Research on the calculation method of information security risk assessment considering human reliability

Gu, Tingyang; Li, Luyi; Lu, Minyan; Li, Jiao

doi:10.1109/icrms.2014.7107238

Cited by 4 publications

(3 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…HRA involves the use of qualitative and quantitative methods to assess the human contribution to risk and has been used within high reliability industries such as petro-chemical, nuclear and aviation [32]. According to Gu et al [33] human reliability is a term used to describe human performance such as the ability of a human to complete a given task without any errors in given conditions in a given time period. Gu et al [33] also states that the human factors of people involved in information security can be categorised into cognition, physiology, psychology and ability and also demonstrates how incorporating HRA in to the risk assessment function significantly affects the risk assessment output.…”

Section: Measurement and Assessmentmentioning

confidence: 99%

“…According to Gu et al [33] human reliability is a term used to describe human performance such as the ability of a human to complete a given task without any errors in given conditions in a given time period. Gu et al [33] also states that the human factors of people involved in information security can be categorised into cognition, physiology, psychology and ability and also demonstrates how incorporating HRA in to the risk assessment function significantly affects the risk assessment output. This could subsequently affect the resultant activity taken by an organisation and again emphasises the importance of reliable assurance activities and information.…”

Section: Measurement and Assessmentmentioning

confidence: 99%

See 1 more Smart Citation

Human behaviour as an aspect of cybersecurity assurance

Evans

Μαγλαράς

et al. 2016

Security Comm Networks

105

View full text Add to dashboard Cite

There continue to be numerous breaches publicised pertaining to cybersecurity despite security practices being applied within industry for many years. This paper is intended to be the first in a number of papers as research into cybersecurity assurance processes. This paper is compiled based on current research related to cybersecurity assurance and the impact of the human element on it. The objective of this work is to identify elements of cybersecurity that would benefit from further research and development based on the literature review findings. The results outlined in this paper present a need for the cybersecurity field to look in to established industry areas to benefit from effective practices such as human reliability assessment, along with improved methods of validation such as statistical quality control in order to obtain true assurance. The paper proposes the development of a framework that will be based upon defined and repeatable quantification, specifically relating to the range of human aspect tasks that provide or are intended not to negatively affect cybersecurity assurance.

show abstract

Section: Measurement and Assessmentmentioning

confidence: 99%

Section: Measurement and Assessmentmentioning

confidence: 99%

Human behaviour as an aspect of cybersecurity assurance

Evans

Μαγλαράς

et al. 2016

Security Comm Networks

105

View full text Add to dashboard Cite

show abstract

“…However, the developed and empirically validated [21], [22] Information Security Core Human Error Causes (IS-CHEC) information security HRA technique had so far only been used reactively in relation to reported information security incidents in healthcare. As stated by Gu et al [29] human reliability should be extended to address the entire information security risk management function. There is currently no published information security HRA technique or method that is designed to proactively interact directly with employees in order to identify potential causes of human error which may result in an information security incident and the associated risk exposure.…”

Section: Introductionmentioning

confidence: 99%

Employee Perspective on Information Security Related Human Error in Healthcare: Proactive Use of IS-CHEC in Questionnaire Form

Evans

Luo

et al. 2019

IEEE Access

View full text Add to dashboard Cite

The objective of the research was to establish data relating to underlying causes of human error which are the most common cause of information security incidents within a private sector healthcare organization. A survey questionnaire was designed to proactively apply the IS-CHEC information security human reliability analysis (HRA) technique. The IS-CHEC technique questionnaire identified the most likely core human error causes that could result in incidents, their likelihood, the most likely tasks that could be affected, suggested remedial and preventative measures, systems or processes that would be likely to be affected by human error and established the levels of risk exposure. The survey was operational from 15th November 2018 to 15th December 2018. It achieved a response rate of 65% which equated to 485 of 749 people targeted by the research. The research found that, in the case of this particular participating organization, the application of the IS-CHEC technique through a questionnaire added beneficial value as an enhancement to a standard approach of holistic risk assessment. The research confirmed that the IS-CHEC in questionnaire form can be successfully applied within a private sector healthcare organization and also that a distributed approach for information security human error assessment can be successfully undertaken in order to add beneficial value. The results of this paper indicate, from the questionnaire responses supplied by employees, that organizational focus on its people and their working environment can improve information security posture and reduce the likelihood of associated information security incidents through a reduction in human error. INDEX TERMSHuman error assessment and reduction technique (HEART), human error related information security incidents, human reliability analysis (HRA), information security, IS-CHEC.

show abstract