A Weighted Monte Carlo Simulation Approach to Risk Assessment of Information Security Management System

Abstract

In recent decades, information has become a critical asset to various organizations, hence identifying and preventing the loss of information are becoming competitive advantages for firms. Many international standards have been developed to help organizations to maintain their competitiveness by applying risk assessment and information security management system and keep risk level as low as possible. This study aims to propose a new quantitative risk analysis and assessment methodology which is based on AHP and Monte Carlo simulation. In this method, AHP is used to create favorable weights for Confidentiality, Integrity and Availability (CIA) as security characteristic of any information asset. To deal with the uncertain nature of vulnerabilities and threats, Monte Carlo simulation is utilized to handle the stochastic nature of risk assessment by taking into account multiple judges' opinions. The proposed methodology is suitable for organizations that require risk analysis to implement ISO/IEC 27001 standard.

Information Security Risk Assessment in Critical Infrastructure: A Hybrid MCDM Approach

“…, then" rules. The method for assessing the critical threats, assets and vulnerabilities OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is a methodology based on strategic risk assessment (Bamakan and Dehghanimohammadabadi, 2015).…”

Analyzing airport security checkpoint performance using cognitive agent models

“…These parameters play a central role in the generic TVC methodology (Washington, 2009), which underlies many existing security risk assessment frameworks, and is used to manage risks in a wide range of organizations. Security risk assessment is also done by methods based on game theory (Brown, Sinha, Schlenker, & Tambe, 2016;Farraj, Hammad, Al Daoud, & Kundur, 2016;Pita et al, 2008), graph theory (Schneier, 1999), the bowtie method (de Ruijter & Guldenmund, 2016), probabilistic tools (Bamakan & Dehghanimohammadabadi, 2015;Chawdhry, 2009) and red-teaming, i.e., real-life simulation of a threat scenario.…”

Towards effective cybersecurity resource allocation: the Monte Carlo predictive modelling approach

“…The tool utilises Monte Carlo method to support evidence-based risk assessment and management, in furtherance of justifying appropriate countermeasures. The work in [35] presents a different approach to information security assessment based on analytic hierarchy process (AHP) and Monte Carlo simulation. In particular, the approach applies weight elements to the confidentiality, integrity and availability of information assets in order to improve the accuracy of results.…”