An approach to select cost-effective risk countermeasures

Authors:
Le Minh Sang Tran;Bjørnar Solhaug;Ketil Stølen
Affiliations:
University of Trento, Italy;SINTEF ICT, Norway;SINTEF ICT, Norway,Department of Informatics, University of Oslo, Norway
Venue:
DBSec'13 Proceedings of the 27th international conference on Data and Applications Security and Privacy XXVII
Year:
2013

Citing 5
Cited 0

Security attribute evaluation method: a cost-benefit approach

Proceedings of the 24th International Conference on Software Engineering
Risk Analysis and Security Countermeasure Selection

Risk Analysis and Security Countermeasure Selection
Modular analysis and modelling of risk scenarios with dependencies

Journal of Systems and Software
Model-Driven Risk Analysis: The CORAS Approach

Model-Driven Risk Analysis: The CORAS Approach
SP 800-30. Risk Management Guide for Information Technology Systems

SP 800-30. Risk Management Guide for Information Technology Systems

Quantified Score

Hi-index	0.00

Visualization

Abstract

Security risk analysis should be conducted regularly to maintain an acceptable level of security. In principle, all risks that are unacceptable according to the predefined criteria should be mitigated. However, risk mitigation comes at a cost, and only the countermeasures that cost-efficiently mitigate risks should be implemented. This paper presents an approach to integrate the countermeasure cost-benefit assessment into the risk analysis and to provide decision makers with the necessary decision support. The approach comes with the necessary modeling support, a calculus for reasoning about the countermeasure cost and effect, as well as means for visualization of the results to aid decision makers.