A systematic review of information security risk assessment

Abstract

Many standards exist to guide the process of risk assessment, particularly in the field of information security. This leads to many, subtly different, definitions of risk analysis, evaluation and assessment. Consequently, researchers often confuse these terms and disciplines, which leads to further confusion within the community. In this sense, it is important to come to a common understanding of the processes and terminology to clarify research in this area. A common approach to achieve this goal is to carry out a literature review. This paper takes a formal approach to the literature review based on the ideas of the Cochrane group. The result is a systematic review of risk assessment in the field of information security. We present a systematic review of over 80 research papers published between 2004 and 2014. The main contribution of our paper is to construct a classification of these published papers into seven types. This classification aims to help researchers obtain a clear and unbiased picture of the terminology, developments and trends of information security risk assessment in the academic sector. [6] present a conceptual framework of comparisons among well-documented ISRA guidelines including NIST 800-30, OCTAVE and ISRAM. Other authors are interested in the improvement of current risk analysis approaches by applying fuzzy theory [7,8] and AHP (Analytic Hierarchy Process) theory [9,10].However, to our knowledge, there has been no systematic overview of the ISRA research to analyse the emphasis of the work and the direction of future research. Consequently, this paper will apply the methodology of systematic review not only to summarize the related research papers, but also to present a classified framework of these papers. In order to not to confuse the phrases of risk analysis, risk assessment and risk evaluation, we will use their definitions from ISO 27005 in our systematic review. The aim of the classification framework is to help researchers obtain a clear picture about the research areas. According to this classification, researchers can find some study entry points in this sector. Researchers may also learn the advanced ISRA methods and find the connections between organizational level and academic level from this systematic review.

Realizando una Revisión Sistemática de Metodologías ISRA orientadas a la Seguridad TIC. Periodo 2014-2019

“…En [60] se hace una revisión de las publicaciones científicas asociadas al análisis de riesgos, pero centradas en las metodologías NIST SP800-30, ISO27005/ISO27001, OCTAVE e ISRAM. Determina que estos mecanismos de análisis de riesgos tienen importantes carencias, como por ejemplo que no pueden abordar algunos factores importantes, como son la fuga de activos, los activos creados por los usuarios y el conocimiento crítico.…”

“…• Los métodos deben tener mecanismos de soporte a la toma de decisiones [57]. • Los resultados del análisis de riesgos son informales y poco analíticos, obteniendo puntuaciones de riesgo subjetivas [58,60]. • Necesidad de contar con orientaciones y perspectivas económicas del análisis de riesgos [60].…”

“…• Los resultados del análisis de riesgos son informales y poco analíticos, obteniendo puntuaciones de riesgo subjetivas [58,60]. • Necesidad de contar con orientaciones y perspectivas económicas del análisis de riesgos [60]. • Necesidad de taxonomías de riesgos actualizadas y adecuadas a las nuevas tecnologías (ICSs, IoT, Smart Grids, …) [61,64,73,76].…”

Comparative Analysis of Risk Evaluation Models for Risk-aware Access Control in Bring Your Own Device Environment

“…For example, [29] used risk evaluation and risk estimation interchangeably. On the contrary, the meaning ascribed to the concepts sometimes cause confusion when improperly defined among stakeholders [30]. This study preferred to use risk evaluation for risk quantification or qualification.…”

A Risk-Based Framework to Inform Prioritisation of Security Investment for Insider Threats

“…This would enable them to prioritise their investments and customise their security arrangements to meet the organisation's needs. Security solutions should be guided by a conceptual framework that takes into account the various insider types, as well as how security controls interact to reduce insider risk along the various threat pathways [10,26,37,44,45].…”