Security Risk Management Framework Research Articles

Blockchain-based ontology driven reference framework for security risk management

Security risk management (SRM) is crucial for protecting valuable assets from malicious harm. While blockchain technology has been proposed to mitigate security threats in traditional applications, it is not a perfect solution, and its security threats must be managed. This paper addresses the research problem of having no unified and formal knowledge models to support the SRM of traditional applications using blockchain and the SRM of blockchain-based applications. In accordance with this, we present a blockchain-based reference model (BbRM) and an ontology driven reference framework (OntReF) for the SRM of traditional and blockchain-based applications. The BbRM consolidates security threats of traditional and blockchain-based applications, structured following the SRM domain model and offers guidance for creating the OntReF using the domain model. OntReF is grounded on unified foundational ontology (UFO) and provides semantic interoperability and supporting the dynamic knowledge representation and instantiation of information security knowledge for the SRM. Our evaluation approaches demonstrate that OntReF is practical to use.

IoT Security Risk Management: A Framework and Teaching Approach

While Internet of Things (IoT) devices have increased in popularity and usage, their users have become more susceptible to cyber-attacks, thus emphasizing the need to manage the resulting security risks. However, existing works reveal research gaps in IoT security risk management frameworks where the IoT architecture – building blocks of the system – are not adequately considered for analysis. Also, security risk management includes complex tasks requiring appropriate training and teaching methods to be applied effectively. To address these points, we first proposed a security risk management framework that captures the IoT architecture perspective as an input to further security risk management activities. We then proposed a hackathon learning model as a practical approach to teach hackathon participants to apply the IoT security risk management framework. To evaluate the benefits of the framework and the hackathon learning model, we conducted an action research study that integrated the hackathon learning model into a cybersecurity course, where students learn how to apply the framework. Our findings show that the IoT-ARM framework was beneficial in guiding students towards IoT security risk management and producing repeatable outcomes. Additionally, the study demonstrated the applicability of the hackathon model and its interventions in supporting the learning of IoT security risk management and applying the proposed framework to real-world scenarios.

Design of Information Security Risk Management Framework Based on a Risk Profiling Study in the Healthcare Sector

Saat ini, sektor kesehatan merupakan salah satu sektor yang menjadi target utama serangan siber. Penggunaan teknologi informasi pada sektor kesehatan menyebabkan munculnya berbagai kerentanan dalam sektor kesehatan. Pengelolaan risiko keamanan informasi merupakan salah satu hal yang harus dilakukan oleh organisasi sektor kesehatan. Penelitian ini bertujuan untuk menghasilkan kerangka kerja manajemen risiko keamanan informasi pada sektor kesehatan berdasarkan kajian terhadap profil risiko yang ada pada sektor kesehatan. Penelitian dilakukan dengan metode kualitatif. Berdasarkan hasil risk profiling, sektor kesehatan mempunyai dua aset kritikal, yaitu electronic health record dan perangkat medis yang saling terhubung atau Internet of Medical Things. Aset tersebut mempunyai sensitivitas yang tinggi namun mempunyai berbagai kerentanan yang rawan dieksploitasi. Untuk mengatasi hal tersebut, diajukan kerangka kerja manajemen risiko keamanan informasi yang terdiri atas empat tahap, yaitu Risk Profiling, Pengukuran Level Risiko, Perlakuan Risiko, dan Pemantauan. Risk Profiling merupakan tahap yang penting dalam proses manajemen risiko. Pada tahap tersebut dilakukan analisis untuk menghasilkan gambaran profil risiko keamanan informasi berdasarkan aset kritikal yang dimiliki organisasi dan kondisi ruang siber dalam konteks keamanan informasi di sektor kesehatan. Kerangka yang diajukan bersifat siklis karena profil risiko pada sektor kesehatan sifatnya dinamis sehingga perlu dilakukan pemantauan terhadap perubahan profil risiko organisasi.

An integrated cyber security risk management framework and risk predication for the critical infrastructure protection

Cyber security risk management plays an important role for today’s businesses due to the rapidly changing threat landscape and the existence of evolving sophisticated cyber attacks. It is necessary for organisations, of any size, but in particular those that are associated with a critical infrastructure, to understand the risks, so that suitable controls can be taken for the overall business continuity and critical service delivery. There are a number of works that aim to develop systematic processes for risk assessment and management. However, the existing works have limited input from threat intelligence properties and evolving attack trends, resulting in limited contextual information related to cyber security risks. This creates a challenge, especially in the context of critical infrastructures, since attacks have evolved from technical to socio-technical and protecting against them requires such contextual information. This research proposes a novel integrated cyber security risk management (i-CSRM) framework that responds to that challenge by supporting systematic identification of critical assets through the use of a decision support mechanism built on fuzzy set theory, by predicting risk types through machine learning techniques, and by assessing the effectiveness of existing controls. The framework is composed of a language, a process, and it is supported by an automated tool. The paper also reports on the evaluation of our work to a real case study of a critical infrastructure. The results reveal that using the fuzzy set theory in assessing assets' criticality, our work supports stakeholders towards an effective risk management by assessing each asset's criticality. Furthermore, the results have demonstrated the machine learning classifiers’ exemplary performance to predict different risk types including denial of service, cyber espionage and crimeware.

