Security Risk Management Research Articles

Information System Security Risk Management E-Learning Using FMEA in University

The security of information systems in the learning process during the Covid-19 pandemic is very important for educational institutions today, which are based on government regulations that require learning to be done online In order to prevent the transmission of covid-19, people are advised to stay at home, but the learning process must continue In the process of learning system risk is a point that must be considered In online learning, information system security risk management can use the FMEA platform to analyze data security and minimize risks that occur © 2020, World Academy of Research in Science and Engineering All rights reserved

Vulnerability assessment of offshore terminals in the Sultanate of Oman: The case of a security audit for SPM Terminal of Mina al Fahal

Nowadays, the pressure for enhanced attention to critical infrastructure security and the focused concern on threats emanating from both domestic and foreign terrorist groups have fostered new challenges for Petrochemical Seaports and Offshore Terminals (PSOTs). These tendencies dictate to maintain comprehensive security regimens that can be integrated with national and international strategies to support the country’s security against terrorism. Therefore, the need for a Security Risk Management (SRM) programme will be an essential part of the business of running a seaport particularly if the addressed port or terminal is handling hazardous chemicals produced from a nearby plant or refinery for export purposes. As a result, by the use of a case study in this paper, the identified security risk factors for an offshore Single Point Mooring (SPM) terminal located inshore side of the seaport of Mina al Fahal in Sultanate of Oman will be assessed by introducing its designated Security Risk Factor Table (SRFT) in order to examine the vulnerability of the addressed terminal. Consequently, the proposed framework can be used by intelligence analysts or port security and risk managers for the protection of these critical infrastructures. Suitable mitigation measures and further treatments for lessening the impact of a successful terrorist attack or potential likelihood of other threats in PSOTs facilities will be studied carefully.

Wording optimization tasks on risk management by simulation in the CoC QUASAR

The article reveals the possibility of solving optimization tasks for security risk management in a specific social system. The application of modern technological solutions to support the assessments contributes to the assessment objectification and the scenarios based methods application. The modeling of security processes and their reproduction, including repeatedly in a simulation environment can be used to solve optimization tasks to ensure security. The optimization task for security risk management has been formulated as methodology for solving the problems in the laboratories of work package "Risk Management" of the Center for Competence QUASAR.

Development of a method for quantifying relative importance of NPP cyber attack probability variables based on factor analysis and AHP

The cyber security of NPPs recently has become a major issue, and a utility in Korea is requested to follow cyber security controls and to perform cyber security risk management based on the regulatory guide RS-015. Since it is difficult to fully implement the controls with limited resources, it is necessary to find which controls are relatively more important than other controls. The aim of this study is to develop a method for quantifying the relative importance of NPP cyber attack probability variables. These variables were investigated, and rearrangement and classification of them was validated by the factor analysis method. The relative importance among the variables was quantified by the AHP method. By applying the relative importance to the regulatory guide, the controls that have higher priority to be implemented were identified. Considering the relatively more important controls, it is expected that the utility can follow cyber security controls efficiently.

Hazard-risk and vulnerability assessment for the National Zoological Park at New Delhi, India

Hazard risk and disaster implications for human habitat have significant concern but, however, the vulnerability of animal habitat remained a low priority. Zoological parks where animals are under captivity present complexity or probable impacts in case of disasters. This study has considered the potential hazards and major incidents over past 20 years for risk and vulnerability assessment in order to delineate disaster risk reduction strategies for National Zoological Park. On-field observations were also undertaken, also the analysis of potential hazards implying the Scaling method. Evaluation and interpretation of data was done in graphs, charts and summarized tables. Most fatal disasters adversely affected the zoo environment were the cases of snake bite (44%) and disease outbreaks (32%). Under observational period, potential hazards such as presence of dry logs, branches and bushes prone to fire, damaged fencing, house shelters and roof of kraal, low level of railing in visitor viewing area and free ranging species were recorded. Hazard implications with high possibility future occurrence and with worst impact on zoo environment estimated were flood and sewage backflow (16%), fire incidents (10.7%), law and order problem (10.7%), zoonotic diseases and epidemics (10.7%), followed by other factors. Biosecurity measures taken by zoo administration were reviewed and recommendations have been drawn based on scientific observations and assessment of gaps with respect to security, safety and other risk management measures before, during and after a disaster.

