat these security vulnerabilities, but they remain to persist today. In this review, we discuss the risk calculation of android applications which is used to determine the overall security of an application. Besides, we also present and discuss the permission-based access control models that can be used to evaluate application access to user data. The study also focuses on examining the predictive analysis of security risks using machine learning. We conduct a comprehensive review of the leading studies accomplished on investigating the vulnerabilities of the applications for the Android mobile platform. The review examines various well-known vulnerabilities prediction models and highlights the sources of the vulnerabilities, prediction technique, applications and the performance of these models. Some models and frameworks prove to be promising but there is still much more research needed to be done regarding security for Android applications.

In-Depth Exploration of ISO/SAE 21434 and Its Correlations with Existing Standards

In recent years, the evolution of road vehicles has strongly required common rules to manage cybersecurity in the automotive industry. In this article, we summarize the ISO/SAE 21434 standard, focusing on the main requirements, work products, and innovations. We identify with an ego-network the possible correlation of ISO/SAE 21434 with the already existing automotive standards, reporting a strong correlation with the ISO 26262 safety standard. Following, we discuss the relationship between safety and security in the automotive field, and between ISO/SAE 21434 and regulation UNECE WP.29 R155. Then we focus on possible limits and implementations of the standard such as the introduction of application methods or specific thresholds for the required security risk analysis. Finally, we propose a structured list of documents that can be used as a landmark to achieve compliance with the cyber-security standard and an example of the application of ISO/SAE 21434 to an electric window power regulator system.

The analysis of security and privacy risks in smart education environments

The contemporary smart educational environment uses different information technologies like social networks, virtual laboratories, augmented reality, artificial intelligence, big data, and so on. Each of these technologies has its security and privacy threats profile, but their integration in one system can lead to completely new challenges. The article analyses the technological development of smart educational environments from the point of view of their security and privacy issues. Any technological or legislative security control could be broken as the result of one mistake caused by human factors. People with different levels of competence are interacting every day with each other in educational environments. The risks of personal data leaking or hacking of educational services should be minimized during this interaction. Therefore, not only the key technologies that form the architecture of the educational environment but also the main points of interaction between the users and the education environment should be taken into account in the analysis. The article provides a basic analysis of security and privacy risks for smart education environments. As the result, the analysis identifies key information security technologies development of which is necessary for the sustainable development of a smart educational environment as part of a smart city.

Methodology of information security risk analysis based on quantitative assessment of damages in information and technical systems bodies of the internal affairs

Objective. Assessment of the consequences of the occurrence of damage cases in the information and technical systems (ITS) of the internal affairs bodies (ATS) requires the use of an analysis of the risks of damage as a result of the implementation of information security threats.Method. In order to analyze the processes occurring in the ITS, as a rule, mathematical modeling is used. For ITS, due to the high technological complexity, high costs for the acquisition, maintenance of equipment and payment of wages to employees, it is necessary to apply the procedure for analyzing the risks of ITS ITS. The security of the functioning of the ITS ITS is normative, since at the moment the method of quantitative assessment of damages is insufficiently developed. The development of this scientific application would make it possible to establish the appropriate value of the indicator of the permissible risk of the implementation of threats to information security. Analytical and mathematical modeling using the apparatus of queuing systems. Result. A technique for analyzing the risks of information security violations based on a quantitative assessment of the damages of the ITS of ATS is given. Conclusion. The direction of this study is relevant and requires further elaboration in order to improve the method for assessing the occurrence of damage in the ITS of the internal affairs bodies.

Power 5G Hybrid Networking and Security Risk Analysis

5G communication technology provides strong support for the power Internet of Things, and it also introduces new security challenges in the application process of the power industry. Starting from the analysis of the power 5G business requirements, this article proposes five 5G enterprise networking construction plans based on different collaborative processing relationships, and conducts a comparative analysis in security, delay, independence, cost, and staffing. According to the analysis of power business requirements and enterprise networking mode, a hybrid networking architecture of 5G and power communication network is proposed, and the 5G network slicing architecture is re-segmented according to different business scenarios. Finally, the new risks and challenges introduced by 5G technology are analyzed in detail from the four parts of terminal access, edge computing, network channel, and core network. Two important risks pointed are specified through a security risk assessment algorithm. In the future, it is also necessary to further study key technologies such as lightweight authentication algorithms and network slice security isolation to realize the real security use of 5G network in the power industry.

Artificial Intelligence Technology in Internet Finance and Analysis of Security Risk

Artificial Intelligence Technology in Internet Finance and Analysis of Security Risk

Hesitant Fuzzy-Sets Based Decision-Making Model for Security Risk Assessment

Security is an important component in the process of developing healthcare web applications. We need to ensure security maintenance; therefore the analysis of healthcare web application's security risk is of utmost importance. Properties must be considered to minimise the security risk. Additionally, security risk management activities are revised, prepared, implemented, tracked, and regularly set up efficiently to design the security of healthcare web applications. Managing the security risk of a healthcare web application must be considered as the key component. Security is, in specific, seen as an add-on during the development process of healthcare web applications, but not as the key problem. Researchers must ensure that security is taken into account right from the earlier developmental stages of the healthcare web application. In this row, the authors of this study have used the hesitant fuzzy-based AHP-TOPSIS technique to estimate the risks of various healthcare web applications for improving security-durability. This approach would help to design and incorporate security features in healthcare web applications that would be able to battle threats on their own, and not depend solely on the external security of healthcare web applications. Furthermore, in terms of healthcare web application's security-durability, the security risk variable is measured, and vice versa. Hence, the findings of our study will also be useful in improving the durability of several web applications in healthcare.

