G-RAM framework for software risk assessment and mitigation strategies in organisations

Abstract

Purpose Malicious attackers frequently breach information systems by exploiting disclosed software vulnerabilities. Knowledge of these vulnerabilities over time is essential to decide the use of software products by organisations. The purpose of this paper is to propose a novel G-RAM framework for business organisations to assess and mitigate risks arising out of software vulnerabilities. Design/methodology/approach The G-RAM risk assessment module uses GARCH to model vulnerability growth. Using 16-year data across 1999-2016 from the National Vulnerability Database, the authors estimate the model parameters and validate the prediction accuracy. Next, the G-RAM risk mitigation module designs optimal software portfolio using Markowitz’s mean-variance optimisation for a given IT budget and preference. Findings Based on an empirical analysis, this study establishes that vulnerability follows a non-linear, time-dependent, heteroskedastic growth pattern. Further, efficient software combinations are proposed that optimise correlated risk. The study also reports the empirical evidence of a shift in efficient frontier of software configurations with time. Research limitations/implications Existing assumption of independent and identically distributed residuals after vulnerability function fitting is incorrect. This study applies GARCH technique to measure volatility clustering and mean reversal. The risk (or volatility) represented by the instantaneous variance is dependent on the immediately previous one, as well as on the unconditional variance of the entire vulnerability growth process. Practical implications The volatility-based estimation of vulnerability growth is a risk assessment mechanism. Next, the portfolio analysis acts as a risk mitigation activity. Results from this study can decide patch management cycle needed for each software – individual or group patching. G-RAM also ranks them into a 2×2 risk-return matrix to ensure that the correlated risk is diversified. Finally the paper helps the business firms to decide what to purchase and what to avoid. Originality/value Contrary to the existing techniques which either analyse with statistical distributions or linear econometric methods, this study establishes that vulnerability growth follows a non-linear, time-dependent, heteroskedastic pattern. The paper also links software risk assessment to IT governance and strategic business objectives. To the authors’ knowledge, this is the first study in IT security to examine and forecast volatility, and further design risk-optimal software portfolios.

Antecedents for enhanced level of cyber-security in organisations

“…Therefore, IT managers need to carefully choose software with uncorrelated vulnerabilities while building system configurations (Chen et al , 2011; Temizkan et al , 2017). Diversification of correlated cyber-risk enables efficient assessment and mitigation of cyber-risks and reduces “software monoculture” (Chen et al , 2011; Temizkan et al , 2017; Biswas and Mukhopadhyay, 2018). Chen et al (2011) have developed a simulation-based study to identify the correlated risks arising due to shared software vulnerabilities across multiple software platforms.…”

Understanding continued smartwatch usage: the role of emotional as well as health and fitness factors

“…Qualitative research identified health information privacy concerns as barrier to wearable health technology growth (Becker 2018). While one would generally assume that these concerns impose greater threat to initial wearable adoption, research has demonstrated that data vulnerability grows over time as userbase increases (Biswas and Mukhopadhyay 2018). If software becomes more vulnerable to cyber-attacks over time, it might be a fruitful avenue for future research to assess the impact of privacy concerns on continuous smartwatch usage.…”

User preferences for privacy features in digital assistants

“…For example the impact of trust in DAs was examined by Mihale-Wilson et al (2017). Further, these concerns can be external and internal: External, because digital assistants are software-based and hackers can exploit security vulnerabilities and access personal information (Biswas and Mukhopadhyay 2018). Internal, because DAs need a substantial amount of personal data for a meaningful personalization.…”