Information Security Risk Assessment A Practical Approach with a Mathematical Formulation of Risk

Ghazouani, Mohamed El; Faris, Sophia; Medromi, Hicham; Sayouti, Adil

doi:10.5120/18097-9155

Cited by 28 publications

(15 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The article [7] proposes a mathematical formulation of risk using the SI main concepts of such risk management methodologies as MEHARI, EBIOS, CRAMM and SP 800-30 (NIST).…”

Section: Analysis Of Recent Studies and Publicationsmentioning

confidence: 99%

Algorithm of Information Security Risk Assessment Based on Fuzzy-Multiple Approach

Yevseiev

Shmatko

Romashchenko

2019

A.I.S.

View full text Add to dashboard Cite

The subject of the study is the process of assessing the level of information security risk that is being implemented with the help of the fuzzy logic apparatus. The purpose of this work is to develop a methodology for assessing the degree of information security risk, which would avoid the uncertainty factor, that occurs when some parts of information about the analyzed automated information system are absent. The methodology is based on the use of fuzzy logic and fuzzy sets and implies the introduction of the term sets for each of the system characteristics and the linguistic assessment of the indicators. The tasks to be solved are to analyze existing information security risk assessment methodologies for identifying their strengths and weaknesses. On the basis of the conducted analysis, a new method for assessing the risk of automated information systems information security is proposed. The following results were obtained: the advantages and disadvantages of qualitative and quantitative methodologies for assessing the risk degree of automated systems information security were identified; the main stages of the proposed methodology were described; the degree of information security risk is calculated in comparison to the FAIR methodology. Conclusion: The methodology presented in the article provides an opportunity to translate the obtained results of risk assessment from a mathematical language into a linguistic form that is more comprehensible to the decision-maker. This increases the effectiveness of the management of automated information systems protection mechanisms.

show abstract

“…The article [7] proposes a mathematical formulation of risk using the SI main concepts of such risk management methodologies as MEHARI, EBIOS, CRAMM and SP 800-30 (NIST).…”

Section: Analysis Of Recent Studies and Publicationsmentioning

confidence: 99%

Algorithm of Information Security Risk Assessment Based on Fuzzy-Multiple Approach

Yevseiev

Shmatko

Romashchenko

2019

A.I.S.

View full text Add to dashboard Cite

show abstract

“…[20] is the system that maintains security for personal information. [16] is the practical approach by applying a mathematical formulation of web vulnerabilities. [25] is the research work related to reduction of denial of service attacks using web service filters.…”

Section: Other Web Vulnerability Detection Systemsmentioning

confidence: 99%

Automated Client-side Sanitizer for Code Injection Attacks

Patil¹,

Patil²

2016

IJITCS

View full text Add to dashboard Cite

Web applications are useful for various online services. These web applications are becoming ubiquitous in our daily lives. They are used for multiple purposes such as e-commerce, financial services, emails, healthcare services and many other captious services. But the presence of vulnerabilities in the web application may become a serious cause for the security of the web application. A web application may contain different types of vulnerabilities. Cross-site scripting is one of the type of code injection attacks. According to OWASP TOP 10 vulnerability report, Cross-site Scripting (XSS) is among top 5 vulnerabilities. So this research work aims to implement an effective solution for the prevention of cross-site scripting vulnerabilities. In this paper, we implemented a novel client-side XSS sanitizer that prevents web applications from XSS attacks. Our sanitizer is able to detect cross-site scripting vulnerabilities at the client-side. It strengthens web browser, because modern web browser do not provide any specific notification, alert or indication of security holes or vulnerabilities and their presence in the web application.

show abstract

“…[20] is the system that maintains security for personal information. [16] is the practical approach by applying mathematical formulation of web vulnerabilities. [26] is the research work related to reduction of denial of service attacks using web service filters.…”

Section: Other Web Vulnerability Detection Systemsmentioning

confidence: 99%

Client-side Automated Sanitizer for Cross-Site Scripting Vulnerabilities

Patil¹,

Patil²

2015

IJCA

View full text Add to dashboard Cite

Web applications are useful for various online services. These web applications are becoming ubiquitous in our daily lives. They are used for multiple purposes such as e-commerce, financial services, emails, healthcare services and many other captious services. But the presence of vulnerabilities in the web application may become a serious cause for the security of the web application. A web application may contain different types of vulnerabilities. According to OWASP TOP 10 vulnerability report, Cross-site Scripting (XSS) is among top 5 vulnerabilities. So this research work aims to implement effective solution for the prevention of cross-site scripting vulnerabilities. In this paper, we implemented a novel client-side XSS sanitizer that prevents web applications from XSS attacks. Our sanitizer is able to detect cross-site scripting vulnerabilities at the client-side. It strengthens web browser, because modern web browser do not provide any specific notification, alert or indication of security holes or vulnerabilities and their presence in the web application.

show abstract

Information Security Risk Assessment A Practical Approach with a Mathematical Formulation of Risk

Cited by 28 publications

References 6 publications

Algorithm of Information Security Risk Assessment Based on Fuzzy-Multiple Approach

Algorithm of Information Security Risk Assessment Based on Fuzzy-Multiple Approach

Automated Client-side Sanitizer for Code Injection Attacks

Client-side Automated Sanitizer for Cross-Site Scripting Vulnerabilities

Contact Info

Product

Resources

About