System Security Risk Assessment Research Articles

RiskTree: Decision Trees for Asset and Process Risk Assessment Quantification in Big Data Platforms

The inherent characteristics of big data lies in its voluminous scale, varied data formats, and swift processing velocity. The intrinsic characteristics of big data undermine the efficacy of conventional data security techniques and data management standards, consequently compromising the security of big data. As a consequence, big data possesses susceptibilities to security incidents, including unauthorized data access, data manipulation, and data compromise throughout the transmission, storage, and processing stages. Conventional information system security risk assessment methodologies are constrained by human resources and computational techniques, rendering them unsuitable for direct application to big data platforms. Consequently, there is an urgent necessity to develop a risk assessment framework tailored specifically for big data environments, capable of quantifying potential risks and losses. In response to this need, we have devised an automated risk assessment theory that assimilates the unique characteristics of big data with traditional quantitative methods, introducing a risk metric system suited to the big data context. Utilizing the risk-related data generated during operations on the big data platform, we train a decision tree model to derive the weights for each risk indicator. These weights are then employed to conduct a weighted summation of the operational risk indicators, thereby achieving a quantitative evaluation of the platform's risk profile. To substantiate the proposed framework, experiments were conducted on a simulated big data platform. The experimental outcomes demonstrate that, compared to existing quantitative risk assessment methodologies, our approach enables an automatic, objective, and efficient assessment and quantification of the risks associated with tangible assets and data processing operations within the big data platform.

A neuro-fuzzy security risk assessment system for software development life cycle

This study aims to protect software development by creating a Software Risk Assessment (SRA) model for each phase of the Software Development Life Cycle (SDLC) using an Adaptive Neuro-Fuzzy Inference System (ANFIS) model. Software developers discovered and validated the risk variables affecting each SDLC phase, following which relevant data about risk factors and associated SRA for each SDLC phase were collected. To create the SRA model for SDLC phases, risk factors were used as inputs, and SRA was used as an output. The formulated model was simulated using 70 % and 80 % of the data for training, while 30 % and 20 % were used for testing the model. The performance of the SRA models using the test datasets was evaluated based on accuracy. According to the study findings, many risk variables were discovered and confirmed for the requirement, design, implementation, integration, and operation phases of SDLC 11, 8, 9, 4, and 6, respectively. The SRA model was formulated using the risk factors using 2048, 256, 512, 16, and 64 inference rules for the requirement, design, implementation, integration, and operation phases, respectively. The study concluded that using the SRA model to assess security risk at each SDLC phase provided a secured software development process.

Facilitating the Integrative Use of Security Knowledge Bases within a Modelling Environment

Security threat and risk assessment of systems requires the integrated use of information from multiple knowledge bases. Such use is typically carried out ad-hoc by security experts in an unstructured manner. Also, this ad-hoc use of information often lacks foundations that allow for rigorous, disciplined applications of policy enforcement and the establishment of a well-integrated body of knowledge. This hinders organisational learning as well as the maturation of the threat modelling discipline. In this article, we uncover a newly developed extension of a state-of-the-art modelling tool that allows users to integrate and curate security-related information from multiple knowledge bases. Specifically, we provide catalogues of threats and security controls based on information from CAPEC, ATT&CK, and NIST SP800-53. We demonstrate the ability to curate security information using the designed solution. We highlight the contribution to improving the communication of security information, including the systematic mapping between user-defined security guidance and information derived from knowledge bases. The solution is open source and relies on model-to-model transformations and extendable threat and security control catalogues. Accordingly, the solution allows prospective users to adapt the modelling environment to their needs as well as keep it current with respect to evolving knowledge bases.

Design and Implementation of Intelligent Data Security Risk Assessment and Management System

Data is facing increasingly complex and diverse security risks. To have a better control on these, an Intelligent Data Security Risk Assessment and Management system emerges. This study takes a comprehensive literature research and case analysis method to have an in-depth research on the design and implementation of Intelligent Data Security Risk Assessment and Management System. Based on the collection and analysis of relevant literature, the key features and technical content of the system are introduced. The successful experience and challenges in the practical application of the system are explored through case analysis. The results indicate that the evaluation accuracy of the system is between 91% and 98%. The design and implementation of the Intelligent Data Security Risk Assessment and Management System greatly enhances the risk management capability of the organization. The system, leveraging on intelligent technology, is efficient, accurate in response and a comprehensive management of data security risk.