Trustworthiness Evaluation for Permissioned Blockchain-Enabled Applications

As permissioned blockchain becomes a common foundation of blockchain-based circumstances for current organizations, related stakeholders need a means to assess the trustworthiness of the applications involved within. It is extremely important to consider the potential impact brought by the Blockchain technology in terms of security and privacy. Therefore, this study proposes a rigorous security risk management framework for permissioned blockchain-enabled applications. The framework divides itself into different implementation domains, i.e., organization security, application security, consensus mechanism security, node management and network security, host security and perimeter security, and simultaneously provides guidelines to control the security risks of permissioned blockchain applications with respect to these security domains. In addition, a case study, including a security testing and risk evaluation on each stack of a specific organization, is demonstrated as an implementation instruction of our proposed risk management framework. According to the best of our knowledge, this study is one of the pioneer researches that provide a means to evaluate the security risks of permissioned blockchain applications from a holistic point of view. If users can trust the applications that adopted this framework, this study can contribute to the adoption of permissioned blockchain-enabled technologies. Furthermore, application providers can use the framework to perform gap analysis on their existing systems and controls and understand the risks of their applications.

Towards Design and Development of a Data Security and Privacy Risk Management Framework for WBAN Based Healthcare Applications

Assuring security and privacy of data is a key challenge for organizations when developing WBAN applications. The reasons for this challenge include (i) developers have limited knowledge of market-specific regulatory requirements and security standards, and (ii) there are a vast number of security controls with insufficient implementation detail. To address these challenges, we have developed a WBAN data security and privacy risk management framework. The goal of this paper is trifold. First, we present the methodology used to develop the framework. The framework was developed by considering recommendations from legislation and standards. Second, we present the findings from an initial validation of the framework’s usability and effectiveness of the security and privacy controls. Finally, we present an updated version of the framework and explain how it addresses the aforementioned challenges.

IoT in Banking: The trends, threats, and solution

The Internet of Things is the next step of the digital revolution that will change consumers' lives. The Internet of Things promises to be a worthy representative of an open course in technology, economics, and culture. IoT, without a doubt, has a promising future. The modern consumer actions and uses represent inescapable digital transformations for banking institutions. Emerging digital world developments guide all banking services' digital transformation. However, the security threats of using IoT in banking are increasing. Cybercriminals such as hacking, corruption, and financial violence, data breaches, and financial expenditure risks will continue to trouble the use of IoT in banking. Therefore, this research aims to study the banking industry's existing IoT uses, issues, and challenges in adopting the IoT in the banking industry. IoT threats are highlighted in this paper. This article sets out a model dimension of the process monitoring framework for IoT security risk management. Other than that, this paper also studies the existing security risk management model of IoT in banking. Moreover, preventive IoT protection initiatives and approaches to enhance IoT protection by implementing blockchain technology and Control Model Information Structure are addressed in this article

Bayesian Decision Network-Based Security Risk Management Framework

Network security risk management is comprised of several essential processes, namely risk assessment, risk mitigation and risk validation and monitoring, which should be done accurately to maintain the overall security level of a network in an acceptable level. In this paper, an integrated framework for network security risk management is presented which is based on a probabilistic graphical model called Bayesian decision network (BDN). Using BDN, we model the information needed for managing security risks, such as information about vulnerabilities, risk-reducing countermeasures and the effects of implementing them on vulnerabilities, with the minimum need for expert’s knowledge. In order to increase the accuracy of the proposed risk assessment process, vulnerabilities exploitation probability and impact of vulnerabilities exploitation on network assets are calculated using inherent, temporal and environmental factors. In the risk mitigation process, a cost-benefit analysis is efficiently done using modified Bayesian inference algorithms even in case of budget limitation. The experimental results show that network security level enhances significantly due to precise assessment and appropriate mitigation of risks.

A risk management framework for security and integrity of networks and services

It is clearly acknowledged that, in complex sectors like telecommunications, to consider an infrastructure as fully secure, although desirable, is not realistic. The current European regulation on public communications networks is aware of this assumption and currently requires that Telecommunications Service Providers (TSPs) take appropriate technical and organizational measures to manage the risks posed to the security of networks and services. In this context, risk management has become both a key aspect for dealing with security and a main trust vector included particularly in regulations. In this context, our paper concerns the establishment of a national security risk management framework to comply with national and European regulations for TSPs. This framework is composed of two parts: a security risk management tool to be used by the TSPs and an analysis tool to be used by the regulatory authority to gather and assess the risk management reports from the TSPs. The latter is specifically used to benchmark the security level of TSPs and the security of the sector as a whole. This paper reports on the design of this framework and the challenges emerging after an entire regulatory cycle.