Research on Public Health Security Risk Management and Emergency Response Measures under Climate Change

Climate change, characterized by global warming, has a wider and deeper impact on society, economy and life. Climate change is an important cause of human health and the spread of infectious diseases. The explosiveness and uncertainty of the epidemic of infectious diseases pose a huge threat to human health and become a major challenge for global public health security. Beginning in January 2020, a new coronavirus-infected pneumonia (COVID-19) was first diagnosed in Wuhan, China, and the epidemic quickly spread across the country, becoming a major event with the fastest spread, widest range of infection, and most difficult prevention and control in New China Public health emergencies have caused far-reaching social impacts and huge economic costs. This article analyzes the direct impact of climate on human health and the trend of the occurrence and spread of infectious diseases caused by future climate change. According to the shortcomings and deficiencies exposed in the public health field during the epidemic prevention and control, in the face of new situations, new challenges and new requirements, countermeasures were proposed for national governance and emergency response to public safety. To solve the current problems in a targeted manner, and actively promote the modernization of the national governance system and the modernization of governance capabilities. It is not only a scientific issue, but also an economic issue, and it is also a political issue that guarantees social harmony and security and stability. It has important practical significance and long-term historical significance.

Bayesian Decision Network-Based Security Risk Management Framework

Network security risk management is comprised of several essential processes, namely risk assessment, risk mitigation and risk validation and monitoring, which should be done accurately to maintain the overall security level of a network in an acceptable level. In this paper, an integrated framework for network security risk management is presented which is based on a probabilistic graphical model called Bayesian decision network (BDN). Using BDN, we model the information needed for managing security risks, such as information about vulnerabilities, risk-reducing countermeasures and the effects of implementing them on vulnerabilities, with the minimum need for expert’s knowledge. In order to increase the accuracy of the proposed risk assessment process, vulnerabilities exploitation probability and impact of vulnerabilities exploitation on network assets are calculated using inherent, temporal and environmental factors. In the risk mitigation process, a cost-benefit analysis is efficiently done using modified Bayesian inference algorithms even in case of budget limitation. The experimental results show that network security level enhances significantly due to precise assessment and appropriate mitigation of risks.

Development of sustainable SMEs: conceptualized criteria for measuring the sustainability of youth-owned small retail businesses in selected rural areas of South Africa

High failure rates among youth-owned small retail businesses has prompted the need for strengthening sustainability in the sector. The current paper sought to establish a framework for use in determining youth-owned small retail business sustainability. An exploratory mixed study approach was followed (qualitative and quantitative methods). Snowball and cluster sampling procedures were utilized to select respondents. Data were collected using semi-structured interview guides and close ended questionnaires. Qualitative data was analyzed using the Atlas.ti version 7 software network techniques, while the IBM SPSS version 25 techniques were utilized to generate quantitative results. Principal component analysis outcomes reflected that the framework for measuring youth-owned small retail business sustainability comprises 6 major components. The components included security measures (18.01%), outsourcing abilities (13.70%), marketing strategies (10.07%), risk management (8.54%), financial management (8.43%) and innovation (7.89%). The six pillars of the criteria were utilized to further develop time specific indices that were expressed in the following formula: R1 = ƒ (SM1, OA1, MS1, RM1, FM1, I1, S1) + e. Based on this formula, the sustainability of youth-owned small retail businesses can be assessed based on the six pillars on the right side of the equation and other subjective attributes at a particular time. The current study provided a framework that can be used by managers and practitioners to determine key sustainability building blocks of youth-owned small retail business at a particular time and track how they change over time.

