This paper presents a fuzzy set based decision support model for taking uncertainty into account when making security investment decisions for distributed systems. The proposed model is complementary to probabilistic approaches and useful in situations where probabilistic information is either unavailable or not appropriate to reliably predict future conditions. We first present the specificati...

This article brings a novel approach for optimized risk management in IT service information security. The new method is based on widely used international standards – best practices – for IT service management (ISO/IEC 20000) and Information security management system (ISO/IEC 27000). Firstly, the IT service information security approach is developed (based on a Service level management extens...

A significant challenge in evaluating network security stems from the scale of modern enterprise networks and the vast number of vulnerabilities regularly found in software applications. A common technique to deal with this complexity is attack graphs, where a tool automatically computes all possible ways a system can be broken into by analyzing the configuration of each host, the network, and ...

Conventional risk analysis techniques do not necessarily cover all security aspects in software. Defects in a software design cannot be identified by simply looking for flaws in the code. Therefore, carrying out risk analysis at architecture level is important. In this project we have performed architectural risk analysis of Chromium which is an open source web browser project. The method follo...

Asset analysis and valuation are important parts of the information security risk management. Outputs they produce are used in the process of risk analysis that plays a key role in securing organization’s business processes. A correct analysis and valuation of assets should reveal not only their importance for the organization, but also their relationships and dependencies between each other. T...

About ten years ago, triadic contexts were presented by Lehmann and Wille as an extension of Formal Concept Analysis. However, they have rarely been used up to now, which may be due to the rather complex structure of the resulting diagrams. In this paper, we go one step back and discuss how traditional line diagrams of standard (dyadic) concept lattices can be used for exploring and navigating ...

This paper is devoted to the presentation of a risk-management methodology (RiMaHCoF) that is specifically tailored for the health-care environment. The proposed methodology includes five successive stages in all, namely initiation, domain analysis, risk assessment, risk analysis and domain monitoring. This paper focuses on the risk analysis stage. The RiMaHCoF (" Risk Management in Health Care...

The goal of Security Risk Management is to teach you practical techniques that will be used on a daily basis, while also explaining the fundamentals so you understand the rationale behind these practices. Security professionals often fall into the trap of telling the business that they need to fix something, but they cant explain why. This book will help you to break free from the so-called bes...

With all the efforts put into IT system security, the issue remains of what the level of such security is and how sure we are that our IT system is secure. The paper starts with the assumption that users are one of the most important components of IT system security, and an aware and trained user takes much more care about security in his daily activities. Such system will have less security in...

With the recent service enhancements over the Internet, organisations are confronted with a growing magnitude of security intrusions and attacks. Current intrusion detection strategies have not been effective in the long term, as new and obfuscated security attacks keep emerging evading the surveillance mechanisms. With information technology (IT) playing a pivotal role in today’s organizationa...