A Cost-Optimization Scheme Using Security Vulnerability Measurement for Efficient Security Enhancement
1
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
The security risk management used by some service providers is not appropriate for effective securityenhancement. The reason is that the security risk management methods did not take into account the opinionsof security experts, types of service, and security vulnerability-based risk assessment. Moreover, the securityrisk assessment method, which has a great influence on the risk treatment method in an information securityrisk assessment model, should be security risk assessment for fine-grained risk assessment, considering securityvulnerability rather than security threat. Therefore, we proposed an improved information security riskmanagement model and methods that consider vulnerability-based risk assessment and mitigation to enhancesecurity controls considering limited security budget. Moreover, we can evaluate the security cost allocationstrategies based on security vulnerability measurement that consider the security weight.
Abstract
The security risk management used by some service providers is not appropriate for effective securityenhancement. The reason is that the security risk management methods did not take into account the opinionsof security experts, types of service, and security vulnerability-based risk assessment. Moreover, the securityrisk assessment method, which has a great influence on the risk treatment method in an information securityrisk assessment model, should be security risk assessment for fine-grained risk assessment, considering securityvulnerability rather than security threat. Therefore, we proposed an improved information security riskmanagement model and methods that consider vulnerability-based risk assessment and mitigation to enhancesecurity controls considering limited security budget. Moreover, we can evaluate the security cost allocationstrategies based on security vulnerability measurement that consider the security weight.
참고문헌 (35)
- "2017 Thales Data Threat Report: Trends in Encryption and Data Security (Global Edition)" (2017)[URL]
- "IT Security Spending Trends" (2016)[URL]
- "2015 Global Study on IT Security Spending & Investments" (2015)[URL]
- A. Schilling, "Optimizing information security investments with limited budget", Operations Research Proceedings 2014, pp.493~499 (2016), Springer
- A. Behnia, "A survey of information security risk analysis methods", SmartCR, 2(1), pp.79~94 (2012)
- OWASP Top 10: The Top 10 Most Critical Web Application Security Threats: Enhanced with Text Analytics and Content by PageKicker Robot Phil 73, "Oepn Web Application Security Project", CreateSpace Independent Publishing Platform, ~ (2014)
- J. Y. Park, "Access control framework design for personal cloud", Proceedings of the International Conference on Convergence Technology, pp.1578~1579 (2013)
- W. M. Kang, "An enhanced security framework for home appliances in smart home", Human-centric Computing and Information Sciences, 7 (2017)
- C. D. Huang, "Economics of information security investment in the case of concurrent heterogeneous attacks with budget constraints", International Journal of Production Economics, 141(1), pp.255~268 (2013)
- N. J. Brown, "Multi-layered security investment optimization using a simulation embedded within a genetic algorithm", Proceedings of 2015 Winter Simulation Conference(WSC), pp.2424~2435 (2015)
- H. Wang, "A vulnerability assessment method in industrial internet of things based on attack graph and maximum flow", IEEE Access, 6, pp.8599~8609 (2018)
- N. Gao, "Exploring attack graphs for security risk assessment : a probabilistic approach", Wuhan University Journal of Natural Sciences, 23(2), pp.171~177 (2018)
- J. C. Maa, "A kind of hierarchical network vulnerability assessment model based on attack graph", Computer Science and Artificial Intelligence: Proceedings of the International Conference on Computer Science and Artificial Intelligence (CSAI2016). (2017), World Scientific Publishing
- R. Dewri, "Optimal security hardening on attack tree models of networks : a cost-benefit analysis", International Journal of Information Security, 11(3), pp.167~188 (2012)
- B. Kordy, "Principles of Security and Trust", pp.325~346 (2018), Springer
- P. Wang, "Threat risk analysis for cloud security based on Attack-Defense Trees", Proceedings of 2012 8th International Conference on Computing Technology and Information Management(NCM and ICNIT), pp.106~111 (2012)
- Z. Tarmudi, "A fuzzy Delphi method to rank alternatives for industry selection", AIP Conference Proceedings, 1974 (2018)
- Y. Tian, "A novel Threat Evaluation method for privacy-aware system in RFID", International Journal of Ad Hoc and Ubiquitous Computing, 8(4), pp.230~240 (2011)
- S. H. Na, "A broker-based cooperative security-SLA evaluation methodology for personal cloud computing", Security and Communication Networks, 8(7), pp.1318~1331 (2015)
- L. A. Gordon, "The economics of information security investment", ACM Transactions on Information and System Security(TISSEC), 5(4), pp.438~457 (2002)
- A. Trufanov, "Complex Networks VIII", pp.175~182 (2017), Springer
- D. Schatz, "Corporate information security investment decisions : a qualitative data analysis approach", International Journal of Enterprise Information Systems(IJEIS), 14(2), pp.1~20 (2018)
- W. Sonnenreich, "Return on security investment(ROSI)-a practical quantitative model", Journal of Research and Practice in Information Technology, 38(1), pp.45~56 (2006)
- N. Tsalis, "Return on security investment for cloud platforms", Proceedings of 2013 IEEE 5th International Conference on Cloud Computing Technology and Science, pp.132~137 (2013)
- A. Schilling, "A quantitative threat modeling approach to maximize the return on security investment in cloud computing", Proceedings of the 1st International Conference on Cloud Security Management(ICCSM), pp.68~78 (2013)
- "Information technology - Security techniques - Information security risk management", ISO, 2011
- K. Bernsmed, "Security SLAs for federated cloud services", Proceedings of 2011 6th International Conference on Availability, pp.202~209 (2011)
- N. Al-Safwani, "ISCP : in-depth model for selecting critical security controls", Computers & Security, 77, pp.565~577 (2018)
- M. S. Lund, "Model-Driven Risk Analysis: The CORAS Approach" (2010), Springer
- A. Aviad, "Semantic risk assessment for cybersecurity", Proceedings of International Conference on Cyber Warfare and Security, pp.513~520 (2018)
- A. Sharma, "Analyzing the Role of Risk Mitigation and Monitoring in Software Development", pp.46~60 (2018), IGI Global
- Bharti Nagpal, "A Survey on the Detection of SQL Injection Attacks and Their Countermeasures", JIPS(Journal of Information Processing Systems), 13(4), pp.689~702 (2017), 한국정보처리학회[DOI]
- M. D. Nguyen, "A demonstration of malicious insider attacks inside cloud IaaS vendor", International Journal of Information and Education Technology, 4(6), pp.483~486 (2014)
- P. Wang, "Information Technology-New Generations", pp.147~150 (2018), Springer
- Jayaprakash Kar, "Mitigating Threats and Security Metrics in Cloud Computing", JIPS(Journal of Information Processing Systems), 12(2), pp.226~233 (2016), 한국정보처리학회[DOI]