A framework for estimating information security risk assessment method completeness

Abstract

In general, an information security risk assessment (ISRA) method produces risk estimates, where risk is the product of the probability of occurrence of an event and the associated consequences for the given organization. ISRA practices vary among industries and disciplines, resulting in various approaches and methods for risk assessments. There exist several methods for comparing ISRA methods, but these are scoped to compare the content of the methods to a predefined set of criteria, rather than process tasks to be carried out and the issues the method is designed to address. It is the lack of an all-inclusive and comprehensive comparison that motivates this work. This paper proposes the Core Unified Risk Framework (CURF) as an all-inclusive approach to compare different methods, all-inclusive since we grew CURF organically by adding new issues and tasks from each reviewed method. If a task or issue was present in surveyed ISRA method, but not in CURF, it was appended to the model, thus obtaining a measure of completeness for the studied methods. The scope of this work is primarily functional approaches risk assessment procedures, which are the formal ISRA methods that focus on assessments of assets, threats, vulnerabilities, and protections, often with measures of probability and consequence. The proposed approach allowed for Digital Security Section, NTNU, Teknologiveien 22, 2815 Gjøvik, Norway a detailed qualitative comparison of processes and activities in each method and provided a measure of completeness. This study does not address aspects beyond risk identification, estimation, and evaluation; considering the total of all three activities, we found the "ISO/IEC 27005 Information Security Risk Management" to be the most complete approach at present. For risk estimation only, we found the Factor Analysis of Information Risk and ISO/IEC 27005:2011 as the most complete frameworks. In addition, this study discovers and analyzes several gaps in the surveyed methods.

Information Security Risk Assessment: A Method Comparison

“…This scheme makes them less suited for analyzing cause-effect relationships between method and results, since causes not present in the criteria may be neglected. The CURF bottom-up approach [5] solves this problem by mapping ISRA method content and using it as comparison criteria. For each added method reviewed in CURF, we identify which tasks the approach covers and combine all the tasks covered by all surveyed methods into a combined set.…”

“…The row scores reveal how well the ISRA methods scored overall. The three ISRA methods included in this study was also used as input for developing CURF (see [5]), following is a summary of each method and their differences.…”

“…It centers on assets, threats, controls, vulnerabilities, consequences, and likelihood. The ISO27005 scored the highest on the ISRA completeness measurement [5], Table I. We chose to include the ISO/IEC 27005:2011 as it is regarded as the best practice standard for ISRM.…”

“…The data for this study was collected through multiple risk assessment case studies in a Norwegian academic institution. Firstly, we apply the results from Core Unified Risk Framework (CURF) [5] to define distinctiveness of each method. Secondly, we collect and analyze experience data from ISRA groups.…”

An initial insight into Information Security Risk Assessment practices

“…There several tasks that are common when conducting an ISRAn [17], we gathered the common denominators and asked the participants to rate them according to their importance, 1 -Not important to 6 -Very important. Table XIV displays the results, with no notable difference between any groups.…”