Current established risk assessment methodologies and tools

The technology behind information systems evolves at an exponential rate, while at the same time becoming more and more ubiquitous. This brings with it an implicit rise in the average complexity of systems as well as the number of external interactions. In order to allow a proper assessment of the security of such (sub)systems, a whole arsenal of methodologies, methods and tools have been developed in recent years. However, most security auditors commonly use a very small subset of this collection, that best suits their needs. This thesis aims at uncovering the differences and limitations of the most common Risk Assessment frameworks, the conceptual models that support them, as well as the tools that implement them. This is done in order to gain a better understanding of the applicability of each method and/or tool and suggest guidelines to picking the most suitable one

Parameterization, Analysis, and Risk Management in a Comprehensive Management System with Emphasis on Energy and Performance (ISO 50001: 2018)

[EN] The future of business development relies on the effective management of risks, opportunities, and energy and water resources. Here, we evaluate the application of best practices to identify, analyze, address, monitor, and control risks and opportunities (R/O) according to ISO 31000 and 50000. Furthermore, we shed light on tools, templates, ISO guides, and international documents that contribute to classifying, identifying, formulating control, and managing R/O parameterization in a comprehensive management system model, namely CMS QHSE3+, which consists of quality (Q), health and safety (HS), environmental management (E), energy efficiency (E2), and other risk components (+) that include comprehensive biosecurity and biosafety. By focusing on the deployment of R/O-based thinking (ROBT) at strategic and operational levels, we show vulnerability reduction in CMS QHSE3+ by managing energy, efficiency, and sustainability.We express our gratitude for the support from Cajacopi Atlantico, QUARA Technology, ASTEQ Technology, Universidad Simon Bolivar, Universitat Politecnica de Valencia and to all the personnel and companies who offered us their contributions and their valuable points of view.Poveda-Orjuela, PP.; García-Díaz, JC.; Pulido-Rojano, A.; Cañón-Zabala, G. (2020). Parameterization, Analysis, and Risk Management in a Comprehensive Management System with Emphasis on Energy and Performance (ISO 50001: 2018). Energies. 13(21):1-44. https://doi.org/10.3390/en13215579S1441321SDBS Business Demography Indicatorshttps://stats.oecd.org/index.aspx?queryid=70734The World Economy on a Tightrope. OECD Economic Outlook, June 2020http://www.oecd.org/economic-outlook/Strategic Plan 2016–2020www.https://trade.ec.europa.eu/doclib/docs/2016/august/tradoc_154919.pdfSMEs, and Their Business Problems. Case Analysishttps://www.redalyc.org/pdf/206/20605209.pdfMuñoz, P. (2013). The Distinctive Importance of Sustainable Entrepreneurship. Current Opinion in Creativity, Innovation and Entrepreneurship, 2(1). doi:10.11565/cuocient.v2i1.26Parrish, B. D. (2010). Sustainability-driven entrepreneurship: Principles of organization design. Journal of Business Venturing, 25(5), 510-523. doi:10.1016/j.jbusvent.2009.05.005Chaos Report 2015http://www.laboratorioti.com/2016/05/16/informe-del-caos-2015-chaos-report-2015/Dirección