Abstract
Recently, organizations around the world are becoming aware of the need to run risk management programs in order to enhance their information security. However, the majority of the existing qualitative/empirical methods fail to adhere to the terminology defined by ISO 27000-series and treat deliberate threats in a misleading way. In this paper, a quantitative risk analysis approach for deliberate threats is introduced. The proposed approach follows the steps suggested by the ISO 27005 standard for risk management, extending them in order to focus on deliberate threats and the different information security incidents that realize them. It is based on three-levels: the conceptual foundation level, the modeling tools level and the mathematical foundation level. The conceptual foundation level defines and analyzes the terminology involved, using unified modeling language (UML) class diagrams. The modeling tools level introduces certain tools that assist in modeling the relations among different concepts. Finally, the mathematical foundation level includes all the different mathematical formulas and techniques used to estimate risk values for each threat.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Shneier, B.: Attack Trees: Modeling security threats. Dr. Dobb’s Journal (1999), http://www.schneier.com/paper-attacktrees-ddj-ft.html
Shneier, B.: Secrets & Lies: Digital Security in a Networked World. John Wiley & Sons, Chichester (2000)
International Organization for Standarization, ISO/IEC 27001, Information Technology – Security Techniques – Information Security Management systems – Requirements (2005)
International Organization for Standarization, ISO/IEC 27002, Information technology – Security techniques – Code of practice for information security management (2005)
International Organization for Standardization (ISO), ISO/IEC 27005: Information technology – Security techniques – Information security risk management (2008)
Stoneburner, G., Goguen, A., Feringa, A.: Risk Management Guide for Information Technology Systems. Recommendations of the National Institute of Standards and Technology, NIST (2002)
Computer Emergency Response Team (CERT), Carnegie Mellon University, Cert Statistics (Historical), http://www.cert.org/stats/
Moore, P.A., Ellison, J.R., Linger, C.R.: Attack Modeling for Information Security and Survivability. Carnegie Mellon University, Technical Note (2001)
International Organization for Standarization, ISO/IEC 27000, Information technology - Security techniques - Information security management systems - Overview and vocabulary (2009)
CRAMM User Guide, Version 5.0 & 5.1 (2005), http://www.cramm.com/
Zaobin, G., Jiufei, T., Ping, W., Vijay, V.: A Novel Security Risk Evaluation for Information Systems. In: Proceedings of the 2007 Japan-China Joint Workshop on Frontier of Computer Science and Technology, pp. 67–73 (2007)
Benini, M., Sicari, S.: Assessing the risk to intercept VoIP calls. Journal of Computer Networks 52(12), 2432–2446 (2008)
Object Management Group (OMG), Unified Modeling Language Specifications, http://www.omg.org/technology/documents/modeling_spec_catalog.htm#UML
The CORAS method, http://coras.sourceforge.net/
OCTAVE Information Security Risk Evaluation, http://www.cert.org/octave/
Author information
Authors and Affiliations
Editor information
Rights and permissions
Copyright information
© 2011 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Vavoulas, N., Xenakis, C. (2011). A Quantitative Risk Analysis Approach for Deliberate Threats. In: Xenakis, C., Wolthusen, S. (eds) Critical Information Infrastructures Security. CRITIS 2010. Lecture Notes in Computer Science, vol 6712. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-21694-7_2
Download citation
DOI: https://doi.org/10.1007/978-3-642-21694-7_2
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-21693-0
Online ISBN: 978-3-642-21694-7
eBook Packages: Computer ScienceComputer Science (R0)