Adopting ISO/IEC 27005:2011-based Risk Treatment Plan to Prevent Patients Data Theft

The concern raised in late 2017 regarding 46.2 million mobile device subscribers’ data breach had the Malaysian police started an investigation looking for the source of the leak. Data security is fundamental to protect the assets or information by providing its confidentiality, integrity and availability not only in the telecommunication industry but also in other sectors. This paper attempts to protect the data of a patient-based clinical system by producing a risk treatment plan for its software products. The existing system is vulnerable to information theft, insecure databases, needy audit login and password management. The information security risk assessment consisting of identifying risks, analyzing and evaluating them were conducted before a risk assessment report is written down. A risk management framework was applied to the software development unit of the organization to countermeasure these risks. ISO/IEC 27005:2011 standard was used as the basis for the information security risk management framework. The controls from Annex A of ISO/IEC 27001:2013 were used to reduce the risks. Thirty risks have been identified and 7 high-level risks for the product have been recognized. A risk treatment plan focusing on the risks and controls has been developed for the system to reduce these risks in order to secure the patients’ data. This will eventually enhance the information security in the software development unit and at the same time, increase awareness among the team members concerning risks and the means to handle them.

Integrated Circuit Security Risk Management Framework in Government Agencies

The security risk management framework is an essential part of strategic management for government agencies. It allows a government to systematically identify and address the risks associated with its activities to achieve sustainability for different activities of security risk management. The goal of security risk management is to add sustainable value to government activities and reduce the chance of security breaches. Applying security risk management techniques used to government projects can increase the chances of success, help achieve objectives, and assist in finding preventive solutions for future projects. The application of security risk management is profitable for government agencies because it sets specific risk management objectives that are based on the broader overall strategy. It contributes to the achievement of strategic objectives with mechanisms like Spearman's rank correlation coefficient and simple linear regression. These techniques can improve decision-making, planning and implementation of government activities, as well as reduce the negative consequences of present threats. It is recommended to apply the integrated security risk management framework proposed in this paper to increase the effectiveness of security risk management in government agencies. Also using quantitative and intelligent techniques in the analysis and estimation of security risks can help managers to make decisions regarding security issues in government agencies.

A Framework for Cloud Security Risk Management based on the Business Objectives of Organizations

Security is considered one of the top ranked risks of Cloud Computing (CC) due to the outsourcing of sensitive data onto a third party. In addition, the complexity of the cloud model results in a large number of heterogeneous security controls that must be consistently managed. Hence, no matter how strongly the cloud model is secured, organizations continue suffering from lack of trust on CC and remain uncertain about its security risk consequences. Traditional risk management frameworks do not consider the impact of CC security risks on the business objectives of the organizations. In this paper, we propose a novel Cloud Security Risk Management Framework (CSRMF) that helps organizations adopting CC identifies, analyze, evaluate, and mitigate security risks in their Cloud platforms. Unlike traditional risk management frameworks, CSRMF is driven by the business objectives of the organizations. It allows any organization adopting CC to be aware of cloud security risks and align their low-level management decisions according to high-level business objectives. In essence, it is designed to address impacts of cloud-specific security risks into business objectives in a given organization. Consequently, organizations are able to conduct a cost-value analysis regarding the adoption of CC technology and gain an adequate level of confidence in Cloud technology. On the other hand, Cloud Service Providers (CSP) is able to improve productivity and profitability by managing cloud-related risks. The proposed framework has been validated and evaluated through a use-case scenario.

Risk Management Framework and Evaluation: Detail Site Study and Governance of Information Security Risk Management in Medical Information Technology Infrastructure in Hospitals

Objectives: This research has focused on exploring the risk factors involved in hospital medical IT infrastructure risk factor while carry out the software and hardware deployment (i.e. field study) and proposed a risk management framework and assessments for managing the risk. The main objective of the research is to propose an information security risk management framework for a hospital domain as part of use-case in this research. In this paper, we have identified possibilities of risk that might happen anytime, carried out risk analysis in university hospital, and provided risk contingency plans. Methods: Information security is very important for the organization, but very particular for hospital domain, due to patient information is involved and it is very sensitive. While delivering the information, need to be producing the right information at right time with the effective care. The availability of information is very important in medical systems where most of the providers are from cross-border healthcare domain. The methodology followed is a qualitative approach of interview, collecting data, analysis the data, evaluate and provide recommendations. Findings: The expected outcome from this work is a recommendation of risk managing framework for hospital domain on a global context. The risk assessment evaluates the IT plan reports for hospitals and the involved parties to identify the sensitivity, threats, vulnerabilities, and risks that surround the whole medical IT infrastructure. The identified risks are analysed, prioritized and mitigated by providing relevant control plan and recommendationswere provided toavoid or minimize the risk factors in the medical domain. Improvements: Based on field study and risk evaluation reports, IT infrastructure can be improved and risk factors would be forecasted in future and minimized with effective contingency plans. Keywords: Information Security, Medical Hospital, Risk Assessment, Risk Management, Risk Mitigation