de Marketing. Ciudad de México: Pearson and Prentice Hall, 12a Ediciónhttp://biblio.econ.uba.ar/opac-tmpl/bootstrap/tc/148262_TC.pdfPoveda-Orjuela, P. P., García-Díaz, J. C., Pulido-Rojano, A., & Cañón-Zabala, G. (2019). ISO 50001: 2018 and Its Application in a Comprehensive Management System with an Energy-Performance Focus. Energies, 12(24), 4700. doi:10.3390/en12244700Continuity Planning for Your Businesshttps://www.westpac.com.au/content/dam/public/wbc/documents/pdf/help/disaster/WBC_business_continuity_planning_covid-19_checklist.pdfCOVID-19: Five Ways to Maintain Continuity and Reshape for Resiliencehttps://www.ey.com/en_be/transactions/companies-can-reshape-results-and-plan-forcovid-19-recoveryAven, T. (2012). The risk concept—historical and recent development trends. Reliability Engineering & System Safety, 99, 33-44. doi:10.1016/j.ress.2011.11.006Oliva, F. L. (2016). A maturity model for enterprise risk management. International Journal of Production Economics, 173, 66-79. doi:10.1016/j.ijpe.2015.12.007Aven, T., & Zio, E. (2011). Some considerations on the treatment of uncertainties in risk assessment for practical decision making. Reliability Engineering & System Safety, 96(1), 64-74. doi:10.1016/j.ress.2010.06.001The ISO 27k Forumhttps://www.iso27001security.com/html/iso27000.htmlKaya, İ. (2017). Perspectives on Internal Control and Enterprise Risk Management. Eurasian Studies in Business and Economics, 379-389. doi:10.1007/978-3-319-67913-6_26Barafort, B., Mesquida, A.-L., & Mas, A. (2017). Integrating risk management in IT settings from ISO standards and management systems perspectives. Computer Standards & Interfaces, 54, 176-185. doi:10.1016/j.csi.2016.11.010Aven, T. (2016). Risk assessment and risk management: Review of recent advances on their foundation. European Journal of Operational Research, 253(1), 1-13. doi:10.1016/j.ejor.2015.12.023Thekdi, S., & Aven, T. (2016). An enhanced data-analytic framework for integrating risk management and performance management. Reliability Engineering & System Safety, 156, 277-287. doi:10.1016/j.ress.2016.07.010Aven, T., & Zio, E. (2013). Foundational Issues in Risk Assessment and Risk Management. Risk Analysis, 34(7), 1164-1172. doi:10.1111/risa.12132Labodová, A. (2004). Implementing integrated management systems using a risk analysis based approach. Journal of Cleaner Production, 12(6), 571-580. doi:10.1016/j.jclepro.2003.08.008World trends and the future of Latin America; ECLAC UNIDO, 2016–Public Management Series, No 85. ISSN 1680-8827, LC/L.4246 LC/IP/L.348https://repositorio.cepal.org/bitstream/handle/11362/40788/S1600740_es.pdf?sequence=1&isAllowed=yBudhi, M. K. S., Lestari, N. P. N. E., Suasih, N. N. R., & Wijaya, P. Y. (2020). Strategies and policies for developing SMEs based on creative economy. Management Science Letters, 2301-2310. doi:10.5267/j.msl.2020.3.005Melly, D., & Hanrahan, J. (2020). Tourism biosecurity risk management and planning: an international comparative analysis and implications for Ireland. Tourism Review, 76(1), 88-102. doi:10.1108/tr-07-2019-0312Guide for Business Continuity during COVID-19http://www.andi.com.co/Uploads.pdfLa Danse, 1910. Musee de l’Hermitage, Saint-Pétersbourg, Russie. Consulté le 28 Juillet 2020https://www.hermitagemuseum.org/wps/portal/hermitage/Uriarte-Romero, R., Gil-Samaniego, M., Valenzuela-Mondaca, E., & Ceballos-Corral, J. (2017). Methodology