Expansion and Practical Implementation of the MFC Cybersecurity Model via a Novel Security Requirements Taxonomy

2015 ◽  
Vol 6 (4) ◽  
pp. 32-51 ◽  
Author(s):  
Neila Rjaibi ◽  
Latifa Ben Arfa Rabai
Keyword(s):  
Risk Management ◽  
Cyber Security ◽  
Management Practices ◽  
Linear Models ◽  
Cost Model ◽  
Security Requirements ◽  
Practical Implementation ◽  
Security Threats ◽  
Security Risk ◽  
Failure Cost

In security risk management practices if we cannot measure, we can neither control nor improve. A challenging issue in the context of cyber security is to deal with the orthogonal classification of security requirements. A literature review has shown that there are different models of security requirements. Everyone examines some requirements and neglects others. In this paper, the authors intend to answer the question: what taxonomy of security requirements should we use in a security quantification process? It is thus imperative to build a standard, unified and hierarchical taxonomy which incorporates 13 security requirements and then refined in layer into 31 sub-factors referring to the variety of the proposed models based on previous works. The Mean Failure Cost model (MFC) is a recent, strong and structural risk management model. It is a cascade of linear models to quantify security threats in term of loss that results from system's vulnerabilities. It computes for each system's stakeholders his loss of operation ($/H) while taking account of its respective users, security requirements, system's components and the complete list of security threats. The proposed taxonomy is used to optimize quantification using the MFC metric by reducing the redundancy in estimating the security requirements values, and increasing accuracy in estimation. The authors applied the expansion of the MFC model to the context of e-learning platforms.

The Mean Failure Cost Cybersecurity Model to Quantify Security in E-Learning Environments

2016 ◽  
pp. 95-120
Author(s):  
Neila Rjaibi ◽  
Latifa Ben Arfa Rabai ◽  
Ali Mili
Keyword(s):  
Risk Management ◽  
Cyber Security ◽  
Learning Systems ◽  
Security Requirements ◽  
Security Threats ◽  
Security Risk ◽  
Failure Cost ◽  
E Learning ◽  
The Mean ◽  
Security Risk Management

This chapter presents an overview of security challenges in e-Learning systems, and discusses a recent review related research on security risk management approaches in e-Learning to give a proper context to our work. The literature review proves a lack in quantitative security risk management models applied to e-learning system and presents the strengths of the Mean Failure Cost model in quantifying security threats with a financial risk measure. Moreover, we focus on presenting security aspects of e-Learning applications, and analyze its respective stakeholders, security requirements, architectural components and threats. The Mean Failure Cost (MFC) cyber security measure suitable for e-Learning systems is defined and computed. We adapt it to quantify security threats and risk within e-learning systems. It is based on the identification of system's architecture, the well-defined classes of stakeholders, the list of possible threats and vulnerabilities and the specific security requirements related to e-Learning systems and applications.

The Rigorous Security Risk Management Model

2018 ◽  
pp. 1299-1317
Author(s):  
Neila Rjaibi ◽  
Latifa Ben Arfa Rabai
Keyword(s):  
Risk Management ◽  
Cyber Security ◽  
Linear Models ◽  
Management Model ◽  
Security Risk ◽  
Security Threat ◽  
Risk Management Process ◽  
Failure Cost ◽  
The Mean ◽  
Security Risk Management

This chapter presents the security concepts terminologies (threat, risk, security risk management, security risk management process, security threat model) and present the state of the art of security risk management models, compare and discuss strengths and weaknesses of such models. Then it presents the Mean Failure Cost (MFC) model for quantifying security threats as a rigorous measure of cyber security, and as a cascade of linear models in order to estimate the system security using the loss of a given stakeholders as a result of security breakdown. Finally it presents an overview of the applicability of the MFC measure to e-systems. In the conclusion, the chapter criticizes the MFC Cyber Security Measure and presents an overview of different perspectives.

The Rigorous Security Risk Management Model

2018 ◽  
pp. 452-470
Author(s):  
Neila Rjaibi ◽  
Latifa Ben Arfa Rabai
Keyword(s):  
Risk Management ◽  
Cyber Security ◽  
Linear Models ◽  
Management Model ◽  
Security Risk ◽  
Security Threat ◽  
Risk Management Process ◽  
Failure Cost ◽  
The Mean ◽  
Security Risk Management

This chapter presents the security concepts terminologies (threat, risk, security risk management, security risk management process, security threat model) and present the state of the art of security risk management models, compare and discuss strengths and weaknesses of such models. Then it presents the Mean Failure Cost (MFC) model for quantifying security threats as a rigorous measure of cyber security, and as a cascade of linear models in order to estimate the system security using the loss of a given stakeholders as a result of security breakdown. Finally it presents an overview of the applicability of the MFC measure to e-systems. In the conclusion, the chapter criticizes the MFC Cyber Security Measure and presents an overview of different perspectives.

