ویراساینس.
سند علمی

A hybrid information security risk assessment procedure considering interdependences between controls

Chi-Chun Lo, Wan-Jia Chen

چکیده

Risk assessment is the core process of information security risk management. Organizations use risk assessment to determine the risks within an information system and provide sufficient means to reduce these risks. In this paper, a hybrid procedure for evaluating risk levels of information security under various security controls is proposed. First, this procedure applies the Decision Making Trial and Evaluation Laboratory (DEMATEL) approach to construct interrelations among security control areas. Secondly, likelihood ratings are obtained through the Analytic Network Process (ANP) method; as a result, the proposed procedure can detect the interdependences and feedback between security control families and function in real world situations. Lastly, the Fuzzy Linguistic Quantifiers-guided Maximum Entropy Order-Weighted averaging (FLQ-MEOWA) operator is used to aggregate impact values assessed by experts, applied to diminish the influence of extreme evaluations such as personal views and drastic perspectives. A real world application in a branch office of the health insurance institute in Taiwan was examined to verify the proposed procedure. By analyzing the acquired data, we confirm the proposed procedure certainly detects the influential factors among security control areas. This procedure also evaluates risk levels more accurately by coping with the interdependencies among security control families and determines the information systems safeguards required for better security, therefore enabling organizations to accomplish their missions. Crown Copyright 2011 Published by Elsevier Ltd. All rights reserved.

اسناد مشابه

  • Development of an E-Healthcare Information Security Risk Assessment Method

    سند علمی۲۰۱۳J. Database Manag.June Wei, Binshan Lin, Meiga Loho-Noya

    This paper developed a method to assess information security risks in e-healthcare. Specifically, it first developed a static E-Healthcare Information Security Risk (EHISR) model to present thirty-three security risk factors by identifying information security threats and their s

  • A Model-based Information Security Risk Assessment Method for Science Gateways

    سند علمی۲۰۱۳IWSGEvert Mouw, Guido van 't Noordende, Baas Louter, Sílvia Delgado Olabarriaga

    BACKGROUND: Information Security is important for e-Science research groups and other small organisations that design and operate science gateways and virtual research environments, especially when such environments are being used for (bio)medical research. We propose a novel met

  • Taxonomy of information security risk assessment (ISRA)

    سند علمی۲۰۱۶Computers & SecurityAlireza Shameli Sendi, Rouzbeh Aghababaei-Barzegar, Mohamed Cheriet

    Information is a perennially significant business asset in all organizations. Therefore, it must be protected as any other valuable asset. This is the objective of information security, and an information security program provides this kind of protection for a company’s informati

  • Information Security Risk Assessment Based on Analytic Hierarchy Process

    سند علمی۲۰۱۶Mingxiang He, Xin An

    Abstract Information security risk assessment was an important component of information systems security engineering and the selection of assessment method had a direct impact on the final results of the assessment. But there were too many elements in the process of information s

  • Apply Fuzzy Decision Tree to Information Security Risk Assessment

    سند علمی۲۰۱۴Zne-Jung Lee, Li-Yun Chang

    As computer becomes popular and internet advances rapidly, information application systems are used extensively in organizations. Various information application systems such as attendance systems, accounting systems, and statistical systems have already replaced manual operation

  • Model of Information Security Risk Assessment based on Improved Wavelet Neural Network

    سند علمی۲۰۱۳JNWGang Chen, Dawei Zhao

    This paper concentrates on the information security risk assessment model utilizing the improved wavelet neural network. The structure of wavelet neural network is similar to the multi-layer neural network, which is a feed-forward neural network with one or more inputs. Afterward