Skip to Main content Skip to Navigation
New interface
Conference papers

Information Security Risk Management

Abstract : Security breaches on the socio-technical systems organizations depend on cost the latter billions of dollars of losses each year. Although information security is a growing concern, most organizations deploy technical security measures to prevent security attacks, overlooking social and organizational threats and the risks faced because of them. In this paper, we propose a method to information security risk analysis inspired by the ISO27k standard series and based on two state-of-art methods, namely the socio-technical security requirements method STS and the risk analysis method CORAS. The method captures social interactions among stakeholders, while capturing both the risks that threaten their assets as well as those arising while interacting with others. Then, the method suggests how assets are to be protected based on the information classification and potential losses incurred by security breaches. An example from the healthcare domain is used throughout the paper to illustrate the method.
Complete list of metadata

Cited literature [24 references]  Display  Hide  Download
Contributor : Hal Ifip Connect in order to contact the contributor
Submitted on : Thursday, April 12, 2018 - 4:34:36 PM
Last modification on : Friday, April 13, 2018 - 1:37:01 AM


Files produced by the author(s)


Distributed under a Creative Commons Attribution 4.0 International License



Salimeh Dashti, Paolo Giorgini, Elda Paja. Information Security Risk Management. 10th IFIP Working Conference on The Practice of Enterprise Modeling (PoEM), Nov 2017, Leuven, Belgium. pp.18-33, ⟨10.1007/978-3-319-70241-4_2⟩. ⟨hal-01765266⟩



Record views


Files downloads