The Rigorous Security Risk Management Model

2015 ◽  
pp. 84-101 ◽  
Author(s):  
Neila Rjaibi ◽  
Latifa Ben Arfa Rabai
Keyword(s):  
Risk Management ◽  
Cyber Security ◽  
Linear Models ◽  
Management Model ◽  
Security Risk ◽  
Security Threat ◽  
Risk Management Process ◽  
Failure Cost ◽  
The Mean ◽  
Security Risk Management

This chapter presents the security concepts terminologies (threat, risk, security risk management, security risk management process, security threat model) and present the state of the art of security risk management models, compare and discuss strengths and weaknesses of such models. Then it presents the Mean Failure Cost (MFC) model for quantifying security threats as a rigorous measure of cyber security, and as a cascade of linear models in order to estimate the system security using the loss of a given stakeholders as a result of security breakdown. Finally it presents an overview of the applicability of the MFC measure to e-systems. In the conclusion, the chapter criticizes the MFC Cyber Security Measure and presents an overview of different perspectives.

scholarly journals Methodology and algorithm of information security risk management for local infrastructure

2018 ◽  
Vol 325 ◽  
pp. 399-410
Author(s):  
Bulai Rodica ◽  
Ciorbă Dumitru ◽  
Poştaru Andrei ◽  
Rostislav Călin
Keyword(s):  
Risk Management ◽  
Information Security ◽  
Risk Analysis ◽  
Management Practices ◽  
Security Requirements ◽  
Security Risk ◽  
Information Management Systems ◽  
Efficient Information ◽  
Information Security Risk ◽  
Security Risk Management

The complexity of information security does not resume to mere technicality, transferring significant liability to proper management. Risk analysis in information security is a powerful tool that comes in handy for managers in making decisions about the implementation of efficient information management systems, in order to achieve the organization's mission. As a part of risk management, risk analysis is the systematic implementation of methods, techniques and management practices to assess the context, identify, analyze, evaluate, treat, monitor and communicate the risks for the information security and systems through which they are processed, stored or transmitted. The ISO/IEC 27005:2011 – Information security risk management, does not specify any particular method for managing the risks associated with information security, but a general approach. It is up to the organization to devise control objectives that would reflect specific approaches to risk management and the degree of assurance required. There are several models, methodologies and tools amongst which those like CRAMM (United Kingdom, Insight Consulting), Risicare/Mehari (France, Clusif), GSTool (Germany, ITGrundschutz). The theoretical model of the mentioned methodologies is hard to put in practice without experience required from the members of the risk analysis team. Using the appropriate risk assessment solution, an organization can devise its own security requirements.

A Multi-Dimensional Mean Failure Cost Model to Enhance Security of Cloud Computing Systems

2019 ◽  
pp. 211-225
Author(s):  
Mouna Jouini ◽  
Latifa Ben Arfa Rabai
Keyword(s):  
Cloud Computing ◽  
Cost Model ◽  
Quantitative Model ◽  
Security Risk ◽  
Computing Systems ◽  
Security Breaches ◽  
On Demand ◽  
Cloud Computing Adoption ◽  
Failure Cost ◽  
Security Risk Assessment

Cloud computing technology is a relatively new concept of offering reliable and virtualized resources, software and hardware on demand to users. It presents a new technology to deliver computing resources as a service. It allows several benefits for example services on demand, provisioning, shared resources and pay per use and suffers from several challenges. In fact, security presents a major obstacle in cloud computing adoption. In this paper, the authors will deal with security problems in cloud computing systems and estimate security breaches using a quantitative security risk assessment model. Finally, the authors use this quantitative model to solve these problems in cloud environments.

A Multi-Dimensional Mean Failure Cost Model to Enhance Security of Cloud Computing Systems

2016 ◽  
Vol 7 (2) ◽  
pp. 1-14 ◽  
Author(s):  
Mouna Jouini ◽  
Latifa Ben Arfa Rabai
Keyword(s):  
Cloud Computing ◽  
Cost Model ◽  
New Technology ◽  
Quantitative Model ◽  
Assessment Model ◽  
Security Risk ◽  
Shared Resources ◽  
Computing Systems ◽  
On Demand ◽  
Failure Cost

Cloud computing technology is a relatively new concept of offering reliable and virtualized resources, software and hardware on demand to users. It presents a new technology to deliver computing resources as a service. It allows several benefits for example services on demand, provisioning, shared resources and pay per use and suffers from several challenges. In fact, security presents a major obstacle in cloud computing adoption. In this paper, the authors will deal with security problems in cloud computing systems and estimate security breaches using a quantitative security risk assessment model. Finally, the authors use this quantitative model to solve these problems in cloud environments.

Sign in / Sign up

Export Citation Format

Share Document