A risk management framework for security and integrity of networks and services

It is clearly acknowledged that, in complex sectors like telecommunications, to consider an infrastructure as fully secure, although desirable, is not realistic. The current European regulation on public communications networks is aware of this assumption and currently requires that Telecommunications Service Providers (TSPs) take appropriate technical and organizational measures to manage the risks posed to the security of networks and services. In this context, risk management has become both a key aspect for dealing with security and a main trust vector included particularly in regulations. In this context, our paper concerns the establishment of a national security risk management framework to comply with national and European regulations for TSPs. This framework is composed of two parts: a security risk management tool to be used by the TSPs and an analysis tool to be used by the regulatory authority to gather and assess the risk management reports from the TSPs. The latter is specifically used to benchmark the security level of TSPs and the security of the sector as a whole. This paper reports on the design of this framework and the challenges emerging after an entire regulatory cycle.

Measuring development assistance for health systems strengthening and health security: an analysis using the Creditor Reporting System database.

Background: Health systems strengthening (HSS) and health security are two pillars of universal health coverage (UHC). Investments in these areas are essential for meeting the Sustainable Development Goals and are of heightened relevance given the emergence of the 2019 novel coronavirus disease (COVID-19). This study aims to generate information on development assistance for health (DAH) for these areas, including how to track it and how funding levels align with country needs. Methods: We developed a framework to analyze the amount of DAH disbursed in 2015 for the six building blocks of the health system ('system-wide HSS') plus health security (emergency preparedness, risk management, and response) at both the global (transnational) and country level. We reviewed 2,427 of 32,801 DAH activities in the Creditor Reporting System (CRS) database (80% of the total value of disbursements in 2015) and additional public information sources. Additional aid activities were identified through a keyword search. Results: In 2015, we estimated that US$3.1 billion (13.4%) of the US$22.9 billion of DAH captured in the CRS database was for system-wide HSS and health security: US$2.5 billion (10.9%) for system-wide HSS, mostly for infrastructure, and US$0.6 billion (2.5%) for system-wide health security. US$567.1 million (2.4%) was invested in supporting these activities at the global level. If responses to individual health emergencies are included, 7.5% of total DAH (US$1.7B) was for health security. We found a correlation between DAH for HSS and maternal mortality rates, and we interpret this as evidence that HSS aid generally flowed to countries with greater need. Conclusions : Achieving UHC by 2030 will require greater investments in system-wide HSS and proactive health emergency preparedness. It may be appropriate for donors to more prominently consider country needs and global functions when investing in health security and HSS.

Adopting ISO/IEC 27005:2011-based Risk Treatment Plan to Prevent Patients Data Theft

The concern raised in late 2017 regarding 46.2 million mobile device subscribers’ data breach had the Malaysian police started an investigation looking for the source of the leak. Data security is fundamental to protect the assets or information by providing its confidentiality, integrity and availability not only in the telecommunication industry but also in other sectors. This paper attempts to protect the data of a patient-based clinical system by producing a risk treatment plan for its software products. The existing system is vulnerable to information theft, insecure databases, needy audit login and password management. The information security risk assessment consisting of identifying risks, analyzing and evaluating them were conducted before a risk assessment report is written down. A risk management framework was applied to the software development unit of the organization to countermeasure these risks. ISO/IEC 27005:2011 standard was used as the basis for the information security risk management framework. The controls from Annex A of ISO/IEC 27001:2013 were used to reduce the risks. Thirty risks have been identified and 7 high-level risks for the product have been recognized. A risk treatment plan focusing on the risks and controls has been developed for the system to reduce these risks in order to secure the patients’ data. This will eventually enhance the information security in the software development unit and at the same time, increase awareness among the team members concerning risks and the means to handle them.

Cultivation potential projections of breadfruit (Artocarpus altilis) under climate change scenarios using an empirically validated suitability model calibrated in Hawai'i.

