Information Security Risk Assessment

Abstract

Information security risk assessment is an important part of enterprises’ management practices that helps to identify, quantify, and prioritize risks against criteria for risk acceptance and objectives relevant to the organization. Risk management refers to a process that consists of identification, management, and elimination or reduction of the likelihood of events that can negatively affect the resources of the information system to reduce security risks that potentially have the ability to affect the information system, subject to an acceptable cost of protection means that contain a risk analysis, analysis of the “cost-effectiveness” parameter, and selection, construction, and testing of the security subsystem, as well as the study of all aspects of security.

Web Application Security Education Platform Based on OWASP API Security Project

“…The main focus of the qualitative risk assessment is the likelihood of an event rather than its statistical probability. These likelihoods are derived from analyzing the threats and vulnerabilities and then generating a qualitative value for the asset or assets that may be affected [25]. In this research, we chose OWASP risk rating methodology to provide a risk-based level challenge by determining the severity rating of each challenge that is classified into 3 levels which are medium, high, and critical.…”

Information Security Risk Assessment (ISRA): A Systematic Literature Review

“…In most cases, the assessment input data are utilized to acquire information concerning undesirable or unexpected occurrences that might threaten information security. Nevertheless, a common absence of sufficient statistics diminishes the relevance and precision of the outcome [1].…”

“…The qualitative technique is popular since it uses a simple scale with three risk assessment levels (low, medium, and high). Interviews with experts might be used for assessment [1]. Large companies and cities benefit the most from qualitative risk analysis using scenario models.…”

“…In addition to comparing quantitative and qualitative-qualitative models, previous studies have been conducted to compare professional organisation frameworks [38]. In these comparative studies, researchers considered vulnerabilities, threats, assets, and countermeasures for security hazards [1]. For future research, qualitative models are the potential to be compared.…”

“…The aim is to assess the severity of a particular threat and its possible consequences. A hazard needs immediate precautionary measures because this poses the highest risk [1].…”