Integrated process safety and process security risk assessment of industrial cyber-physical systems in chemical plants

Aligned with the development needs of Industry 4.0, industrial cyber-physical systems (ICPSs) are widely applied to chemical facilities to facilitate so-called intelligent production processes. Meanwhile, emerging cyber-to-physical (C2P) risks are introduced due to the vulnerability of ICPSs to cyberattacks. An integrated safety and security risk assessment of chemical facilities equipped with industrial cyber-physical systems becomes challenging, particularly in performing a probabilistic/quantitative risk assessment. Targeting this gap, this study develops a systematic approach to construct accident scenarios concerning both safety hazards and security threats and performs a probabilistic risk assessment of chemical facilities considering the interdependency between safety-associated events and security-associated events. In the proposed approach, bow-tie technique is used to perform a safety risk analysis, and meanwhile, the possible dangerous scenarios caused by physical attacks and C2P attacks are also identified and integrated into the bow-tie diagram. Particularly, attack impact modeling of C2P attacks helps to identify dangerous attack modes, and a time-to-compromise (TTC) based method is used to quantify the vulnerability of ICPSs to C2P attacks. Then, a Bayesian network (BN) model is developed to perform an integrated safety and security risk analysis. An illustrative case study is used in this study to give guidance on performing integrated safety and security risk assessment of ICPSs and validate the feasibility of the proposed approach.

A review of cyber security risk assessment for web systems during its deployment and operation

This paper presents the state of the arts in security risk assessment of web systems. The process of assessing security risks and the process of developing and operating information systems in general, web systems in particular, are depicted step by step, showing how the risk assessment is performed during the deployment and the operation of web systems. Based on this analysis, different methods related to the manual and automatic risk assessment are reviewed, focusing on the methods using probability theory and Bayesian networks. The techniques developed for quantitative and qualitative assessment are presented and compared in terms of their objectives, scopes, and results to pick out advantages and limits. Finally, the approaches dedicated to assessing the risks of web systems are presented.

RISK ASSESSMENT MODELING OF ERP-SYSTEMS

Context. Because assessing security risks is a complex and complete uncertainty process, and uncertainties are a major factor influencing valuation performance, it is advisable to use fuzzy methods and models that are adaptive to noncomputed data. The formation of vague assessments of risk factors is subjective, and risk assessment depends on the practical results obtained in the process of processing the risks of threats that have already arisen during the functioning of the organization and experience of security professionals. Therefore, it will be advisable to use models that can ade-quately assess fuzzy factors and have the ability to adjust their impact on risk assessment. The greatest performance indicators for solving such problems are neuro-fuzzy models that combine methods of fuzzy logic and artificial neural networks and systems, i.e. “human-like” style of considerations of fuzzy systems with training and simulation of mental phenomena of neural networks. To build a model for calculating the risk assessment of security, it is proposed to use a fuzzy product model. Fuzzy product models (Rule-Based Fuzzy Models/Systems) this is a common type of fuzzy models used to describe, analyze and simulate complex systems and processes that are poorly formalized.
 Objective. Development of a fuzzy model of quality of security risk assessment and protection of ERP systems through the use of fuzzy neural models.
 Method. To build a model for calculating the risk assessment of security, it is proposed to use a fuzzy product model. Fuzzy product models are a common kind of fuzzy models used to describe, analyze and model complex systems and processes that are poorly formalized.
 Results. Identified factors influencing risk assessment suggest the use of linguistic variables to describe them and use fuzzy variables to assess their qualities, as well as a system of qualitative assessments. The choice of parameters was substantiated and a fuzzy product model of risk assessment and a database of rules of fuzzy logical conclusion using the MATLAB application package and the Fuzzy Logic Toolbox extension package was implemented, as well as improved by introducing the adaptability of the model to experimental data by introducing neuro-fuzzy components into the model. The use of fuzzy models to solve the problems of security risk assessment, as well as the concept and construction of ERP systems and the analyzed problems of their security and vulnerabilities are considered.
 Conclusions. A fuzzy model has been developed risk assessment of the ERP system. Selected a list of factors affecting the risk of security. Methods of risk assessment of information resources and ERP-systems in general, assessment of financial losses from the implementation of threats, determination of the type of risk according to its assessment for the formation of recommendations on their processing in order to maintain the level of protection of the ERP-system are proposed. The list of linguistic variables of the model is defined. The structure of the database of fuzzy product rules – MISO-structure is chosen. The structure of the fuzzy model was built. Fuzzy variable models have been identified.

