Purpose This study aims to argue that in the case of quantitative security risk assessment, individuals do not estimate probabilities as a likelihood measure of event occurrence. Design/methodology/approach The study uses the most commonly used quantitative assessment approach, the annualized loss expectancy (ALE), to support the three research hypotheses. Findings The estimated probabilities used in quantitative models are subjective. Research limitations/implications The ALE model used in security risk assessment, although it is presented in the literature as quantitative, is, in fact, qualitative being influenced by bias. Practical implications The study provides a factual basis showing that quantitative assessment is neither realistic nor practical to the real world. Originality/value A model that cannot be tested experimentally is not a scientific model. In fact, the probability used in ISRM is an empirical probability or estimator of a probability because it estimates probabilities from experience and observation.

No abstract

No abstract

Dynamic data masking (DDM) is a powerful data-security technique for protecting personal and other sensitive information in databases from unauthorized access. A DDM can be used to mask or obfuscate information in real time, as it is accessed by unauthorized users. This prevents sensitive information from being exposed, while still allowing authorized users to access the data. In current multilayered applications, data masking may be incorporated as special modules placed anywhere between the storage and user interface. In this paper, we consider the solution of implementing masking directly in the persistence layer so that data do not travel unmasked along the network. The data at rest are unchanged (i.e., unmasked), but when users query the database, the sensitive columns in the results are displayed in a masked format, which makes it impossible to identify the original data. Given the diversity of masking features proposed by commercial and open-source database servers, this study proposes a framework for assessing the performance penalty of SQL queries when using database masking relative to the original (unmasking) scenario. We implemented and applied the framework to a basic masking scenario in the Oracle database server using the TPC-H benchmark database. Exploratory analysis and Machine Learning models suggest that DDM has a weak impact on query performance. This could be a powerful incentive for incorporating DDM in real-world software applications when up to 100GB data is stored using Oracle database server.

No abstract