IDEAS home Printed from https://ideas.repec.org/a/eee/ininma/v36y2016i1p25-34.html

Information security risk analysis model using fuzzy decision theory

Author

Listed:
  • de Gusmão, Ana Paula Henriques
  • e Silva, Lúcio Camara
  • Silva, Maisa Mendonça
  • Poleto, Thiago
  • Costa, Ana Paula Cabral Seixas

Abstract

This paper proposes a risk analysis model for information security assessment, which identifies and evaluates the sequence of events – referred to as alternatives – in a potential accident scenario following the occurrence of an initiating event corresponding to abuses of Information Technology systems. In order to perform this evaluation, this work suggests the use of Event Tree Analysis combined with fuzzy decision theory. The contributions of the present proposal are: the development of a taxonomy of events and scenarios, the ranking of alternatives based on the criticality of the risk, considering financial losses, and finally, the provision of information regarding the causes of information system attacks of highest managerial relevance for organizations. We included an illustrative example regarding a data center aiming to illustrate the applicability of the proposed model. To assess its robustness, we analyzed twelve alternatives considering two different methods of setting probabilities of the occurrence of events. Results showed that deliberate external database services attack represent the most risky alternative.

Suggested Citation

  • de Gusmão, Ana Paula Henriques & e Silva, Lúcio Camara & Silva, Maisa Mendonça & Poleto, Thiago & Costa, Ana Paula Cabral Seixas, 2016. "Information security risk analysis model using fuzzy decision theory," International Journal of Information Management, Elsevier, vol. 36(1), pages 25-34.
    • Handle: RePEc:eee:ininma:v:36:y:2016:i:1:p:25-34
    DOI: 10.1016/j.ijinfomgt.2015.09.003
    as

    Download full text from publisher

    File URL: http://www.sciencedirect.com/science/article/pii/S0268401215000900
    Download Restriction: Full text for ScienceDirect subscribers only
    File URL: https://libkey.io/10.1016/j.ijinfomgt.2015.09.003?utm_source=ideas
    LibKey link: if access is restricted and if your library uses this service, LibKey will redirect you to where you can use your library subscription to access this item
    ---><---

    As the access to this document is restricted, you may want to

    for a different version of it.

    References listed on IDEAS

    as
    1. Adiel Teixeira de Almeida & Cristiano Alexandre Virgínio Cavalcante & Marcelo Hazin Alencar & Rodrigo José Pires Ferreira & Adiel Teixeira de Almeida-Filho & Thalles Vitelli Garcez, 2015. "Multicriteria and Multiobjective Models for Risk, Reliability and Maintenance Decision Analysis," International Series in Operations Research and Management Science, Springer, edition 127, number 978-3-319-17969-8, February.
    2. Cooke, Roger M. & ElSaadany, Susie & Huang, Xinzheng, 2008. "On the performance of social network and likelihood-based expert weighting schemes," Reliability Engineering and System Safety, Elsevier, vol. 93(5), pages 745-756.
    3. Brender, Nathalie & Markov, Iliya, 2013. "Risk perception and risk management in cloud computing: Results from a case study of Swiss companies," International Journal of Information Management, Elsevier, vol. 33(5), pages 726-733.
    4. Silva, Maisa Mendonça & de Gusmão, Ana Paula Henriques & Poleto, Thiago & Silva, Lúcio Camara e & Costa, Ana Paula Cabral Seixas, 2014. "A multidimensional approach to information security risk management using FMEA and fuzzy theory," International Journal of Information Management, Elsevier, vol. 34(6), pages 733-740.
    5. Brito, A.J. & de Almeida, A.T., 2009. "Multi-attribute risk assessment for risk ranking of natural gas pipelines," Reliability Engineering and System Safety, Elsevier, vol. 94(2), pages 187-198.
    6. Rosqvist, Tony & Molarius, Riitta & Virta, Hanna & Perrels, Adriaan, 2013. "Event tree analysis for flood protection—An exploratory study in Finland," Reliability Engineering and System Safety, Elsevier, vol. 112(C), pages 1-7.
    7. Rasheed, Hassan, 2014. "Data and infrastructure security auditing in cloud computing environments," International Journal of Information Management, Elsevier, vol. 34(3), pages 364-368.
    8. Grant, Kevin & Edgar, David & Sukumar, Arun & Meyer, Martin, 2014. "‘Risky business’: Perceptions of e-business risk by UK small and medium sized enterprises (SMEs)," International Journal of Information Management, Elsevier, vol. 34(2), pages 99-122.
    9. Garcez, Thalles Vitelli & de Almeida, Adiel Teixeira, 2014. "A risk measurement tool for an underground electricity distribution system considering the consequences and uncertainties of manhole events," Reliability Engineering and System Safety, Elsevier, vol. 124(C), pages 68-80.
    10. Bojanc, Rok & Jerman-Blažič, Borka, 2008. "An economic modelling approach to information security risk management," International Journal of Information Management, Elsevier, vol. 28(5), pages 413-422.
    Full references (including those not matched with items on IDEAS)

    Citations

    Citations are extracted by the CitEc Project, subscribe to its RSS feed for this item.
    as


    Cited by:

    1. Henriques de Gusmão, Ana Paula & Mendonça Silva, Maisa & Poleto, Thiago & Camara e Silva, Lúcio & Cabral Seixas Costa, Ana Paula, 2018. "Cybersecurity risk analysis model using fault tree analysis and fuzzy decision theory," International Journal of Information Management, Elsevier, vol. 43(C), pages 248-260.