Humanity faces significant challenges to agriculture and human nutrition, and changes in climate are predicted to make such challenges greater in the future. Neglected and underutilized crops may play a role in mitigating and addressing such challenges. Breadfruit is a long-lived tree crop that is a nutritious, carbohydrate-rich staple, which is a priority crop in this regard. A fuzzy-set modeling approach was applied, refined, and validated for breadfruit to determine its current and future potential productivity. Hawai'i was used as a model system, with over 1,200 naturalized trees utilized to calibrate a habitat suitability model and 56 producer sites used to validate the model. The parameters were then applied globally on 17 global climate models at the RCP 4.5 and RCP 8.5 global climate projections for 2070. Overall, breadfruit suitability increases in area and in quality, with larger increases occurring in the RCP 8.5 projection. Current producing regions largely remain unchanged in both projections, indicating relative stability of production potential in current growing regions. Breadfruit, and other tropical indigenous food crops present strong opportunities for cultivation and food security risk management strategies moving forward.

Понятие правового механизма управления рисками финансовой безопасности

Понятие правового механизма управления рисками финансовой безопасности

Biopolitical Paternalism and Its Maternal Supplements: Kinship Correlates of Community Mental Health Governance in China

This article examines how the community mental health program run by the Chinese state conceptualizes, mobilizes, and molds the family. My fieldwork shows that, on the one hand, the program defines care biomedically and connects it to managing security risks in the population. The state fashions itself as paternal while displacing most responsibilities for patient care and management onto the supposedly authoritative families. On the other hand, caregivers—mostly women and the elderly—may resort to practices publicly denounced but privately enabled by the program, such as covert medication and home confinement. They do so not only to manage patients from a position of vulnerability and deprivation but also to compassionately engage with patients’ suffering and non-medical desires. These two entangled kinship correlates of state power, which I call “biopolitical paternalism” and its “maternal supplements,” prove critical for understanding the work of community governance in China and beyond.

Adversarial risk analysis under partial information

Adversarial risk analysis provides one-sided decision support to decision makers faced with risks due to the actions of other parties who act in their own interest. It is therefore relevant for the management of security risks, because the likely actions of the adversary can, to some extent, be forecast by formulating and solving decision models which explicitly capture the adversary’s objectives, actions, and beliefs. Yet, while the development of these decision models sets adversarial risk analysis apart from other approaches, the exact specification of the adversary’s decision model can pose challenges. In response to this recognition, and with the aim of facilitating the use of adversarial risk analysis when the parameters of the decision model are not completely known, we develop methods for characterizing the adversary’s likely actions based on concepts of partial information, stochastic dominance and decision rules. Furthermore, we consider situations in which information about the beliefs and preferences of all parties may be incomplete. We illustrate our contributions with a realistic case study of military planning in which the Defender seeks to protect a supply company from the Attacker who uses unmanned aerial vehicles for surveillance and the acquisition of artillery targets.

An Ontology-Based Security Risk Management Model for Information Systems

Security risk management is a knowledge-intensive procedure that requires monitoring and capturing relevant information that can assist in making the right decision by managers. In this paper, a semantically enhanced model for security management during the information system lifetime is proposed. The model supports the continuous collection of identified threat behaviours from the intrusion detection system, filtering and analysis of the threats within a time snapshot and re-appraiser of IS security countermeasures which involves the security administrator (S-Admin), managers, IS and security management system as stakeholders. The probe agent categorizes the security threats identified by the IDS using the developed ontology-driven knowledge base, while the likelihood of threats occurring in real time was obtained using long-term frequency probability. The case-based reasoning paradigm is employed for the security solution reasoning of identified threat risk. The suggested security solutions are based on CASE base built on existing threat ontology. The re-appraiser is based on the success likelihood of potential ongoing threats. The system facilitates management decision with regard to security control selection so that they can have a maximum Return on Security Investment. The proposed Collect–Probe–Analyse–Reason–Reappraise model is illustrated using an e-banking system.