A Risk Management Framework for Cloud Migration Decision Support

Keywords: risk management framework; risk assessment; cloud migration; security; analytic hierarchy process (AHP); business value

Critical infrastructure asset identification: seemingly simple but frustratingly elusive

The attacks of 9/11 highlighted irrefutable vulnerabilities in the US critical infrastructure system and prompted necessary efforts to strengthen defence and resiliency of infrastructure against attack. As critical infrastructures become more dependent on cyber resources, the threat landscape continues to rapidly evolve exposing critical infrastructure to a heightened risk of cyber-attacks. The Department of Homeland Security's Risk Management Framework was developed to guide protection efforts and depends heavily on the ability of the department to effectively identify critical infrastructure assets. However, program audits have reported fundamental flaws in the US identification and prioritisation program. Specifically, there is a need for validation and verification that the right assets are being considered in order to ensure that scarce national resources are not wasted towards protection of the wrong assets. This paper summarises US critical infrastructure identification efforts, ongoing challenges to current programs, and recommendations for moving forward.

Critical infrastructure asset identification: seemingly simple but frustratingly elusive

The attacks of 9/11 highlighted irrefutable vulnerabilities in the US critical infrastructure system and prompted necessary efforts to strengthen defence and resiliency of infrastructure against attack. As critical infrastructures become more dependent on cyber resources, the threat landscape continues to rapidly evolve exposing critical infrastructure to a heightened risk of cyber-attacks. The Department of Homeland Security's Risk Management Framework was developed to guide protection efforts and depends heavily on the ability of the department to effectively identify critical infrastructure assets. However, program audits have reported fundamental flaws in the US identification and prioritisation program. Specifically, there is a need for validation and verification that the right assets are being considered in order to ensure that scarce national resources are not wasted towards protection of the wrong assets. This paper summarises US critical infrastructure identification efforts, ongoing challenges to current programs, and recommendations for moving forward.

Introducing OSSF: A framework for online service cybersecurity risk management

This paper proposes a new framework for online services security risk management which can be used by both service providers and service consumers. The proposed framework was validated through a case study performed in a large enterprise environment. The key components of the proposed framework are Threat model and Risk model. These models are designed to fit specific features of online services and the surrounding cyberspace environment. A risk management process is an integral part of the framework. The process is suitable for frequent and recurrent risk assessments. The process execution results in identification and performance of proper tasks which contribute to treatment of identified security risks and deficiencies. Online services risk score could be continuously documented and reported if the process is executed on a regular basis.

A framework for selection of strategy for management of security measures

In this paper, we present and discuss a framework for security risk management, focusing on the selection of a management strategy for decision-making on security measures in particular. The framework provides guidance on the selection of a suitable type of management strategy for various types of decision-making contexts. An Information and Communication Technology case study is used to illustrate the practical implications of the framework.

A decision framework for managing risk to airports from terrorist attack.

This article presents an asset-level security risk management framework to assist stakeholders of critical assets with allocating limited budgets for enhancing their safety and security against terrorist attack. The proposed framework models the security system of an asset, considers various threat scenarios, and models the sequential decision framework of attackers during the attack. Its novel contributions are the introduction of the notion of partial neutralization of attackers by defenders, estimation of total loss from successful, partially successful, and unsuccessful actions of attackers at various stages of an attack, and inclusion of the effects of these losses on the choices made by terrorists at various stages of the attack. The application of the proposed method is demonstrated in an example dealing with security risk management of a U.S. commercial airport, in which a set of plausible threat scenarios and risk mitigation options are considered. It is found that a combination of providing blast-resistant cargo containers and a video surveillance system on the airport perimeter fence is the best option based on minimum expected life-cycle cost considering a 10-year service period.

Assessment and Management the Security Risk of Public Cloud Service

Cloud computing has become a very attractive paradigm because of its economic and operational benefits. However, most enterprise executives hesitate to use cloud computing system due to the security and privacy challenges. We recognize that it is very important that enterprises assess the security risk before transforming their traditional information services into the cloud. In this paper, we discuss the existing information security risk assessment solutions and approaches, analysis the security challenges of the cloud computing. We propose a useful information security risk assessment and management framework for cloud computing environments and discuss the specific implement of framework.