Ranking information security controls by using fuzzy analytic hierarchy process

Khajouei, Hamid; Kazemi, Mostafa; Moosavirad, Seyed Hamed

doi:10.1007/s10257-016-0306-y

Cited by 24 publications

(12 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It spends the designated investment “ z ” to install new security devices, anti-virus software, intrusion detection system (IDS), firewalls, stringent access controls and upgrade existing ones. It also invests in the information security management system (ISMS) of the organization by employing security experts and framing relevant security policies (Khajouei et al , 2017). Based on the extant literature (Cavusoglu et al , 2008; Huang et al , 2008; Gao and Zhong, 2015; Gao et al , 2014; Gao et al , 2015; Gao and Zhong, 2016; Young et al , 2016; Li and Xu, 2020; Simon and Omar, 2020), we have considered different types of cybersecurity investments (such as an employee-level training, a new firewall or an advanced IDS infrastructure) under a single variable “ z ”.…”

Section: Model Definition and Assumptionsmentioning

confidence: 99%

Firm investment decisions for information security under a fuzzy environment: a game-theoretic approach

Gupta

Biswas

et al. 2020

ICS

View full text Add to dashboard Cite

Purpose This paper aims to examine optimal decisions for information security investments for a firm in a fuzzy environment. Under both sequential and simultaneous attack scenarios, optimal investment of firm, optimal efforts of attackers and their economic utilities are determined. Design/methodology/approach Throughout the analysis, a single firm and two attackers for a “firm as a leader” in a sequential game setting and “firm versus attackers” in a simultaneous game setting are considered. While the firm makes investments to secure its information assets, the attackers spend their efforts to launch breaches. Findings It is observed that the firm needs to invest more when it announces its security investment decisions ahead of attacks. In contrast, the firm can invest relatively less when all agents are unaware of each other’s choices in advance. Further, the study reveals that attackers need to exert higher effort when no agent enjoys the privilege of being a leader. Research limitations/implications In a novel approach, inherent system vulnerability of the firm, financial benefit of attackers from the breach and monetary loss suffered by the firm are considered, as fuzzy variables in the well-recognized Gordon – Loeb breach function, with the help of fuzzy expectation operator. Practical implications This study reports that the optimal breach effort exerted by each attacker is proportional to its obtained economic benefit for both sequential and simultaneous attack scenarios. A set of numerical experiments and sensitivity analyzes complement the analytical modeling. Originality/value In a novel approach, inherent system vulnerability of the firm, financial benefit of attackers from the breach and monetary loss suffered by the firm are considered, as fuzzy variables in the well-recognized Gordon – Loeb breach function, with the help of fuzzy expectation operator.

show abstract

Section: Model Definition and Assumptionsmentioning

confidence: 99%

Firm investment decisions for information security under a fuzzy environment: a game-theoretic approach

Gupta

Biswas

et al. 2020

ICS

View full text Add to dashboard Cite

show abstract

“…In a different, but more recent research study, [35] used fuzzy AHP to prioritize and select effective managerial domains and control objectives in information security controls. This research focused on the process of implementing ISO 27001 information security areas in the National Iranian Oil Products Distribution Company.…”

Section: Solution Approachmentioning

confidence: 99%

Untitled

2019

IJNSA

View full text Add to dashboard Cite

Information security necessitates the implementation of safeguards to guarantee an adequate defense against attacks, threats, and breaches from occurring. Nonetheless, even with "adequate" defensive efforts, the taste for accessing sensitive and confidential financial information is too tempting, and attacks continue to escalate. Organizations must plan ahead so that identified attacks, threats, and breaches are appropriately managed to a successful resolution. A proven method to address information security problems is achieved through the effective implementation of access security controls. This paper proposes a quantitative approach for organizations to evaluate access security controls over financial information using Analytic Hierarchy Process (AHP), and determines which controls best suit management's goals and objectives. Through a case study, the approach is proven successful in providing a way for measuring the quality of access security controls over financial information based on multiple application-specific criteria.

show abstract

“…Also, the diversity of data which is generated in the e-commerce business makes it more challenging to decipher results and provide decision making support dynamically. Thus, the need for strategic adoption of right tools of BDA is important (Khajouei et al, 2017).…”

mentioning

confidence: 99%

“…Earlier studies have also debated that the adoption of technologies is dependent largely on culture of the organization and fundamentally governed by the geography of operations of the firm (Khajouei et al, 2017). BDA is one of such technology which involves huge capital and the rate of success depends largely on stakeholders and organizational culture.…”

mentioning

confidence: 99%

A conceptual framework for the adoption of big data analytics by e-commerce startups: a case-based approach

Behl

Dutta

Lessmann

et al. 2019

Inf Syst E-Bus Manage

View full text Add to dashboard Cite

E-commerce start-ups have ventured into emerging economies and are growing at a significantly faster pace. Big Data has acted like a catalyst in their growth story. Big Data Analytics (BDA) has attracted e-commerce firms to invest in the tools and gain cutting edge over their competitors. The process of adoption of these BDA tools by ecommerce start-ups has been an area of interest as successful adoption would lead to better results. The present study aims to develop an interpretive structural model (ISM) which would act as a framework for efficient implementation of BDA. The study uses hybrid multi criteria decision making processes to develop the framework and test the same using a real-life case study. Systematic review of literature and discussion with experts resulted in exploring 11 enablers of adoption of BDA tools. Primary data collection was done from industry experts to develop an ISM framework and fuzzy MICMAC analysis is used to categorize the enablers of the adoption process. The framework is then tested by using a case study. Thematic clustering is performed to develop a simple ISM framework followed by fuzzy analytical network process (ANP) to discuss the association and ranking of enablers. The results indicate that access to relevant data forms the base of the framework and would act as the strongest enabler in the adoption process while the company rates technical skillset of employees as the most important enabler. It was also found that there is a positive correlation between the ranking of enablers emerging out of ISM and ANP. The framework helps in simplifying the strategies any e-commerce company would follow to adopt BDA in future.

show abstract

Ranking information security controls by using fuzzy analytic hierarchy process

Cited by 24 publications

References 13 publications

Firm investment decisions for information security under a fuzzy environment: a game-theoretic approach

Firm investment decisions for information security under a fuzzy environment: a game-theoretic approach

Untitled

A conceptual framework for the adoption of big data analytics by e-commerce startups: a case-based approach

Contact Info

Product

Resources

About