Position Paper: Privacy Risk Analysis Is about Understanding Conflicting Incentives

Snekkenes, Einar

doi:10.1007/978-3-642-37282-7_9

Cited by 10 publications

(9 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In addition, CURF contains one review of both a Privacy and a Cloud risk assessment method. The following is a summary of the eleven methods: CIRA is a risk assessment method developed primarily by Rajbhandari [117] and Snekkenes [134]. CIRA frames risk regarding conflicting incentives between stakeholders, such information asymmetry situations and moral hazard situations.…”

Section: Reviewed Methodsmentioning

confidence: 99%

Cyber Security Risk Assessment of a DDoS Attack

Wangen¹,

Shalaginov²,

Hallstensen³

2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Section: Reviewed Methodsmentioning

confidence: 99%

Cyber Security Risk Assessment of a DDoS Attack

Wangen¹,

Shalaginov²,

Hallstensen³

2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

“…The Conflicting Incentives Risk Analysis (CIRA) method focuses on the motivation of individual stakeholders to define risks. The lack of relevant historical data in case of emerging and dynamic systems creates a significant challenge for traditional (i.e., relying on frequentist probability estimations) risk analysis methods [37]. Furthermore, deliberate human actions due to misalignment of incentives is rarely at the center of risk analysis procedures.…”

Section: Conflicting Incentives Risk Analysis (Cira)mentioning

confidence: 99%

Representing Decision-Makers in SGAM-H: The Smart Grid Architecture Model Extended with the Human Layer

Szekeres

Snekkenes

2020

Graphical Models for Security

Self Cite

View full text Add to dashboard Cite

The safety and security of critical infrastructures is both a technical and a social issue. However, most risk analysis methods focus predominantly on technical aspects and ignore the impact strategic human decisions have on the behavior of systems. Furthermore, the high degree of complexity and lack of historical data for probability estimations in case of new and emerging systems seriously limit the practical utility of traditional risk analysis methods. The Conflicting Incentives Risk Analysis (CIRA) method concentrates on human decisionmakers to address these problems. However, the method's applicability is restricted by the fact that humans are not represented in the Smart Grid Architecture Model (SGAM) which is the industry's most well-known model of the Smart Grid ecosystem. Therefore, the main objective of this paper is to establish a connection between CIRA and SGAM by proposing the SGAM-H, an enhanced version of the original architecture model complemented by the Human Layer. The development and evaluation of the artifact is guided by the Design Science Research methodology. The evaluation presents a working example of applying the CIRA method on a scenario involving intra-organizational risks at a Distribution System Operator. The key benefit of the SGAM-H is that it enables the construction of a common understanding among stakeholders about risks related to key decision-makers, which is a fundamental first step towards forming a more complete picture about potential issues affecting the electric grids of the future.

show abstract

“…It was developed on the base of game theory, economics and psychology. CIRA is developed by Rajbhandari [48] and Snekkeness [49]. There are two classes of owners in CIRA i.e.…”

Section: Conflicting Incentives Risk Analysis (Cira)mentioning

confidence: 99%

Agent Based Information Security Framework for Hybrid Cloud Computing

2019

KSII TIIS

View full text Add to dashboard Cite

In general, an information security approach estimates the risk, where the risk is to occur due to an unusual event, and the associated consequences for cloud organization. Information Security and Risk Management (ISRA) practices vary among cloud organizations and disciplines. There are several approaches to compare existing risk management methods for cloud organizations but their scope is limited considering stereo type criteria, rather than developing an agent based task that considers all aspects of the associated risk. It is the lack of considering all existing renowned risk management frameworks, their proper comparison, and agent techniques that motivates this research. This paper proposes Agent Based Information Security Framework for Hybrid Cloud Computing as an all-inclusive method including cloud related methods to review and compare existing different renowned methods for cloud computing risk issues and by adding new tasks from surveyed methods. The concepts of software agent and intelligent agent have been introduced that fetch/collect accurate information used in framework and to develop a decision system that facilitates the organization to take decision against threat agent on the basis of information provided by the security agents. The scope of this research primarily considers risk assessment methods that focus on assets, potential threats, vulnerabilities and their associated measures to calculate consequences. After in-depth comparison of renowned ISRA methods with ABISF, we have found that ISO/IEC 27005:2011 is the most appropriate approach among existing ISRA methods. The proposed framework was implemented using fuzzy inference system based upon fuzzy set theory, and MATLAB® fuzzy logic rules were used to test the framework. The fuzzy results confirm that proposed framework could be used for information security in cloud computing environment.

show abstract

Position Paper: Privacy Risk Analysis Is about Understanding Conflicting Incentives

Abstract: We motivate and give a brief overview of the Conflicting Incentives Risk Analysis (CIRA) method, explaining key ideas and concepts, offering a small example and give an overview of remaining challenges in relation to the use of CIRA in large scale risk analysis projects.

Cited by 10 publications

References 5 publications

Cyber Security Risk Assessment of a DDoS Attack

Cyber Security Risk Assessment of a DDoS Attack

Representing Decision-Makers in SGAM-H: The Smart Grid Architecture Model Extended with the Human Layer

Agent Based Information Security Framework for Hybrid Cloud Computing

Contact Info

Product

Resources

About