Analysis of water security risk of cash forest expansion in the Loess Plateau in terms of water footprint:A case study of apple planting

Analysis of water security risk of cash forest expansion in the Loess Plateau in terms of water footprint:A case study of apple planting

Risk analysis for forecasting cyberattacks against connected and autonomous vehicles

A security risk analysis was conducted to identify possible cyberattacks against a future transport system consisting of autonomous and connected vehicles. Six scenarios were developed: joyriding, kidnapping, domestic abuse, autopilot manipulation, a large transport accident, and paralysis of the transport system. Even if it were possible to increase the difficulty of conducting such cyberattacks, it might be impossible to eliminate such attacks entirely. Measures that limit the consequences will therefore be necessary. Such measures include safety measures in vehicles to protect their occupants in traffic accidents and measures that make vehicles easier to remove in case they do not function.

A Spatial Panel Analysis of Food Security and Political Risk in Asian Countries

A Spatial Panel Analysis of Food Security and Political Risk in Asian Countries

Enabling Security Services in Socially Assistive Robot Scenarios for Healthcare Applications.

Today’s IoT deployments are highly complex, heterogeneous and constantly changing. This poses severe security challenges such as limited end-to-end security support, lack of cross-platform cross-vertical security interoperability as well as the lack of security services that can be readily applied by security practitioners and third party developers. Overall, these require scalable, decentralized and intelligent IoT security mechanisms and services which are addressed by the SecureIoT project. This paper presents the definition, implementation and validation of a SecureIoT-enabled socially assisted robots (SAR) usage scenario. The aim of the SAR scenario is to integrate and validate the SecureIoT services in the scope of personalized healthcare and ambient assistive living (AAL) scenarios, involving the integration of two AAL platforms, namely QTrobot (QT) and CloudCare2U (CC2U). This includes risk assessment of communications security, predictive analysis of security risks, implementing access control policies to enhance the security of solution, and auditing of the solution against security, safety and privacy guidelines and regulations. Future perspectives include the extension of this security paradigm by securing the integration of healthcare platforms with IoT solutions, such as Healthentia with QTRobot, by means of a system product assurance process for cyber-security in healthcare applications, through the PANACEA toolkit.

Failure Probability and Security Risk Analysis of Gravity-Wharf Structures in Port Engineering

Xie, Y.; Li, P.; Xu, S.; Chen, J., and Feng, H., 2021. Failure probability and security risk analysis of gravity-wharf structures in port engineering. Journal of Coastal Research, 37(5), 1035–1041. Coconut Creek (Florida), ISSN 0749-0208. To assess the security risk of the gravity-wharf overall structure, the failure probability of the overall structure of the gravity wharf is analyzed based on the Rosenblueth method combined with the structural reliability theory. By constructing the serial system of a gravity wharf, a simplified failure model of the overall structure of a gravity wharf is established to obtain the failure probability of the whole wharf structural system. Thus, the security risk assessment of the gravity-wharf structure is realized. The calculation and analysis of the failure risk of a gravity caisson wharf indicates that the reliability index of the gravity-wharf structure at design low water level is much lower than that at design high water level. And at the design low water level, the overall structure has the largest failure probability. The reliability index of antisliding stability of a gravity caisson wharf at design low water level is about 20.6% lower than that at design high water level. And the reliability index of anti-overturning stability at design low water level is about 11.9% lower than that at design high water level. Meanwhile, the failure probability of anti-overturning of the caisson wharf structure is higher than that of antisliding at the same water level. The analysis method in this paper needn't consider the distribution characteristics of each parametric variable, the calculation efficiency of which is high. The analysis conclusions can provide reference for the failure probability and security risk assessment of the gravity-wharf overall structure.

Research on Information Security Risk Analysis and Prevention Technology of Network Communication Based on Cloud Computing Algorithm

Data communication network must use telephone, cable or optical fiber as transmission medium and computer as information receiving, output and communication tool. Customers can not only process the received information, but also realize information sharing through the network. With the wide application of network communication in daily life, network security issues have higher requirements. In order to solve the problems of subjectivity, long modeling time and low classification accuracy of information security risk assessment methods, this paper first proposes an intelligent information security risk assessment method based on decision tree. Compared with other classification algorithms such as support vector machine, the decision tree classification algorithm has no requirement for data category distribution, and has good classification effect and fast speed. Finally, this paper introduces the security measures in network data communication for reference only.

Quantitative Security Risk Modeling and Analysis with RisQFLan

Domain-specific quantitative modeling and analysis approaches are fundamental in scenarios in which qualitative approaches are inappropriate or unfeasible. In this paper, we present a tool-supported approach to quantitative graph-based security risk modeling and analysis based on attack-defense trees. Our approach is based on QFLan, a successful domain-specific approach to support quantitative modeling and analysis of highly configurable systems, whose domain-specific components have been decoupled to facilitate the instantiation of the QFLan approach in the domain of graph-based security risk modeling and analysis. Our approach incorporates distinctive features from three popular kinds of attack trees, namely enhanced attack trees, capabilities-based attack trees and attack countermeasure trees, into the domain-specific modeling language. The result is a new framework, called RisQFLan, to support quantitative security risk modeling and analysis based on attack-defense diagrams. By offering either exact or statistical verification of probabilistic attack scenarios, RisQFLan constitutes a significant novel contribution to the existing toolsets in that domain. We validate our approach by highlighting the additional features offered by RisQFLan in three illustrative case studies from seminal approaches to graph-based security risk modeling analysis based on attack trees.