for the Successful Integration of an Energy Management System to an Operational Environmental System. Sustainability, 9(8), 1304. doi:10.3390/su9081304Cosgrove, J., Littlewood, J., & Wilgeroth, P. (2017). Development of a framework of key performance indicators to identify reductions in energy consumption in a medical devices production facility. International Journal of Ambient Energy, 39(2), 202-210. doi:10.1080/01430750.2017.1278718Wu, J., Cheng, B., Wang, M., & Chen, J. (2017). Quality-Aware Energy Optimization in Wireless Video Communication With Multipath TCP. IEEE/ACM Transactions on Networking, 25(5), 2701-2718. doi:10.1109/tnet.2017.2701153Biosecurity. Madridhttps://www.insst.es/-/bioseguridadArvanitis, S., Loukis, E., & Diamantopoulou, V. (2013). The effect of soft ICT capital on innovation performance of Greek firms. Journal of Enterprise Information Management, 26(6), 679-701. doi:10.1108/jeim-07-2013-0048ICT in small firms: Factors affecting the adoption and use of ICT in Southeast England SMEshttps://aisel.aisnet.org/ecis2008/167Legg, S. J., Olsen, K. B., Laird, I. S., & Hasle, P. (2015). Managing safety in small and medium enterprises. Safety Science, 71, 189-196. doi:10.1016/j.ssci.2014.11.007Podgórski, D. (2015). Measuring operational performance of OSH management system – A demonstration of AHP-based selection of leading key performance indicators. Safety Science, 73, 146-166. doi:10.1016/j.ssci.2014.11.018Cagno, E., Micheli, G. J. L., Masi, D., & Jacinto, C. (2013). Economic evaluation of OSH and its way to SMEs: A constructive review. Safety Science, 53, 134-152. doi:10.1016/j.ssci.2012.08.016Badri, A., Gbodossou, A., & Nadeau, S. (2012). Occupational health and safety risks: Towards the integration into project management. Safety Science, 50(2), 190-198. doi:10.1016/j.ssci.2011.08.008Carlson, R., Erixon, M., Forsberg, P., & Pålsson, A.-C. (2001). System for integrated business environmental information management. Advances in Environmental Research, 5(4), 369-375. doi:10.1016/s1093-0191(01)00088-0Florio, C., & Leoni, G. (2017). Enterprise risk management and firm performance: The Italian case. The British Accounting Review, 49(1), 56-74. doi:10.1016/j.bar.2016.08.003Aven, T., & Ylönen, M. (2018). A risk interpretation of sociotechnical safety perspectives. Reliability Engineering & System Safety, 175, 13-18. doi:10.1016/j.ress.2018.03.004Skorupinska, A., & Torrent-Sellens, J. (2017). ICT, Innovation and Productivity: Evidence Based on Eastern European Manufacturing Companies. Journal of the Knowledge Economy, 8(2), 768-788. doi:10.1007/s13132-016-0441-1Benitez‐Amado, J., Llorens‐Montes, F. J., & Nieves Perez‐Arostegui, M. (2010). Information technology‐enabled intrapreneurship culture and firm performance. Industrial Management & Data Systems, 110(4), 550-566. doi:10.1108/02635571011039025González-Posada, D. M., & Reyes-Bedoya, N. (2019). Herramientas de gestión al alcance: caso red de hostales de la ciudad de Medellín. Revista CEA, 5(9), 113-129. doi:10.22430/24223182.1261Hernandis Ortuño, B., & Briede Westermeyer, J. C. (2009). AN EDUCATIONAL APPLICATION FOR A PRODUCT DESIGN AND ENGINEERING SYSTEMS USING INTEGRATED CONCEPTUAL MODELS. Ingeniare. Revista chilena de ingeniería, 17(3). doi:10.4067/s0718-3305200900030001

