Context-sensitive Information security Risk identification and evaluation techniques
|Title||Context-sensitive Information security Risk identification and evaluation techniques|
|Publication Type||Conference Paper|
|Year of Publication||2014|
|Conference Name||22nd IEEE International Requirements Engineering Conference (RE14), Karlskrona, Sweden|
|Publisher||IEEE Computer Society|
The objective of my research is to improve and support the process of Information security Risk Assessment by designing a scalable Risk argumentation framework for socio-digital-technical Risk. Due to the various types of IT systems, diversity of architectures and dynamic nature of Risk, there is no one-size-fits all RA method. As such, the research hopes to identify guidelines for conducting Risk Assessments in contexts that raise special challenges such as Telecom and virtualized infrastructures. Finally, it will suggest ways of qualitatively and quantitatively evaluating Information Security Risks in such scenarios by using argumentation and/or modelling attacker business cases.