A web-based cooperative tool for risk management with adaptive security

Abstract

Risk management can benefit from Web-based tools fostering actions for treating risks in an environment, while having several individuals collaborating to face the endeavors related to risks. During the intervention, the security rules in place to preserve resources from unauthorized access, might need to be modified on the fly, e.g., increasing the privileges of risk managers or letting rescue teams view the exact position of the victims. Modifications should respect the overall security policies and avoid security conflicts. This paper presents a dynamic access control model for environmental risks involving physical resources. Data structures included in our Web application to represent both risk and security are given. To keep the dynamic security rules compliant with overall organization security objectives, we consider rules grouped in Access Control Domains so that changes do not create security conflicts during collaboration in risk management. Considering work environments as an example, risk and access control models are introduced. Security is built on the ABAC (Attribute Based Access Control) paradigm. A Risk Management System (RMS) is illustrated: it captures events, signals potential risks, and outputs strategies to prevent the risk. Dynamic authorization is included in the RMS to vary subjects' privileges on physical resources based on risk level, people position and so on. These concepts are implemented in a prototype Web application appearing as a Web Dashboard for risk management

Exploration of Mobile Device Behavior for Mitigating Advanced Persistent Threats (APT): A Systematic Literature Review and Conceptual Framework

“…This section presents a general overview of risk management approaches against cyber-attacks. This study identified 23 primary studies, of which two focused on mobile [153,154], six focused on IoT devices [107,[155][156][157][158]181], two focused on cyber-physical systems [168,169], four focused on either fog computing [111,160], the 5G edge-cloud ecosystem [167], or connected and autonomous vehicle (CAV) [159], and eight in general [61,93,[161][162][163][164][165][166]. Furthermore, four primary studies focused on APT [93,107,111,160], while the others are focused on either specific attacks such as DDOS attacks [181], DOS [167], SQL injections attacks [181], or privilege-induced attacks [154], or non-specific attacks [60,61,140,[155][156][157][158][159][161][162][163][164][165][166]…”

“…As shown in Figure 9, the existing studies either proposed risk management approaches [93,[154][155][156]158,159,161,[165][166][167][168][169] or were integrated with other approaches such as access control [161,164], situational awareness [61], and game theory [107,111,160,162].…”

“…As shown in Figure 9, the existing studies either proposed risk management approaches [93,[154][155][156]158,159,161,[165][166][167][168][169] or were integrated with other approaches such as access control [161,164], situational awareness [61], and game theory [107,111,160,162]. Many researchers have proposed different risk management approaches to minimize the threats and risks to IoT [158,181], computers [170], cyber-physical systems (CPS) [168,169], the 5G edge-cloud ecosystem [167], connected and autonomous vehicles (CAV) [159], and others [89,156,160,169].…”

Special issue on Semantic Technologies for Collaborative Web

“…The paper ''A web-based cooperative tool for risk management with adaptive security'', by M. Fugini, and M. Teimourikia [8], based also on an initial contribution of G. Hadjichristofi, is in the area of cybersecurity and specifies a dynamic access control model for risks occurring in environments where persons, data objects and physical resources are represented both from the risk and from the cybersecurity perspective. Environmental risk management embraces various themes, from technologies of surveillance to strategies of risk treatment and security and privacy of the involved resources.…”

Synergy of computers, cognition, communication and control with industrial applications

“…The synergy of CCCC supports the increasingly demanding performance specifications of these applications and helps to face special situations like unexpected condition adaptations, human interaction challenges, and goal conflicts. Practical industrial applications of the synergy of CCCC are cyber-physical systems [1][2][3][4][5], networked control systems [6][7][8][9][10], mechatronics systems [11][12][13][14][15], online quality control of production items [16][17][18][19][20], supervision and failure analysis of dynamically changing machine states [21][22][23][24], decision support systems [25][26][27][28][29], prediction and control in dynamic production processes [30][31][32], welding processes [33,34], user profiling [35,36], process monitoring [37][38][39], web based control of information management flows [40,41], and resilient control architectures [42][43][44]…”