Development of a Failure Mode and Effects Analysis Based Risk Assessment Tool for Information Security

Abstract

Risk management is recognized as a significant element in Information Security Management while the failure mode and effects analysis (FMEA) is widely used in risk analysis in manufacturing industry. This paper aims to present the development work of the Information Security FMEA Circle (InfoSec FMEA Circle) which is used to support the risk management framework by modifying traditional FMEA methodologies. In order to demonstrate the "appropriateness" of the InfoSec FMEA Circle for the purposes of assessing information security, a case study at Hong Kong Science and Technology Parks Corporation (HKSTP) is employed. The "InfoSec FMEA Circle" is found to be an effective risk assessment methodology that has a significant contribution to providing a stepwise risk management implementation model for information security management.

The consistency analysis of failure mode and effect analysis (FMEA) in information technology risk assessment

“…FMEA is growing and can be used in various fields, including Information Technology. The difference in the use of FMEA is based on the risk object to be measured (Lai and Chin, 2014). In addition, the focal point of risk measurement in this research is IT risks.…”

“…The FMEA method applied in risk management bears a consistency issue (Barends et al, 2012;Estorilio and Posso, 2010;Gary Teng et al, 2006;Oldenhof et al, 2011). A research conducted by (Lai and Chin, 2014) proposed Information Security FMEA Circle that modified traditional FMEA methodology. Moreover, another research by (Oldenhof et al, 2011) examined the consistency of FMEA by assessing risks in different teams in a case study.…”

“…The number of studies that combines FMEA and information security risks is still limited (Silva et al, 2014). The use of FMEA in the IT field still needs to be explored (Lai and Chin, 2014). The consistency of traditional FMEA in the IT field has been proved by (Subriadi et al, 2018).…”

“…Studies that combine the use of FMEA and information security risks are not that many (Silva et al, 2014). Thus, FMEA in the IT field needs to be explored (Lai and Chin, 2014). This study analyzed the consistency of traditional FMEA and Improved FMEA in IT Risk Assessment.…”

Applying a Risk Management Framework to the Thai Massage Businesses

“…Establish the context: Identify the objectives of the project, event or relationship and then consider the internal and external parameters. According to Lai and Chin (2004), the process part of ISO 31000:2009 is the same as AS/NZS 4360:1999, AIRMIC, ALARM, IRM:2002 and ISO 27005:2011. The FMEA is a methodology aimed as a risk assessment tool because of its semi-quantitative approach in calculating RPN.…”