3차원 벡터 시각화를 활용한 효과적인 위험 수준 평가
Effective Risk Level Assessment Using Three-Dimensional Vector Visualization
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
위험분석은 위험을 허용 가능한 수준으로 관리하기 위한 방안을 수립하는 데 활용된다. 이러한 위험관리 의사결정에 있어서 위험의 시각화는 중요하다. 그러나 기존의 위험 시각화 방식은 위험의 요소들을 고려하여 입체적으로 위험을 시각화하는 데 있어서 한계를 지닌다. 본 논문에서는 기밀성, 무결성, 가용성 측면에서 개별적 혹은 종합적으로위험을 표현할 수 있는 개선된 위험도 3차원 시각화 방법을 제시한다. 제안된 방법을 기업의 위험분석 평가에 적용하여 유효성을 검증한다. 제안된 시각화 방법은 내부통제를 위한 정보보호 의사결정 과정에 효과적으로 활용될 수있다.
Abstract
Risk analysis is utilized in devising measures to manage information security risk to an acceptable level. In this risk management decision-making, the visualization of risk is important. However, the pre-existing risk visualization method is limited in visualizing risk factors three-dimensionally. In this paper, we propose an improved risk visualization method which can facilitate the identification of risk from the perspective of confidentiality, integrity, and availability respectively or synthetically. The proposed method is applied to an enterprise’s risk analysis in order to verify how effective it is. We argue that through the proposed method risk levels can be expressed three-dimensionally, which can be used effectively for information security decision-making process for internal controls.
참고문헌 (31)
- ISACA, "CISA Review Manual 2006. Information Systems Audit and Control Association", ISBN 1-933284-15-3, 85~ (2006)
- ISO, "IEC", Guidelines for the Management of Security - Part 1 :Concepts and Models of IT Security, 1996
- Artur Rot, "IT Risk Assessment:Quantitative and Qualitive Approach", Proceedings of the World Congress on Engineering and Computer Science (2008)
- Christopher Alberts, "Introduction to the OCTAVE®", ~ (2003)
- A qualitative risk analysis and management tool-CRAMM, "Yazar", SANS InfoSec Reading Room, ~ (2002)
- Boritz, "IS Practitioners'Views on Core Concepts of Information Integrity", International Journal of Accounting Information Systems (2011), Elsevier
- "INFORMATION SYSTEMS SECURITY :A COMPREHENSIVE MODEL", ANNEX TO NISTISSI No. 4011, ~
- Loukas, G., "Protection Against Denial of Service Attacks: A Survey", Comput. J, 53(7), pp.1020~1037 (2010)[DOI]
- "Information processing Systems - Open Systems Interconnection - Basic Reference Model -Part 2 : Security Architecture", ISO 7498-2, ~
- 800-33, Underlying Technical Models for Information Technology Security, "NIST SP", National Institute for Standards and Technology, ~ (2001)
- Rainer Jr, Rex Kelly, "Risk analysis for information technology", Journal of Management Information Systems, pp.129~147 (1991)
- Cox Jr, "Some limitations of “Risk= Threat×Vulnerability× Consequence” for risk analysis of terrorist attacks", Risk Analysis, 28(6), pp.1749~1761 (2008)
- Sung won Kim, "Risk analysis and assessment Methodology Research for network based Real-time Risk Management", KCC, 34(1)
- Kwo-jean Farn, "A study on information security management system evaluation-assets, threat and vulnerability", Computer Standards & interfaces, 26, pp.501~513 (2004)
- Hank Marquis, "10 Steps to Do It Yourself CRAMM", ~ (2008)
- Introducing octave allegro: Improving the information security risk assessment process, "Caralli", CARNEGIE-MELLON UNIV PITTSBURGH PA SOFTWARE ENGINEERING INST, ~, pp.No. CMU (2007), SEI-2007-TR-012
- 800-30 Risk Management Guide for Information Technology Systems, "NIST, SP", National Institute for Standards and Technology, ~ (2002)
- The it practitioner guide. Technical report, "ISACA", ISACA, ~ (2009)
- Inhyun Cho, "Study onscenario-based Personnel Risk Analysis", Research Briefs on Informaiton & Communication Technology Evolution (ReBICTE), 1 (2015)
- Harmonized Threat and Risk Assessment (TRA) Methodology, "CSE, RCMP", TRA, ~ (2007)
- Christopher Alberts, "OCTAVESM*Threat Profiles", Software Engineering Institute Carnegie Mellon University’s White Paper, ~
- "Threat risk assessment working guide", Government of Canada, Communications Security Establishment, 73~ (1999)
- British Standards Institute(BSI), "Information security management systems – part 3 : Guidelines for information security risk management", BSI Standard 7799-3 : 2006, ~ (2006)
- Brewer, "An Introduction to ISO", IEC 27001: 2013, 2013
- Chung, Yoon Jung, "Security risk vector for quantitative asset assessment", pp.274~283 (2005), Springer Berlin Heidelberg
- Eppler, Martin J., "A systematic framework for risk visualization in risk management and communication", Risk Management, 11(2), pp.67~89 (2009)
- Lipkus, Isaac M., "The visual communication of risk", Journal of the National Cancer Institute. Monographs, 25(1998), pp.149~163 (1998)
- Smerecnik, Chris MR, "Understanding the positive effects of graphical risk information on comprehension:measuring attention directed to written, tabular, and graphical risk information", Risk analysis, 30(9), pp.1387~1398 (2010)
- Dezfuli, Homayoon, "NASA Risk Management Handbook. Version 1.0", ~ (2011)