Towards Automating the Construction & Maintenance of Attack Trees: a Feasibility Study

Security risk management can be applied on well-defined or existing systems; in this case, the objective is to identify existing vulnerabilities, assess the risks and provide for the adequate countermeasures. Security risk management can also be applied very early in the system's development life-cycle, when its architecture is still poorly defined; in this case, the objective is to positively influence the design work so as to produce a secure architecture from the start. The latter work is made difficult by the uncertainties on the architecture and the multiple round-trips required to keep the risk assessment study and the system architecture aligned. This is particularly true for very large projects running over many years. This paper addresses the issues raised by those risk assessment studies performed early in the system's development life-cycle. Based on industrial experience, it asserts that attack trees can help solve the human cognitive scalability issue related to securing those large, continuously-changing system-designs. However, big attack trees are difficult to build, and even more difficult to maintain. This paper therefore proposes a systematic approach to automate the construction and maintenance of such big attack trees, based on the system's operational and logical architectures, the system's traditional risk assessment study and a security knowledge database.Comment: In Proceedings GraMSec 2014, arXiv:1404.163

Integrisan model za upravljanje rizikom u standardizovanim menadžment sistemima

Nowadays organizations seek to use various management system standards (MSSs) in order to organize their management systems and improve the performance of their operations in the right way and then provide the necessary support to manage and address the risks associated with providing these products and services to clients and other stakeholders in addition to providing confidence and security to stakeholders. In this regard, as the first step, a research study has been carried out to analyze the number of companies that have standardized management systems (SMS) obtained for the standards ISO 9001, ISO14001, ISO 50001, ISO 27001, ISO 22000, ISO 13485, ISO 22301, ISO 20000-1, ISO 28000 and ISO 39001 across the continents in 2014, as a result of the increasing growth rate in the management system standards. Later in 2019, the research was conducted to analyze the growth rate of the certificates issued for the standards in addition to five other new standards that were added to the previous ones across the same continents. Based on those longitudinal analyses, according to obtained regression models, predictions were given and standards with the strongest growth trends were identified. However, till now has not been found a framework to define a common and unified standard model for integrated management systems that can be used in all contingency factors settings. Since, as the main objective of applying the standards of management systems in the organizations is to identify the risks that affect the organization's ability to achieve its goals and desired results in addition to organizing and coordinating all operations and the optimal use of resources, the purpose of this dissertation was to develop an integrated risk management model for standardized management systems with predicted growing trends: ISO 9001:2015, ISO 14001:2015, ISO/IEC 27001:2013, ISO 45001:2018 and ISO 22000:2018 in order to enable organizations to manage their processes and associated risks in manner to decrease the number of resources employed and to enhance the organization performance. Novel risk management integrated model in standardized management systems has three levels – correspondence, coordination and integration and put in place an explicit and systematic approach to managing all risks in the organization. Forms of certain documented information also encompass proposed model. Model has been checked empirically to analyze how organizations in Serbia integrate their MSs and their audits, as well as how they feel and act on risk management issues, all together with difficulties and time needed to integrate MSs, extent of integration of MSs in organizations overall, extent of integrated MS processes, resources and goals, extent of integration of the elements of audit systems and benefits of having integrated audits in organizations together with novel risk model check. Regarding integration, results similar to previous studies have been obtained. Contextual independence of proposed model has been checked using Mann-Whitney U*test and it has been proved that model is context free and applicable to companies different in size and sector. Also, performance indicators have been analyzed and 72% of positive and only 4.5% of negative attitudes have been reached. Accordingly, posted hypothesis have been proved and novel model enables companies to reach the defined goals of the company, as it is experimentally verified.Данас организације теже примени различитих стандарда система менаџмента како би организовале своје системе управљања и побољшале перформансе пословања на правилан и жељен начин, као и да би обезбедили потребну подршку за управљање ризицима при пружању производа и услуга клијентима и другим заинтересованим странама, уз стицање поверења код свих заинтересованих страна. Стога је најпре спроведенао истраживање, која је анализирало трендове раста број компанија које имају стандардизоване системе управљања (СМС) за стандарде ИСО 9001, ИСО14001, ИСО 50001, ИСО 27001, ИСО 22000, ИСО 13485, ИСО 22301, ИСО 20000-1, ИСО 28000 и ИСО 39001 широм света најпре у 2014. години, а затим и у 2018. години. Успостављени су лонгитудинални предиктивни регресиони модели и детерминисани су стандарди са највећим статистички значајним трендовима раста. Како до данас није расположив оквир који дефинише заједнички и обједињени модел интегрисаних система управљања који се могу користити независно од контекста, циљ ове дисертације била је израда интегрисаног модела управљања ризиком за стандардизоване системе управљања са високим трендом раста броја сертификата: ИСО 9001: 2015, ИСО 14001: 2015, ИСО / ИЕЦ 27001: 2013, ИСО 45001: 2018, и ИСО 22000: 2018 како би организације могле да управљају својим процесима и повезаним ризицима на интегрисан начин који смањује број ангажованих ресурса и омогућава побољшање перформанси организације. Новопредложени модел менаџмента ризиком у интегрисаним менаџмент системима има три нивоа – адекватност, координацију и интеграцију и пружа експлицитан, систематичан приступ управљању ризицима у организацијама. Модел је употпуњен и документованим информацијама од значаја за примену. Такође, модел је проверен у пракси методама анкетирања и интервуја, са циљем да се истражи начин и обим интеграције, спроведени аудити, тешкоће, користи и временски оквири интеграције, и применом факторске, регресионе анализе и анализе поузданости извршена је провера новопредложеног модела и утицаји на пословне перформансе. По питању интеграција, добијени су резултати подударни ретким претходним истраживањима. Контекстуална независност новопредложеног модела потврђена је применом Mann-Whitney U* теста. Модел је примењив у организацијама назависно од величине и припадности одређеном индустријском сектору. Такође, анализирани су индикатори пословних перформанси и резултати показују 72% позитивних и свега 4,5% негативних ставова. Коначно, постављене хипотезе су потврђене и модел омогућава предузећима остварење постављених циљева, сходно експерименталној верификацији