DEVELOPING A FUZZY RISK ASSESSMENT MODEL FOR ERPSYSTEMS

Context. Because assessing information security risks is a complex and complete uncertainty process, and uncer-tainties are a major factor influencing valuation performance, it is advisable to use fuzzy methods and models that are adaptive to non-calculated data. The formation of vague assessments of risk factors is subjective, and risk assessment depends on the practical results obtained in the process of processing the risks of threats that have already arisen during the functioning of the organization and experience of information security professionals. Therefore, it will be advisable to use models that can adequately assess fuzzy factors and have the ability to adjust their impact on risk assessment. The greatest performance indicators for solving such problems are neuro-fuzzy models that combine methods of fuzzy logic and artificial neural networks and systems, i.e. “human-like” style of considerations of fuzzy systems with training and simulation of mental phenomena of neural networks. To build a model for calculating the risk assessment of information security, it is proposed to use a fuzzy product model. Fuzzy product models (Rule-Based Fuzzy Models/Systems) this is a common type of fuzzy models used to describe, analyze and simulate complex systems and processes that are poorly formalized.
 Objective. Development of the structure of a fuzzy model of quality of information security risk assessment and protection of ERP systems through the use of fuzzy neural models.
 Method. To build a model for calculating the risk assessment of information security, it is proposed to use a fuzzy product model. Fuzzy product models are a common kind of fuzzy models used to describe, analyze and model complex systems and processes that are poorly formalized.
 Results. Identified factors influencing risk assessment suggest the use of linguistic variables to describe them and use fuzzy variables to assess their qualities, as well as a system of qualitative assessments. The choice of parameters is substantiated and the structure of the fuzzy product model of risk assessment and the basis of the rules of fuzzy logical conclusion is developed. The use of fuzzy models for solving problems of information security risk assessment, as well as the concept and construction of ERP systems and analyzed problems of their security and vulnerabilities are considered.
 Conclusions. A fuzzy model has been developed risk assessment of the ERP system. Selected a list of factors affecting the risk of information security. Methods of risk assessment of information resources and ERP-systems in general, assessment of financial losses from the implementation of threats, determination of the type of risk according to its assessment for the formation of recommendations on their processing in order to maintain the level of protection of the ERP-system are proposed. The list of linguistic variables of the model is defined. The structure of the database of fuzzy product rules – MISO-structure is chosen. The structure of the fuzzy model was built. Fuzzy variable models have been identified.

A fuzzy DRBFNN-based information security risk assessment method in improving the efficiency of urban development.

The rapid development of urban informatization is an important way for cities to achieve a higher pattern, but the accompanying information security problem become a major challenge restricting the efficiency of urban development. Therefore, effective identification and assessment of information security risks has become a key factor to improve the efficiency of urban development. In this paper, an information security risk assessment method based on fuzzy theory and neural network technology is proposed to help identify and solve the information security problem in the development of urban informatization. Combined with the theory of information ecology, this method establishes an improved fuzzy neural network model from four aspects by using fuzzy theory, neural network model and DEMATEL method, and then constructs the information security risk assessment system of smart city. According to this method, this paper analyzed 25 smart cities in China, and provided suggestions and guidance for information security control in the process of urban informatization construction.

