A security risk analysis model for information systems: Causal relationships of risk factors and vulnerability propagation analysis

Authors:
Nan Feng;Harry Jiannan Wang;Minqiang Li
Affiliations:
College of Management and Economics, Tianjin University, 92 Weijin Road, Nankai District, Tianjin 300072, PR China;Department of Accounting and MIS, University of Delaware, Newark, DE, United States;College of Management and Economics, Tianjin University, 92 Weijin Road, Nankai District, Tianjin 300072, PR China
Venue:
Information Sciences: an International Journal
Year:
2014

Citing 30
Cited 1

A Bayesian Method for the Induction of Probabilistic Networks from Data

Machine Learning
Modern heuristic techniques for combinatorial problems

Modern heuristic techniques for combinatorial problems
Bayesian networks

Communications of the ACM
Learning Bayesian Networks: The Combination of Knowledge and Statistical Data

Machine Learning
Structure Learning of Bayesian Networks by Genetic Algorithms: A Performance Analysis of Control Parameters

IEEE Transactions on Pattern Analysis and Machine Intelligence
Learning in graphical models

Learning in graphical models
The ant colony optimization meta-heuristic

New ideas in optimization
Swarm intelligence

Swarm intelligence
Introduction to Bayesian Networks

Introduction to Bayesian Networks
The economics of information security investment

ACM Transactions on Information and System Security (TISSEC)
Managing Information Security Risks: The Octave Approach

Managing Information Security Risks: The Octave Approach
Searching for the best elimination sequence in Bayesian networks by using ant colony optimization

Pattern Recognition Letters
The economic cost of publicly announced information security breaches: empirical evidence from the stock market

Journal of Computer Security - IFIP 2000
Metaheuristics in combinatorial optimization: Overview and conceptual comparison

ACM Computing Surveys (CSUR)
Ant Colony Optimization

Ant Colony Optimization
BBN-based software project risk management

Journal of Systems and Software - Special issue: Applications of statistics in software engineering
Information Security Risk Analysis

Information Security Risk Analysis
The max-min hill-climbing Bayesian network structure learning algorithm

Machine Learning
An Information Systems Security Risk Assessment Model Under the Dempster-Shafer Theory of Belief Functions

Journal of Management Information Systems
The Effect of Internet Security Breach Announcements on Market Value: Capital Market Reactions for Breached Firms and Internet Security Developers

International Journal of Electronic Commerce
Network externalities, layered protection and IT security risk management

Decision Support Systems
Quantitative risk-based security prediction for component-based systems with explicitly modeled attack profiles

Journal of Systems and Software
A simple graphical approach for understanding probabilistic inference in Bayesian networks

Information Sciences: an International Journal
Choquet integral based aggregation approach to software development risk assessment

Information Sciences: an International Journal
Optimal Search on Clustered Structural Constraint for Learning Bayesian Network Structure

The Journal of Machine Learning Research
Bayesian Networks and Influence Diagrams: A Guide to Construction and Analysis

Bayesian Networks and Influence Diagrams: A Guide to Construction and Analysis
An information systems security risk assessment model under uncertain environment

Applied Soft Computing
An integrated risk measurement and optimization model for trustworthy software process management

Information Sciences: an International Journal
Ant system: optimization by a colony of cooperating agents

IEEE Transactions on Systems, Man, and Cybernetics, Part B: Cybernetics
Fuzzy risk analysis based on similarity measures of generalized fuzzy numbers

IEEE Transactions on Fuzzy Systems

Identification of stock market forces in the system adaptation framework

Information Sciences: an International Journal

Quantified Score

Hi-index	0.07

Visualization

Abstract

With the increasing organizational dependence on information systems, information systems security has become a very critical issue in enterprise risk management. In information systems, security risks are caused by various interrelated internal and external factors. A security vulnerability could also propagate and escalate through the causal chains of risk factors via multiple paths, leading to different system security risks. In order to identify the causal relationships among risk factors and analyze the complexity and uncertainty of vulnerability propagation, a security risk analysis model (SRAM) is proposed in this paper. In SRAM, a Bayesian network (BN) is developed to simultaneously define the risk factors and their causal relationships based on the knowledge from observed cases and domain experts. Then, the security vulnerability propagation analysis is performed to determine the propagation paths with the highest probability and the largest estimated risk value. SRAM enables organizations to establish proactive security risk management plans for information systems, which is validated via a case study.