IT architecture-based confidentiality risk assessment in networks of organizations

Morali, Ayse

doi:10.3990/1.9789036531658

Cited by 7 publications

(3 citation statements)

References 74 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Therefore, we developed RiskREP [8]. RiskREP is built on the CRAC++ [14] and MOQARE [7] methods. The following Section 3 presents RiskREP´s meta model which explicitly considers different perspectives on security, and Section 4 illustrates RiskREP´s systematic process with extracts from an action case.…”

Section: Related Workmentioning

confidence: 99%

“…The risk expert also assesses the value of each quality goal, for example by using value models for availability [20] or confidentiality [14] and then estimates the impact or damage caused by the misuse case to these quality goals. This way we maintain the link between business goals and impact of a misuse case.…”

Section: Fig 2: Business Concepts Elicited With Riskrepmentioning

confidence: 99%

“…However, checklists are based on past experience and are useful for achieving consensus among experts, but do not necessarily provide justifications that are based on business goals or technical characteristics of the system. Such ad hoc analyses are risky in the face of current fast-changing information technology (IT) [14,20]. Furthermore, such justifications provide a proof of common maturity level which is necessary for networks of businesses to operate securely and effectively.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Risk and Business Goal Based Security Requirement and Countermeasure Prioritization

Herrmann

Morali²,

Etalle

et al. 2012

Workshops on Business Informatics Research

Self Cite

View full text Add to dashboard Cite

Companies are under pressure to be in control of their assets but at the same time they must operate as efficiently as possible. This means that they aim to implement-good-enough security‖ but need to be able to justify their security investment plans. Currently companies achieve this by means of checklist-based security assessments, but these methods are a way to achieve consensus without being able to provide justifications of countermeasures in terms of business goals. But such justifications are needed to operate securely and effectively in networked businesses. In this paper, we first compare a Risk-Based Requirements Prioritization method (RiskREP) with some requirements engineering and risk assessment methods based on their requirements elicitation and prioritization properties. RiskREP extends misuse case-based requirements engineering methods with IT architecture-based risk assessment and countermeasure definition and prioritization. Then, we present how RiskREP prioritizes countermeasures by linking business goals to countermeasure specification. Prioritizing countermeasures based on business goals is especially important to provide the stakeholders with structured arguments for choosing a set of countermeasures to implement. We illustrate RiskREP and how it prioritizes the countermeasures it elicits by an application to an action case.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Fig 2: Business Concepts Elicited With Riskrepmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Risk and Business Goal Based Security Requirement and Countermeasure Prioritization

Herrmann

Morali²,

Etalle

et al. 2012

Workshops on Business Informatics Research

Self Cite

View full text Add to dashboard Cite

show abstract

Efficient modelling, generation and analysis of Markov Automata

Timmer¹

View full text Add to dashboard Cite

Quantitative model checking is concerned with the verification of both quantitative and qualitative properties over models incorporating quantitative information. Increases in expressivity of the models involved allow more types of systems to be analysed, but also raise the difficulty of their efficient analysis.Three years ago, the Markov automaton (MA) was introduced as a generalisation of probabilistic automata and interactive Markov chains, supporting nondeterminism, discrete probabilistic choice as well as stochastic timing (Markovian rates). Later, the tool IMCA was developed to compute time-bounded reachability probabilities, expected times and long-run averages for sets of goal states within an MA. However, an efficient formalism for modelling and generating MAs was still lacking. Additionally, the omnipresent state space explosion also threatened the analysability of these models. This thesis solves the first problem and contributes significantly to the solution of the second.

show abstract

Abstract graph transformation

Zambon

View full text Add to dashboard Cite

IT architecture-based confidentiality risk assessment in networks of organizations

Cited by 7 publications

References 74 publications

Risk and Business Goal Based Security Requirement and Countermeasure Prioritization

Risk and Business Goal Based Security Requirement and Countermeasure Prioritization

Efficient modelling, generation and analysis of Markov Automata

Abstract graph transformation

Contact Info

Product

Resources

About