Design of vehicle traffic information security risk evaluation index system based on grey evaluation method

The network security problem of vehicle traffic information system is becoming more and more prominent. In order to effectively defend the system, this paper conducts in-depth research on the network security of vehicle traffic information system and proposes an information security risk assessment system for vehicle traffic control center. Specifically, the vehicle traffic control center is divided into components, and the security attributes of each component of the vehicle traffic control center system are constructed. By studying the information interaction process between the vehicle traffic control center and other subsystems, the security attributes of each component are abstracted; Identify the risk value of the component based on the influence of the component’s security attribute on the risk assessment index, aiming to enhance the security defense capability of the vehicle traffic information system.

Research on Information Security Risk Assessment Method Based on Fuzzy Rule Set

With the increasing complexity of the network structure and the increasing size of the network, various network security incidents pose an increasing threat to the security of computer systems and the network. Especially, in the network environment, the diversified intrusion methods and application environment make the security of the network more fragile. In order to improve information security, based on fuzzy rule sets, this paper proposes a fuzzy association rule mining algorithm based on fuzzy matrix and applies it to security event correlation. In addition, this paper combines the embedded system to construct an information security risk assessment system and sets the system performance based on the actual situation. Finally, this paper carries out experimental design to verify the performance of the system and analyzes the experimental results by mathematical statistics. From the experimental research, it can be seen that the system constructed in this paper has a certain effect.

Technical Countermeasures for Security Risks of Artificial General Intelligence

Human beings might face significant security risks after entering into the artificial general intelligence (AGI) era. By summarizing the difference between AGI and traditional artificial intelligence, we analyze the sources of the security risks of AGI from the aspects of model uninterpretability, unreliability of algorithms and hardware, and uncontrollability over autonomous consciousness. Moreover, we propose a security risk assessment system for AGI from the aspects of ability, motivation, and behavior. Subsequently, we discuss the defense countermeasures in the research and application stages. In the research stage, theoretical verification should be improved to develop interpretable models, the basic values of AGI should be rigorously constrained, and echnologies should be standardized. In the application stage, man-made risks should be prevented, motivations should be selected for AGI, and human values should be given to AGI. Furthermore, it is necessary to strengthen international cooperation and the education of AGI professionals, to well prepare for the unknown coming era of AGI.

Security Risk Assessment System for Detection and Prevention Of Unauthorized Access

Security Risk Assessment System for Detection and Prevention Of Unauthorized Access

An Integrated LHS–CD Approach for Power System Security Risk Assessment with Consideration of Source–Network and Load Uncertainties

Large-scale wind power integrated into power grids brings serious uncertainties and risks for power system safe operation, and it is imperative to evaluate power system security risk pertinent to high-level of uncertainties. In this paper, a comprehensive source–network–load probabilistic model, representing the typical uncertainties penetrated in power generation transmission consumption portion, is firstly set for power system operation. Afterwards an integrated LHS–CD approach based on the Latin hypercube sampling (LHS) and Cholesky decomposition (CD) is tailored to effectively conduct the security risk assessment, in which the LHS is utilized to stratified sample the uncertainties of wind power and thermal power, transmission line outage, and load demands, while the CD part is adopted to address the correlations of uncertainties by rearranging the sampled matrix generated by LHS. Moreover, static voltage risk and transmission line overloaded risk index are properly defined for quantitatively evaluating power system operational security risk. Simulation results of a modified New England 39-bus system confirm that the proposed integrated LHS–CD approach is effective and efficient for power system security risk assessment with consideration of source–network–load demand uncertainties.

