Risk Assessment Model of Information Security for Transportation Industry System Based on Risk Matrix

Abstract

Risk assessment is a vital part of classification protection system for transportation industry system information security. In this paper, an information security risk assessment model based on risk matrix was put forward for heterogeneous-based transportation industry system. The risk matrix method was brought into assessment system. Then an accurate risk assessment model was constructed. In this model, there were three critical modules, such as expert 2-dimension matrix, Borda sequence and gray analytical hierarchy process. In this assessment system, qualitative analysis was firstly processed. Those three modules have quantitative feature, so the assessment results described by words before can be denoted by numbers. The final quantitative results were obtained by related equations. This model was put into practical application of transportation security decision support system for emergency response, and the application results indicate that this model can increase the objectivity of the assessment.

Risk assessment of information production using extended risk matrix approach

“…Borda method is also developed to improve risk matrix precision, although this effort cannot eliminate risk ties completely [13]. There are also some proposed risk calculation algorithm to improve objectivity of assessment process [14]. All of these developments are relied on the original published risk matrix where matrix dimension is limited to two dimension and for many cases this limitation create inflexibility in risk assessment problem and requirements [10].…”

“…In Bayesian conditional probability, a prior opportunity represents a trust distribution reflecting the amount of initial trust of agents contributing to the hypothesis of an event [23]. In general, to calculate this probability value we refer to GB/T 20984-2007 [14,24]. The detail of calculation of probability of risk factor and risk profile can be derived in the following steps.…”

“…To calculate each likelihood and impact of each threat, we refer to [14]. Likelihood of threat risk (𝑓 1 ) is a function of threat and vulnerability, while impact of threat risk (𝑓 2 ) is a function of asset and vulnerability [14]. To calculate (𝑓 1 ), we are using formula and weight (notation 𝛼 and 𝛽) from [14] as in (7).…”

A systematic review of information security risk assessment

“…For instance, E-government [14], supply chain management [15], E-health [16], E-science [17], student performance [18], chlorine processing system [19], transportation industry [20], power systems [21], cloud computing [22][23][24][25], mobile applications [26] and so on. The development of ISRA in these industries illustrates that ISRA is becoming increasingly important not only traditional industries, but also other emerging domains such as mobile and cloud computing.…”

“…For instance, Karaba-cak and Sogukpinar apply the real-life statistical data of a survey as input data to analyse risks properly [38]. Moreover, three papers [20,36,42] adopt the expert's assessment as the input data and then use the AHP or fuzzy theory to reduce the subjectivity of these input data.…”