Towards a conceptual definition for IT assets through interrogating their nature and epistemic uncertainty

Adesemowo, A. Kayode

doi:10.1016/j.cose.2020.102131

Cited by 10 publications

(5 citation statements)

References 61 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Unfortunately, this approach emphasizes more the physical relationship of assets; it cannot map the involvement of assets to organizational processes. Adesemowo [17] then concludes that it is still not sufficient for the current state of ISRA. We prove AMin has overcome this gap by integrating ISRA with process mining.…”

Section: B Discussionmentioning

confidence: 99%

“…Incorrect identification will lead to inaccurate ISRA results [13], [14]. Making this one of ISRA's crucial steps [17], [18]. This activity is still done manually, depending on the model adopted or proposed.…”

Section: Introductionmentioning

confidence: 99%

“…This activity is still done manually, depending on the model adopted or proposed. Asset identification in its current form is inadequate for risk assessment [17]. We can see this through both ISRA perspectives, asset and process-oriented [12], [13].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Asset Identification in Information Security Risk Assessment Using Process Mining

Yunizal¹,

Santoso²,

Surendro³

2022

International Journal on Advanced Science, Engineering and Information Technology

View full text Add to dashboard Cite

Information security risk assessment (ISRA) currently has gaps in inadequate asset identification. This activity is still manual, depending on the approach adopted and used, thus leading to subjectivity and inaccuracies. Whereas incorrect identification will lead to inaccurate results. The need to consider the dependency of assets within ISRA, which is still not resolved by ISRA, complicates this. A process perspective that can view assets based on their role in organizational processes rather than physical connections should be able to bridge this gap. Unfortunately, Small and Medium Enterprises (SME) find it difficult to take advantage of this opportunity due to time and cost constraints. This research bridges this gap by providing a process-oriented perspective that uses process mining. It automates asset identification based on historically derived organizational workflows using Legacy Information Systems (LIS) triggers. For rigor and relevance, this research uses a series of design research evaluation stages: problem, design, construct, and usage. Problem evaluation is through the study of related literature. For design evaluation, it made comparisons with asset and process-oriented ISRA and preprocessing of process mining. The construct evaluation by testing the system before and after method implementation. It also considers the method's maximum capability. Meanwhile, usage evaluation through a case study on an inventory system. The contribution offered: (1) integrating process mining with ISRA, (2) making the process-aware LIS without disturbing the running process, (3) preparing an artifact to generate an event log using database trigger, and (4) automating ISRA's asset identification which also considers asset dependency.

show abstract

Section: B Discussionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Asset Identification in Information Security Risk Assessment Using Process Mining

Yunizal¹,

Santoso²,

Surendro³

2022

International Journal on Advanced Science, Engineering and Information Technology

View full text Add to dashboard Cite

show abstract

“…The experimental procedure was carried out with 4 security experts from 3 different institutions (Adesemowo, 2020). The experts were gotten from financial institution and IT organizations.…”

Section: Methodsmentioning

confidence: 99%

“…This study models a framework that will systematically classify, assess and label company's information assets in compliance with ISO 27001 based on the owner's security requirements. Our framework is also important considering that the ISO 2700x family of standards no longer have definition for information asset since 2014 nor for IT assets (Adesemowo et al, 2016), especially as the debate on nature of information assets, IT assets and digital technologies rages on (Adesemowo, 2020;Baskerville et al, 2020).…”

Section: Introductionmentioning

confidence: 99%

A Fuzzy Based Classification and Labelling Framework for Effective Information Assets Security Risk Assessment

Alonge,

Adesemowo,

Mustapha

et al. 2023

Preprint

View full text Add to dashboard Cite

This study explores the pressing problem of security risk classification of information assets, which is a significant concern for businesses due to the lack of an efficient system aligning with information security standards and accounting for users’ preferences. Current strategies such as manual methods and machine learning techniques have shown limitations in effectiveness. The research introduces a Fuzzy-based Information Asset Classification and Labeling (FIACL) framework, implemented according to the ISO/IEC 27001 security standard. The FIACL framework consists of six key phases, namely, information asset classification, fuzzy inference system, information asset labelling, information security risk assessment, information asset handling, and storage. Data from various institutions were collected and utilised in assessing the FIACL's performance. The framework classified and labelled the information assets according to their security levels, followed by a risk assessment phase. Usability tests were performed using real datasets from the case studies and the Technology Acceptance Model. FIACL's performance was compared with an Expert based information classification system (ICS), demonstrating superior precision, recall, f-measure, and accuracy values (1.00, 0.89, 0.94, 0.89 respectively), indicating its improved efficiency in classifying information assets and mitigating security risks.

show abstract

Stock market reactions to favorable and unfavorable information security events: A systematic literature review

Ali

Lai

Dominic

et al. 2021

Computers & Security

View full text Add to dashboard Cite

Towards a conceptual definition for IT assets through interrogating their nature and epistemic uncertainty

Cited by 10 publications

References 61 publications

Asset Identification in Information Security Risk Assessment Using Process Mining

Asset Identification in Information Security Risk Assessment Using Process Mining

A Fuzzy Based Classification and Labelling Framework for Effective Information Assets Security Risk Assessment

Stock market reactions to favorable and unfavorable information security events: A systematic literature review

Contact Info

Product

Resources

About