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Henriques de Gusmão, Ana Paula & Mendonça Silva, Maisa & Poleto, Thiago & Camara e Silva, Lúcio & Cabral Seixas Costa, Ana Paula, 2018. "Cybersecurity risk analysis model using fault tree analysis and fuzzy decision theory," International Journal of Information Management, Elsevier, vol. 43(C), pages 248-260.
    2. Haqaf, Husam & Koyuncu, Murat, 2018. "Understanding key skills for information security managers," International Journal of Information Management, Elsevier, vol. 43(C), pages 165-172.
    3. Medeiros, Cristina Pereira & da Silva, Lucas Borges Leal & Alencar, Marcelo Hazin & de Almeida, Adiel Teixeira, 2021. "A new method for managing multidimensional risks in Natural Gas Pipelines based on non-Expected Utility," Reliability Engineering and System Safety, Elsevier, vol. 214(C).
    4. Rogerson, Ellen C. & Lambert, James H., 2012. "Prioritizing risks via several expert perspectives with application to runway safety," Reliability Engineering and System Safety, Elsevier, vol. 103(C), pages 22-34.
    5. Marlow, David R. & Beale, David J. & Mashford, John S., 2012. "Risk-based prioritization and its application to inspection of valves in the water sector," Reliability Engineering and System Safety, Elsevier, vol. 100(C), pages 67-74.
    6. Martín León-Santiesteban & Martha Cecilia Mendez-Prada & Yolanda Patricia Cardona-Arce & Nelly Guerrero-Mosquera, 2023. "Multicriteria Model for Measuring the Potential of Cultural Identity in the Tourism Development of Sincelejo, Colombia," Sustainability, MDPI, vol. 15(20), pages 1-15, October.
    7. Shie, An-Jin & Xu, En-Min & Wang, Yunyu & Yang, Ming & Wu, Yenchun Jim, 2025. "Emotional needs and service process optimization in combined medical and elder care: A TRIZ approach," Technovation, Elsevier, vol. 143(C).
    8. Marie-Anne Le-Dain & Lamiae Benhayoun & Judy Matthews & Marine Liard, 2023. "Barriers and opportunities of digital servitization for SMEs: the effect of smart Product-Service System business models," Service Business, Springer;Pan-Pacific Business Association, vol. 17(1), pages 359-393, March.
    9. Yin, Yuanbo & Yang, Hao & Duan, Pengfei & Li, Luling & Zio, Enrico & Liu, Cuiwei & Li, Yuxing, 2022. "Improved quantitative risk assessment of a natural gas pipeline considering high-consequence areas," Reliability Engineering and System Safety, Elsevier, vol. 225(C).
    10. Thalles Vitelli Garcez & Helder Tenório Cavalcanti & Adiel Teixeira de Almeida, 2021. "A hybrid decision support model using Grey Relational Analysis and the Additive-Veto Model for solving multicriteria decision-making problems: an approach to supplier selection," Annals of Operations Research, Springer, vol. 304(1), pages 199-231, September.
    11. Erin Baker & Olaitan Olaleye, 2013. "Combining Experts: Decomposition and Aggregation Order," Risk Analysis, John Wiley & Sons, vol. 33(6), pages 1116-1127, June.
    12. Deepa Mishra & Sameer Kumar & Elkafi Hassini, 2019. "Current trends in disaster management simulation modelling research," Annals of Operations Research, Springer, vol. 283(1), pages 1387-1411, December.
    13. Bolger, Fergus & Wright, George, 2017. "Use of expert knowledge to anticipate the future: Issues, analysis and directions," International Journal of Forecasting, Elsevier, vol. 33(1), pages 230-243.
    14. Casado, Ramon Swell Gomes Rodrigues & Alencar, Marcelo Hazin & de Almeida, Adiel Teixeira, 2022. "Combining a multidimensional risk evaluation with an implicit enumeration algorithm to tackle the portfolio selection problem of a natural gas pipeline," Reliability Engineering and System Safety, Elsevier, vol. 221(C).
    15. Antonio Pievatolo & Fabrizio Ruggeri & Refik Soyer & Simon Wilson, 2021. "Decisions in Risk and Reliability: An Explanatory Perspective," Stats, MDPI, vol. 4(2), pages 1-23, March.
    16. Wang, Tien & Duong, Trong Danh & Chen, Charlie C., 2016. "Intention to disclose personal information via mobile applications: A privacy calculus perspective," International Journal of Information Management, Elsevier, vol. 36(4), pages 531-542.
    17. Himanshu Gupta & Kumar Shreshth & Manjeet Kharub & Ashwani Kumar, 2024. "Strategies to overcome challenges to smart sustainable logistics: a Bayesian-based group decision-making approach," Environment, Development and Sustainability: A Multidisciplinary Approach to the Theory and Practice of Sustainable Development, Springer, vol. 26(5), pages 11743-11770, May.
    18. Martin Eling & Michael McShane & Trung Nguyen, 2021. "Cyber risk management: History and future research directions," Risk Management and Insurance Review, American Risk and Insurance Association, vol. 24(1), pages 93-125, March.
    19. Flandoli, F. & Giorgi, E. & Aspinall, W.P. & Neri, A., 2011. "Comparison of a new expert elicitation model with the Classical Model, equal weights and single experts, using a cross-validation technique," Reliability Engineering and System Safety, Elsevier, vol. 96(10), pages 1292-1310.
    20. João Batista Sarmento dos Santos-Neto & Ana Paula Cabral Seixas Costa, 2023. "A Multi-Criteria Decision-Making Model for Selecting a Maturity Model," International Journal of Decision Support System Technology (IJDSST), IGI Global Scientific Publishing, vol. 15(1), pages 1-15, January.

    More about this item

    Keywords

    ;
    ;
    ;

    Statistics

    Access and download statistics

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:eee:ininma:v:36:y:2016:i:1:p:25-34. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: Catherine Liu (email available below). General contact details of provider: https://www.journals.elsevier.com/international-journal-of-information-management .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.