scholarly journals Application of Bayesian network in risk assessment for website deployment scenarios

2022 ◽  
Vol 2 (14) ◽  
pp. 3-16
Author(s):  
Vu Thi Huong Giang ◽  
Nguyen Manh Tuan
Keyword(s):  
Risk Assessment ◽  
Bayesian Network ◽  
Cyber Security ◽  
Rapid Development ◽  
Cyber Attacks ◽  
Security Risk ◽  
Security Testing ◽  
Security Risks ◽  
Web Based ◽  
Assessment Results

Abstract—The rapid development of web-based systems in the digital transformation era has led to a dramatic increase in the number and the severity of cyber-attacks. Current attack prevention solutions such as system monitoring, security testing and assessment are installed after the system has been deployed, thus requiring more cost and manpower. In that context, the need to assess cyber security risks before the deployment of web-based systems becomes increasingly urgent. This paper introduces a cyber security risk assessment mechanism for web-based systems before deployment. We use the Bayesian network to analyze and quantify the cyber security risks posed by threats to the deployment components of a website. First, the deployment components of potential website deployment scenarios are considered assets, so that their properties are mapped to specific vulnerabilities or threats. Next, the vulnerabilities or threats of each deployment component will be assessed according to the considered risk criteria in specific steps of a deployment process. The risk assessment results for deployment components are aggregated into the risk assessment results for their composed deployment scenario. Based on these results, administrators can compare and choose the least risky deployment scenario. Tóm tắt—Sự phát triển mạnh mẽ của các hệ thống trên nền tảng web trong công cuộc chuyển đổi số kéo theo sự gia tăng nhanh chóng về số lượng và mức độ nguy hiểm của các cuộc tấn công mạng. Các giải pháp phòng chống tấn công hiện nay như theo dõi hoạt động hệ thống, kiểm tra và đánh giá an toàn thông tin mạng được thực hiện khi hệ thống đã được triển khai, do đó đòi hỏi chi phí và nhân lực thực hiện lớn. Trong bối cảnh đó, nhu cầu đánh giá rủi ro an toàn thông tin mạng cho các hệ thống website trước khi triển khai thực tế trở nên cấp thiết. Bài báo này giới thiệu một cơ chế đánh giá rủi ro an toàn thông tin mạng cho các hệ thống website trước khi triển khai thực tế. Chúng tôi sử dụng mạng Bayes để phân tích và định lượng rủi ro về an toàn thông tin do các nguồn đe dọa khác nhau gây ra trên các thành phần triển khai của một website. Đầu tiên, các thành phần triển khai của các kịch bản triển khai website tiềm năng được mô hình hoá dưới dạng các tài sản, sao cho các thuộc tính của chúng đều được ánh xạ với các điểm yếu hoặc nguy cơ cụ thể. Tiếp đó, các điểm yếu, nguy cơ của từng thành phần triển khai sẽ được đánh giá theo các tiêu chí rủi ro đang xét tại mỗi thời điểm cụ thể trong quy trình triển khai. Kết quả đánh giá của các thành phần triển khai được tập hợp lại thành kết quả đánh giá hệ thống trong một kịch bản cụ thể. Căn cứ vào kết quả đánh giá rủi ro, người quản trị có thể so sánh các kịch bản triển khai tiềm năng với nhau để lựa chọn kịch bản triển khai ít rủi ro nhất.

Cyber security risks in globalized supply chains: conceptual framework

2020 ◽  
Vol 13 (1) ◽  
pp. 103-128 ◽  
Author(s):  
Shipra Pandey ◽  
Rajesh Kumar Singh ◽  
Angappa Gunasekaran ◽  
Anjali Kaushik
Keyword(s):  
Supply Chains ◽  
Cyber Security ◽  
Cyber Attacks ◽  
Point Of View ◽  
Mitigation Strategies ◽  
Future Research ◽  
Security Risk ◽  
Security Risks ◽  
Content Type ◽  
Efficiency And Effectiveness

Purpose The purpose of this study is to examine cyber security risks in globalized supply chains (SCs). It has been seen to have a greater impact on the performance of SCs. The information and communication technology of a firm, which enhances the efficiency and effectiveness in the SC, could simultaneously be the cause of vulnerabilities and exposure to security threats. Researchers have primarily focussed on the cyber-physical system (CPS) vulnerabilities impacting SC. This paper tries to categorize the cyber security risks occurring because of the SCs operating in CPS. Design/methodology/approach Based on the flow of information along the upstream and downstream SC, this paper tries to identify cyber security risks in the global SCs. It has further tried to categorize these cyber security risks from a strategic point of view. Findings This paper tries to identify the various cyber security risk and cyber-attacks in globalized SC for improving the performance. The 16 cyber security risks have been categorized into three categories, namely, supply risk, operational risk and demand risk. The paper proposes a framework consisting of different cyber-attacks across the information that flows in global SCs along-with suitable mitigation strategies. Research limitations/implications The paper presents the conceptual model of cyber security risks and cyber-attacks in globalized SCs based on literature review and industry experts. Further validation and scale development of these risks can be done through empirical study. Practical implications This paper provides significant managerial insights by developing a framework for understanding the cyber security risks in terms of the drivers of these risks and how to deal with them. From a managerial perspective, this framework can be used as a decision-making process while considering different cyber security risks across the stages of globalized SCs. Originality/value The major contribution of this study is the identification and categorization of cyber security risks across the global SCs in the digital age. Thus, this paper introduces a new phenomenon to the field of management that has the potential to investigate new areas of future research. Based on the categorization, the paper provides insights on how cyber security risks impact the continuity of SC operations.

scholarly journals Risk Level Calculation for IoT System

2021 ◽  
pp. 103-107
Author(s):  
Neelam Naik
Keyword(s):  
Risk Assessment ◽  
Medical Devices ◽  
Cyber Security ◽  
Computational Approach ◽  
Cyber Attacks ◽  
Risk Level ◽  
Security Risk ◽  
Risk Ranking ◽  
Security Risk Assessment ◽  
Level Calculation

Due to the complexity and heterogeneity of technology, devices, data and computation, Internet of Things (IoT) systems are vulnerable to the cyber-attacks. Many cyber security risk assessment frameworks dedicated to IoT systems are under study. This study introduces the unique risk ranking method by calculating risk impact and risk likelihood by quantifying them. This unique computational approach is applied in the context of medial domain to calculate risk ranking of two medical devices used in medical IoT-based system.

