The Design and Evaluation of a User-Centric Information Security Risk Assessment and Response Framework

Abstract

The risk of sensitive information disclosure and modification through the use of online services has increased considerably and may result in significant damage. As the management and assessment of such risks is a well-known discipline for organizations, it is a challenge for users from the general public. Users have difficulties in using, understanding and reacting to security-related threats. Moreover, users only try to protect themselves from risks salient to them. Motivated by the lack of risk assessment solutions and limited impact of awareness programs tailored for users of the general public, this paper aims to develop a structured approach to help in protecting users from threats and vulnerabilities and, thus, reducing the overall information security risks. By focusing on the user and that different users react differently to the same stimuli, the authors developed a user-centric risk assessment and response framework that assesses and communicates risk on both user and system level in an individualized, timely and continuous way. Three risk assessment models were proposed that depend on user-centric and behavior-related factors when calculating risk. This framework was evaluated using a scenario-based simulation of a number of users and results analyzed. The analysis demonstrated the effectiveness and feasibility of the proposed approach. Encouragingly, this analysis provided an indication that risk can be assessed differently for the same behavior based upon a number of user-centric and behavioralrelated factors resulting in an individualized granular risk score/level. This granular risk assessment, provided a more insightful evaluation of both risk and response. The analysis of results was also useful in demonstrating how risk is not the same for all users and how the proposed model is effective in adapting to differences between users offering a novel approach to assessing information security risks.

Respite for SMEs: A Systematic Review of Socio-Technical Cybersecurity Metrics

“…Juliadotter and Choo [119] 2015 Risk Theoretical Both Otero [120] 2015 Risk Theoretical Defender Solic et al [121] 2015 Risk Theoretical Defender Sugiura et al [122] 2015 Risk Theoretical Defender Wei et al [123] 2015 Risk Theoretical Defender You et al [75] 2015 Security Theoretical Defender Brožová et al [51] 2016 Risk Theoretical Defender Brynielsson et al [124] 2016 Awareness Theoretical Defender Granåsen and Andersson [125] 2016 Resilience Theoretical Defender Orojloo and Azgomi [126] 2016 Risk Theoretical Attacker Aiba and Hiromatsu [127] 2017 Risk Theoretical Defender Damenu and Beaumont [103] 2017 Risk Implementation Defender Ramos et al [41] 2017 Review -Defender Rass et al [52] 2017 Risk Theoretical Defender Alohali et al [128] 2018 Risk Theoretical Defender Li et al [82] 2018 Risk Theoretical Defender Morrison et al [43] 2018 Review -Both Pramod and Bharathi [129] 2018 Risk Theoretical Defender Proença and Borbinha [89] 2018 Maturity Implementation Defender Rueda and Avila [130] 2018 Risk Theoretical Defender Shokouhyar et al [104] 2018 Risk Theoretical Defender Stergiopoulos et al [131] 2018 Risk Theoretical Defender You et al [132] 2018 Maturity Theoretical Defender Akinsanya et al [133] 2019 Maturity Theoretical Defender Bharathi [134] 2019 Risk Theoretical Defender Fertig et al [135] 2019 Awareness Theoretical Defender Husák et al [31] 2019 Review -Defender Salih et al [136] 2019 Risk Theoretical Defender Cadena et al [34] 2020 Review -Defender Wirtz and Heisel [137] 2020 Risk Theoretical Defender Ganin et al [138] 2020 Risk Theoretical Defender Luh et al [90] 2020 Risk Theoretical Both Table A3. The in...…”

Risk Assessment Methods for Cybersecurity in Nuclear Facilities: Compliance to Regulatory Requirements

“…In a cybersecurity concept, cyber risk is associated with the risk of operational activities in cyberspace, in which the impact can threaten the information systems and assets, the information and communication technology, devices, and peripheral technology resources, and can create damage to the tangible and intangible materials [56]. By managing information security risks, good information security practices in cybersecurity are expected to maintain reliable services by the system [57].…”

Information Security in the Banking Sector: A Systematic Literature Review on Current Trends, Issues, and Challenges

“…Also, it should not be forgotten that, with the growing popularity of the Internet and its services, there is an increase in information security threats, such as social engineering, malware, and hacking, of which some users may not be aware [10]. Additionally, while many different security methods, such as intrusion detection systems and antivirus software, are used to protect IT systems from different attacks, the information security threat landscape continues to rapidly evolve and attackers are putting more effort into developing sophisticated and advanced malware and hacking methods [11]. Therefore, it is evident that there is an urgency on the part of companies to take new measures to face the wide variety of forms that cyberattacks are adopting.…”