Skip to Main content Skip to Navigation
Conference papers

Information Security Risk Management

Abstract : Security breaches on the socio-technical systems organizations depend on cost the latter billions of dollars of losses each year. Although information security is a growing concern, most organizations deploy technical security measures to prevent security attacks, overlooking social and organizational threats and the risks faced because of them. In this paper, we propose a method to information security risk analysis inspired by the ISO27k standard series and based on two state-of-art methods, namely the socio-technical security requirements method STS and the risk analysis method CORAS. The method captures social interactions among stakeholders, while capturing both the risks that threaten their assets as well as those arising while interacting with others. Then, the method suggests how assets are to be protected based on the information classification and potential losses incurred by security breaches. An example from the healthcare domain is used throughout the paper to illustrate the method.
Complete list of metadata

Cited literature [24 references]  Display  Hide  Download

https://hal.inria.fr/hal-01765266
Contributor : Hal Ifip <>
Submitted on : Thursday, April 12, 2018 - 4:34:36 PM
Last modification on : Friday, April 13, 2018 - 1:37:01 AM

File

459826_1_En_2_Chapter.pdf
Files produced by the author(s)

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Salimeh Dashti, Paolo Giorgini, Elda Paja. Information Security Risk Management. 10th IFIP Working Conference on The Practice of Enterprise Modeling (PoEM), Nov 2017, Leuven, Belgium. pp.18-33, ⟨10.1007/978-3-319-70241-4_2⟩. ⟨hal-01765266⟩

Share

Metrics

Record views

606

Files downloads

199