A Systems Approach to Information Security for the Twenty-First Century Organization

A crisis resulting from disruptive events that threaten to harm the organization or its stakeholders can originate from a plethora of sources. Data breaches, unauthorized disclosures of confidential information, and data leaks, are on the news almost daily. Most guidelines and standards published by prominent International Standards Organizations hold that risk-based thinking supports public, private, and community enterprises (referred for convenience in this work by the generic term “organization”) in determining the forces that could cause their key and enabling processes to deviate from planned arrangements, to apply preventive measures to modify risk, and to take advantage of opportunities as they arise. A well-structured Information Security Management System that is developed, implemented, and maintained through sound risk-based thinking, enables the organization to take appropriate actions to address the risks and opportunities associated with its information resources, in a manner that is commensurate to the complexity of its socio-technical infrastructure and the external environmentassociated with its activities. In this work we explore the Risk Management Process that is outlined in the ISO 31000 international standard, through the requirements/guidelines defined in the ISO/IEC 27000-series of international standards. The knowledge gained is applied to develop a systems driven conceptual structure thatcan be employed by any organization operating on the complexities of an interconnected environment, for the purpose of designing, implementing, monitoring, reviewing and continually improving a structured Information Security Management System

A national cybersecurity management framework for developing countries

Abstract : Please refer to full text to view abstract.D.Phil. (Computer Science

Readiness of local authorities in implementing information security management system (ISMS)

Information Security Management System (ISMS) is an ICT Compliance Standards to provide specifications and controls for protecting information security assets and to increase the integrity and confidence of clients against the agencies, especially those involving the government delivery service. This certification is certified by a certification body of the Standards Industrial Research Institute of Malaysia (SIRIM) and a survey covering the problems faced by Local Authorities in ensuring the confidentiality, integrity and availability of information from any threat and risks that can cripple the agency services. The research process include factors such as threats and vulnerabilities, particularly in security management practices of the agency, which can cause loss of agencies' information and negative impact on the services provided by the Local Authority. Then with studying these factors it can measure the readiness of local authorities in implementing Information Security Management System (ISMS). The process of research studies using quantitative methods in gathering information to analyze the problems faced by the agency to ensure information security is protected such as assessment taxes is the largest contributor earning council. The final result of this research concluded that local authorities are still not ready in implementing Information Security Management System (ISMS)