A Need for Cyber Security Creativity

2018 ◽  
pp. 192-211
Author(s):  
Harold Patrick ◽  
Ziska Fields
Keyword(s):  
Risk Assessment ◽  
Information Technology ◽  
Cyber Security ◽  
Data Analytics ◽  
Security Risk ◽  
Technology Advancement ◽  
Economic Markets ◽  
Security Risk Assessment

Information technology is rapidly increasing and evolving all the time in pursuit for better solutions and products for the digitized world. Technology advancement and greater connectivity has moved organizations to better economic markets for sustainability. Together with better technology and greater connectivity, cybercrime is swiftly growing on par with these developments. This chapter focuses on the cyber security landscape and threats faced by organizations. The growth and sophistication of cybercrime is stressed. Cyber security creative approaches security risk assessment, cloud collaboration and data analytics are provided. This chapter ends with propositions that security creative approaches should be used as a method of managing cybercrime and ensuring that the organization's sustainability and governance are improved.

Cyber Security Assessment of NPP I&C Systems

2020 ◽  
pp. 221-238
Author(s):  
Oleksandr Klevtsov ◽  
Artem Symonov ◽  
Serhii Trubchaninov
Keyword(s):  
Control Systems ◽  
Cyber Security ◽  
Nuclear Power ◽  
Power Plants ◽  
Cyber Attacks ◽  
Security Assessment ◽  
Nuclear Facilities ◽  
Security Risks ◽  
Cyber Threats ◽  
And Control

The chapter is devoted to the issues of cyber security assessment of instrumentation and control systems (I&C systems) of nuclear power plants (NPP). The authors examined the main types of potential cyber threats at the stages of development and operation of NPP I&C systems. Examples of real incidents at various nuclear facilities caused by intentional cyber-attacks or unintentional computer errors during the maintenance of the software of NPP I&C systems are given. The approaches to vulnerabilities assessment of NPP I&C systems are described. The scope and content of the assessment and periodic reassessment of cyber security of NPP I&C systems are considered. An approach of assessment to cyber security risks is described.

Classification and characterization of US consumers based on their perceptions of risk of tablet use in international hotels

2019 ◽  
Vol 10 (3) ◽  
pp. 233-254 ◽  
Author(s):  
Cristian Morosan ◽  
Agnes DeFranco
Keyword(s):  
Cyber Security ◽  
Risk Perceptions ◽  
Latent Profile Analysis ◽  
Profile Analysis ◽  
Cyber Attacks ◽  
Security Risk ◽  
Content Type ◽  
Perceptions Of Risk ◽  
Using Data

Purpose Cyber-attacks on hotel information systems could threaten the privacy of consumers and the integrity of the data they exchange upon connecting their mobile devices to hotel networks. As the perceived cyber-security risk may be reflected heterogeneously within the US consumer population traveling internationally, the purpose of this study is to examine such heterogeneity to uncover classes of US consumers based on their perceptions of risk of using tablets for various tasks when staying in hotels abroad. Design/methodology/approach Using data collected from 1,016 US consumers who stayed in hotels abroad, this study used latent profile analysis (LPA) to classify the consumers based on their perceptions of risk associated with several tablet use behaviors in hotels. Findings The analysis uncovered four latent classes and produced a characterization of these classes according to several common behavioral (frequency of travel, the continent of the destination, duration of stay and purpose of travel) and demographic (gender, age, income and education) consumer characteristics. Originality/value Being the first study that classifies consumers based on the risk of using tablets in hotels while traveling internationally, this study brings the following contributions: offers a methodology of classifying (segmenting) consumer markets based on their cyber-security risk perceptions, uses LPA, which provides opportunities for an accurate and generalizable characterization of multivariate data that comprehensively illustrate consumer behavior and broadens the perspective offered by the current literature by focusing on consumers who travel from their US residence location to international destinations.

An Approach for Intentional Modeling of Web Services Security Risk Assessment

2007 ◽  
pp. 363-379
Author(s):  
Subhas C. Misra ◽  
Vinod Kumar ◽  
Uma Kumar
Keyword(s):  
Risk Assessment ◽  
Web Services ◽  
Conceptual Modeling ◽  
Security System ◽  
Security Risk ◽  
Security Risks ◽  
Early Stages ◽  
Modeling Approach ◽  
Web Services Security ◽  
Security Risk Assessment

In this chapter, we provide a conceptual modeling approach for Web services security risk assessment that is based on the identification and analysis of stakeholder intentions. There are no similar approaches for modeling Web services security risk assessment in the existing pieces of literature. The approach is, thus, novel in this domain. The approach is helpful for performing means-end analysis, thereby, uncovering the structural origin of security risks in WS, and how the root-causes of such risks can be controlled from the early stages of the projects. The approach addresses “why” the process is the way it is by exploring the strategic dependencies between the actors of a security system, and analyzing the motivations, intents, and rationales behind the different entities and activities in constituting the system.

Sign in / Sign up

Export Citation Format

Share Document