Risk Assessment Method Based on Business Process-Oriented Asset Evaluation for Information System Security

Abstract

Abstract. We presented risk assessment methodology focused on business-process oriented asset evaluation and qualitative risk analysis method. The business process-oriented asset evaluation is to evaluate asset's value by the degree of asset contribution related to business process. Namely, asset's value is different according to the importance of department to which asset belongs, the contribution of asset's business, and security safeguard, etc. We proposed new asset's value evaluation applied to the weight of above factors. The weight is decided by evaluation matrix by Delphi team. We assess risk by qualitative method applied to the improved international standard method which is added the effectiveness of operating safeguard at information system. It reflects an assumption that they can reduce risk level when existent safeguards are established appropriately. Our model derives to practical risk assessment method than existent risk assessment method, and improves reliability of risk analysis.

An Improved AHP Based Quantitative Method for Host Network Risk Evaluation

“…Compared to the existing risk evaluation, the system in the paper has the following advantages:(1) The quantified risk value can present the fairly accurate risk value. (2) The improved AHP method is used to calculate the primary and second layer factors in network security system, which enhances the evaluation accuracy. (3) New evaluation factor system is constructed.…”

Risk assessment for a video surveillance system based on Fuzzy Cognitive Maps

“…Eom, Park and Han introduced a risk assessment method based on asset valuation and quantification [19]. Baudrit and Dubios proposed a risk assessment method taking into account two types of uncertainty: randomness and imprecision [6].…”

A new lightweight method for security risk assessment based on fuzzy cognitive maps

“…Han et al (2004) described an expansible vulnerability model in order to qualitatively assess the security of an active network and active nodes, aiming at solving a problem that is more suited for an active network than a traditional one. Eom et al (2007) introduced a risk assessment method based on asset valuation and quantification. Baudrit et al (2006) proposed a risk assessment method of node transmission and possibility exposure.…”