pISRA: privacy considered information security risk assessment model

Wei, Yu-Chih; Wu, Wei-Chen; Lai, Gu-Hsin; Chu, Ya-Chi

doi:10.1007/s11227-018-2371-0

Cited by 21 publications

(26 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Privacy data protection standards (e.g., BS 10012:2017 [ 35 ], ISO/IEC 29151:2017 [ 36 ] and ISO/IEC 27018:2014 [ 37 ]), can be found in the literature focusing on PIA as a requirement in the execution of cybersecurity risk assessments. PIA and cybersecurity risk assessments are, however, treated as two different and uncorrelated processes [ 32 , 38 ], with a clear gap on automated tools, methods and models that implement PIA [ 33 ]. Even though standards (e.g., ISO/IEC 29134:2017 [ 39 ]) provide details and guidance to conduct privacy impact assessments, they are very generic, and provide high-level information that in some cases is insufficient to perform an appropriate privacy risk assessment [ 38 ].…”

Section: Related Workmentioning

confidence: 99%

“…PIA and cybersecurity risk assessments are, however, treated as two different and uncorrelated processes [ 32 , 38 ], with a clear gap on automated tools, methods and models that implement PIA [ 33 ]. Even though standards (e.g., ISO/IEC 29134:2017 [ 39 ]) provide details and guidance to conduct privacy impact assessments, they are very generic, and provide high-level information that in some cases is insufficient to perform an appropriate privacy risk assessment [ 38 ]. Although the literature provides a wide variety of privacy metrics, they mainly consider properties of privacy-enhancing technologies such as the amount of sensitive information leaked or the number of indistinguishable users, instead of the privacy impact [ 40 ].…”

Section: Related Workmentioning

confidence: 99%

“…In addition to the aforementioned regulatory efforts, academic research has also proposed improvements to DPIA processes. These efforts include making the DPIA process more systematic and structured by proposing formal modelling techniques for privacy threats [ 38 ]. The authors in [ 47 ] proposed a comprehensive methodology for identifying data privacy risks and quantifying them, while the risk values are computed at different levels to help both senior management and operational personnel, in assessing and mitigating privacy risks.…”

Section: Related Workmentioning

confidence: 99%

“…The authors in [ 47 ] proposed a comprehensive methodology for identifying data privacy risks and quantifying them, while the risk values are computed at different levels to help both senior management and operational personnel, in assessing and mitigating privacy risks. In addition, the work in [ 38 ] proposed a systematic privacy-considered information security risk assessment (pISRA) model, which can take both a privacy impact analysis and risk assessment into consideration. Finally, in [ 48 ], the authors presented an empirically evaluated privacy risk assessment framework, namely DPIA Data Wheel, based on contextual integrity, that practitioners can use to inform decision making around the privacy risks of Cyber Physical Systems (CPS).…”

Section: Related Workmentioning

confidence: 99%

See 3 more Smart Citations

Automated Cyber and Privacy Risk Management Toolkit

González-Granadillo

Menesidou

Papamartzivanos

et al. 2021

Sensors

View full text Add to dashboard Cite

Addressing cyber and privacy risks has never been more critical for organisations. While a number of risk assessment methodologies and software tools are available, it is most often the case that one must, at least, integrate them into a holistic approach that combines several appropriate risk sources as input to risk mitigation tools. In addition, cyber risk assessment primarily investigates cyber risks as the consequence of vulnerabilities and threats that threaten assets of the investigated infrastructure. In fact, cyber risk assessment is decoupled from privacy impact assessment, which aims to detect privacy-specific threats and assess the degree of compliance with data protection legislation. Furthermore, a Privacy Impact Assessment (PIA) is conducted in a proactive manner during the design phase of a system, combining processing activities and their inter-dependencies with assets, vulnerabilities, real-time threats and Personally Identifiable Information (PII) that may occur during the dynamic life-cycle of systems. In this paper, we propose a cyber and privacy risk management toolkit, called AMBIENT (Automated Cyber and Privacy Risk Management Toolkit) that addresses the above challenges by implementing and integrating three distinct software tools. AMBIENT not only assesses cyber and privacy risks in a thorough and automated manner but it also offers decision-support capabilities, to recommend optimal safeguards using the well-known repository of the Center for Internet Security (CIS) Controls. To the best of our knowledge, AMBIENT is the first toolkit in the academic literature that brings together the aforementioned capabilities. To demonstrate its use, we have created a case scenario based on information about cyber attacks we have received from a healthcare organisation, as a reference sector that faces critical cyber and privacy threats.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Automated Cyber and Privacy Risk Management Toolkit

González-Granadillo

Menesidou

Papamartzivanos

et al. 2021

Sensors

View full text Add to dashboard Cite

show abstract

“…The paper [8] then looks at the privacy and security part under the theme of Internet of Things. Authors propose a privacy considered information security risk assessment model that can take both privacy impact analysis and risk assessment into consideration.…”

mentioning

confidence: 99%