Security Management of Process Plants by a Bayesian Network Methodology

Before the tragedy of 9/11, the perception of risk in process plants was mainly focused on accidental events caused by technical failures, human errors or natural events. However, since then, the risk of deliberate actions against process facilities - also known as security risk - has also become a concern. Security risk assessment of engineering systems and infrastructures constitutes a complex task since a significant multitude of technical and socio-political information is needed to reasonably predict the risk of intentional malevolent acts. In the present study, a methodology based on Bayesian network (BN) has been applied to increase the security of critical infrastructures via cost-effective allocation of security measures. Using the probability updating feature of BN, the proposed methodology can be employed to investigate the effect of vulnerabilities on adversaries' preferences while planning security scenarios. Moreover, the proposed methodology is capable of efficiently identifying an optimal defensive strategy given a security scenario (i.e., an attack) through maximizing defenders' expected utility.

Complex method to calculate objective assessments of information systems protection to improve expert assessments reliability

The paper considers the questions of filling the relevant SIEM nodes based on calculations of objective assessments in order to improve the reliability of subjective expert assessments. The proposed methodology is necessary for the most accurate security risk assessment of information systems. This technique is also intended for the purpose of establishing real-time operational information protection in the enterprise information systems. Risk calculations are based on objective estimates of the adverse events implementation probabilities, predictions of the damage magnitude from information security violations. Calculations of objective assessments are necessary to increase the reliability of the proposed expert assessments.

Network Security Risk Assessment System Based on Attack Graph and Markov Chain

Network security risk assessment technology can be found in advance of the network problems and related vulnerabilities, it has become an important means to solve the problem of network security. Based on attack graph and Markov chain, this paper provides a Network Security Risk Assessment Model (NSRAM). Based on the network infiltration tests, NSRAM generates the attack graph by the breadth traversal algorithm. Combines with the international standard CVSS, the attack probability of atomic nodes are counted, and then the attack transition probabilities of ones are calculated by Markov chain. NSRAM selects the optimal attack path after comprehensive measurement to assessment network security risk. The simulation results show that NSRAM can reflect the actual situation of network security objectively.

Design and Implementation of Security Risk Assessment System for Electric Power Communication Network

The communication network is an important part of the power system, its safety is of great significance to the whole power system safe and stable operation. At present, in the electric power communication network security risk assessment study, mostly concentrated in the evaluation model and evaluation index system, evaluation algorithm, such as theory research, rarely reported in the relevant assessment system and its application research. Article on the analysis of the present situation of electric power communication network security risk assessment based on the important degree evaluation, combined with vulnerability and risk assessment of electric power communication network backbone circuit process, the construction of evaluation index and risk calculation method is studied. Finally combining with the risk assessment process and method, designed and developed a set of practical engineering application value of electric power communication network security risk assessment system.

Research on Security Risk Assessment System of Soil Slope Based on AHP

Based on the investigation of soil slope in Zhejiang province, the main influence factors of soil slope stability were analyzed and the risk assessment indexes of soil slop were selected. Then the risk assessment model of soil slope was established by the method of analytic hierarchy process according to the importance of each index. The security risk assessment system of soil slope was obtained finally. The research result has important reference for the soil slope management.

How Much Matter Probabilities in Information Security Quantitative Risk Assessment?

The starting point of this research essay is a critical review of two methods to conduct a quantitative analysis of information systems security risks: 1) Management of Risk: Guidance for Practitioners and 2) a cost model based on annual loss expectancy. We are focusing on these methods with a perspective that highlights the limits of both empiricism and the theoretical elements that underlie them. From an epistemological point of view we have considered the logical syntax of the two models, the semantics included in statements and the pragmatics of the scientific discourse: the use of models to demonstrate the risk assessment thesis, to solve the problems of risks in the human judgment versus mathematical calculus controversy. The major issues that we are discussing in this article imply various perspectives on scientific criteria, the choice among various theories and the structuring of problems proposed to be solved. We argue that the models that have been developed so far, the top-down approach (which involves well defined and well understood rules), as well as the demonstrations based on the induction method, cannot be applied in a lot of scenarios, because information systems, considered as a complex whole made up of various components, is primarily not a positivistic science solely described by mathematics. The main research question to be answered in this paper is: What are the limits of knowledge in probabilistic computations for information systems security risk assessment? Our purpose is to demonstrate the epistemological limits of the two models and the error of generalizing probability calculus using the interpretive approach.