Maturity Framework Analysis ISO 27001: 2013 on Indonesian Higher Education

Information Security Management System (ISMS) implementation in Institution is an effort to minimize information security risks and threats such as information leakage, application damage, data loss and declining IT network performance. The several incidents related to information security have occurred in the implementation of the Academic System application in Indonesian higher education. This research was conducted to determine the maturity level of information security practices in Academic Information Systems at universities in Indonesia. The number of universities used as research samples were 35 institutions. Compliance with the application of ISO 27001:2013 standard is used as a reference to determine the maturity level of information system security practices. Meanwhile, to measure and calculate the level of maturity using the SSE-CMM model. In this research, the Information System Security Index obtained from the analysis results can be used as a tool to measure the maturity of information security that has been applied. There are six key areas examined in this study, namely the role and importance of ICT, information security governance, information security risk management, information security management framework, information asset management, and information security technology. The results showed the level of information security maturity at 35 universities was at level 2 Managed Process and level 3 Established Process. The composition is that 40% of universities are at level 3, and 60% are out of level 3. The value of the gap between the value of the current maturity level and the expected level of maturity is varied for each clause (domain). The smallest gap (1 level) is in clause A5: Information Security Policy, clause A9: Access Control, and clause A11: Physical and environmental security. The biggest gap (4 levels) is in clause A14: System acquisition, development and maintenance and clause A18: compliance.  Â

Cybersecurity for higher education institutions: adopting regulatory framework

Cybersecurity is defined as the protection of networks, data and systems in the cyberspace. It should have the ability to protect or defend an organization’s use of cyberspace from any attack, conducted via cyberspace with the intention of disrupting, disabling, destroying, or maliciously controlling a computing environment and even destroying the integrity of the data or stealing controlled information. As the rapid technological developments have provided vast opportunities and potential sources of efficiency to every organization, these new technologies have also brought unprecedented threats and could be a critical issue for every organization. In this study, Phase I delved into the different Cybersecurity frameworks and regulatory environments presented through review of related literature. One of the frameworks is the Cybersecurity Framework released in 2014 by the National Institute of Standards and Technology (NIST). Establishing an internal cyber security policies and procedures, management of cyber security risk and the alignment to international information security standards will be the highlight of the literature review of this study. The Phase II will focus on the design, and analysis of a specific cyber security dealings guided by the standard regulatory framework intended for selected State Universities in Region III in the Philippines. Facing the threat of cyber-attacks, the researchers believed that educational administrators and leaders need to implement the right solutions to protect their resources from cyber threats. All organizations need to understand these cyber threats they face. The challenge now is the establishment of imperative tasks related to preservation of confidentiality, integrity and availability of information in the Cyberspace while facilitating an essential operating function.

Improving Chemical Security with Material Control and Accountability and Inventory Management

Chemical risk management is a process to control safety and security risks associated with hazardous chemicals. Chemical risk management includes the management of both chemical safety and chemical security. It is generally accepted that there are five pillars that make up chemical security management. Each of the five pillars are key components to the implementation of a chemical security risk management system. In this work, we will review the “Material Control and Accountability” pillar and how an academic institution can implement this principle using a chemical inventory management system (CIMS). A robust CIMS will improve the quality and efficiency of research, reduce time and resources associated with laboratory management, and reduce both the safety and security risks associated with chemicals.

Risk management practices in information security: Exploring the status quo in the DACH region

Information security management aims at ensuring proper protection of information values and information processing systems (i.e. assets). Information security risk management techniques are incorporated to deal with threats and vulnerabilities that impose risks to information security properties of these assets. This paper investigates the current state of risk management practices being used in information security management in the DACH region (Germany, Austria, Switzerland). We used an anonymous online survey targeting strategic and operative information security and risk managers and collected data from 26 organizations. We analyzed general practices, documentation artifacts, patterns of stakeholder collaboration as well as tool types and data sources used by enterprises to conduct information security management activities. Our findings show that the state of practice of information security risk management is in need of improvement. Current industrial practice heavily relies on manual data collection and complex potentially subjective decision processes with multiple stakeholders involved. Dedicated risk management tools and methods are used selectively and neglected in favor of general-purpose documentation tools and direct communication between stakeholders. In light of our results we propose guidelines for the development of risk management practices that are better aligned with the current operational situation in information security management.