A quantitative framework for dependency-aware organizational IT Risk Management

Schmidt, Stephan; Albayrak, Şahin

doi:10.1109/isda.2010.5687022

Cited by 7 publications

(5 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Design objective 1 2 3 4 5 6 7 8 9 ISRA asset-oriented [9], [14], [18], [20], [45]          ISRA process-oriented [4], [13], [21], [22]          Preprocessing process mining [31] …”

Section: Researchmentioning

confidence: 99%

See 1 more Smart Citation

Asset Identification in Information Security Risk Assessment Using Process Mining

Yunizal¹,

Santoso²,

Surendro³

2022

International Journal on Advanced Science, Engineering and Information Technology

View full text Add to dashboard Cite

Information security risk assessment (ISRA) currently has gaps in inadequate asset identification. This activity is still manual, depending on the approach adopted and used, thus leading to subjectivity and inaccuracies. Whereas incorrect identification will lead to inaccurate results. The need to consider the dependency of assets within ISRA, which is still not resolved by ISRA, complicates this. A process perspective that can view assets based on their role in organizational processes rather than physical connections should be able to bridge this gap. Unfortunately, Small and Medium Enterprises (SME) find it difficult to take advantage of this opportunity due to time and cost constraints. This research bridges this gap by providing a process-oriented perspective that uses process mining. It automates asset identification based on historically derived organizational workflows using Legacy Information Systems (LIS) triggers. For rigor and relevance, this research uses a series of design research evaluation stages: problem, design, construct, and usage. Problem evaluation is through the study of related literature. For design evaluation, it made comparisons with asset and process-oriented ISRA and preprocessing of process mining. The construct evaluation by testing the system before and after method implementation. It also considers the method's maximum capability. Meanwhile, usage evaluation through a case study on an inventory system. The contribution offered: (1) integrating process mining with ISRA, (2) making the process-aware LIS without disturbing the running process, (3) preparing an artifact to generate an event log using database trigger, and (4) automating ISRA's asset identification which also considers asset dependency.

show abstract

Section: Researchmentioning

confidence: 99%

“…Khanmohammadi and Houmb [21] emphasize collecting workflows and identifying the assets involved. Schmidt and Albayrak [22] identify assets and dependencies by requesting experts and asset managers. Shedden et al [13] answered with document analysis, seeing work directly, and semi-structured interviews with organizational actors.…”

Section: Introductionmentioning

confidence: 99%

Asset Identification in Information Security Risk Assessment Using Process Mining

Yunizal¹,

Santoso²,

Surendro³

2022

International Journal on Advanced Science, Engineering and Information Technology

View full text Add to dashboard Cite

show abstract

“…Based on the ISRA taxonomy, our approach is similar to other risk assessment approaches [2,6,43]. However, none of these methodologies uses threat-based techniques, nor do they use the hierarchical structure we propose to use for SMEs.…”

Section: Algorithm Descriptionmentioning

confidence: 99%

A Threat-Based Cybersecurity Risk Assessment Approach Addressing SME Needs

Haastrecht

Sarhan

Shojaifar

et al. 2021

Proceedings of the 16th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Cybersecurity incidents are commonplace nowadays, and Smalland Medium-Sized Enterprises (SMEs) are exceptionally vulnerable targets. The lack of cybersecurity resources available to SMEs implies that they are less capable of dealing with cyber-attacks. Motivation to improve cybersecurity is often low, as the prerequisite knowledge and awareness to drive motivation is generally absent at SMEs. A solution that aims to help SMEs manage their cybersecurity risks should therefore not only offer a correct assessment but should also motivate SME users. From Self-Determination Theory (SDT), we know that by promoting perceived autonomy, competence, and relatedness, people can be motivated to take action. In this paper, we explain how a threat-based cybersecurity risk assessment approach can help to address the needs outlined in SDT. We propose such an approach for SMEs and outline the data requirements that facilitate automation. We present a practical application covering various user interfaces, showing how our threat-based cybersecurity risk assessment approach turns SME data into prioritised, actionable recommendations. CCS CONCEPTS• Security and privacy → Systems security; Human and societal aspects of security and privacy.

show abstract

“…Current risk management methodologies are often static in nature and cannot meet the demands of operational practices. IT risk assessment in particular is often not integrated into the business management process but rather executed in parallel (Schmidt & Albayrak, 2010).…”

Section: Managementmentioning

confidence: 99%

Designing a New Integrated IT Governance and IT Management Framework Based on Both Scientific and Practitioner Viewpoint

Pereira

Silva

2012

International Journal of Enterprise Information Systems

View full text Add to dashboard Cite

IT Governance (ITG) has been recognized as a CIO top-10 issue for more than five years and has risen in priority between 2007 and 2009. There are several Frameworks to help organizations in ITG implementation but these lack scientific viewpoint, are complex, and also overlap each other. However, besides the existence of several frameworks to help organizations in ITG implementation, most organizations keep designing their own Framework. Such statements reinforce the possibility of improvements in the existing Frameworks. In this paper the authors make a literature review to leverage ITG Contingency factors, ITG general guidelines and main ITG and IT Management (ITM) areas in order to provide a scientific viewpoint validation. Therefore, they integrate their artefacts and propose a new integrated ITG framework. The authors then evaluate their artefacts with expert’s interviews so as to provide practitioner viewpoint validation and also map the authors’ artefacts with current theories. Finally, they conclude their research with main contributions and future work.

show abstract

A quantitative framework for dependency-aware organizational IT Risk Management

Cited by 7 publications

References 10 publications

Asset Identification in Information Security Risk Assessment Using Process Mining

Asset Identification in Information Security Risk Assessment Using Process Mining

A Threat-Based Cybersecurity Risk Assessment Approach Addressing SME Needs

Designing a New Integrated IT Governance and IT Management Framework Based on Both Scientific and Practitioner Viewpoint

Contact Info

Product

Resources

About