A graph-based risk assessment and prediction in IT systems

• Autorzy: El Fray I. , Pejaś J.

Identyfikatory

DOI

10.15199/48.2017.01.22

Warianty tytułu

PL

Model teorii grafów do szacowania ryzyka w systemach informatycznych

• Języki publikacji: EN

Abstrakty

EN

In this paper we propose a graph-based model for the description of a risk analysis process and a risk calculation in IT systems. Our model based on a graph (Graph Risk model in short) is compliant with international standards and recommendations. The graph model for risk assessment includes the best practices in IT Governance. Based on the proposed model there is possible to describe the structure of the security system, its components and relations, and then to make risk calculations for each embedded component of the evaluated system. Moreover, it allows to compare results obtained using different risk analysis method in the context of compliance with standards and recommendations. A simple example given at the end of this paper illustrates how to apply the proposed model to describe the security system and calculate its final risk values.

PL

W artykule zaproponowano oparty na teorii grafów model opisu procesu analizy i oceny ryzyka w systemach informatycznych. Model ten (w skrócie model grafu ryzyk) jest zgodny z międzynarodowymi standardami i zaleceniami. Model grafowy do szacowania ryzyka budowany jest w oparciu o dobre praktyki z zakresu zarządzania IT. W oparciu o zaproponowany model możliwe jest opisanie struktury systemu bezpieczeństwa, jego komponentów i ich relacji, a następnie oszacowanie ryzyka każdego komponentu ocenianego systemu. Ponadto, proponowany model pozwala na porównanie wyników z innymi wynikami uzyskanymi za pomocą metody analizy ryzyka „FoMRA” w kontekście zgodności z normami i zaleceniami. Na końcu niniejszego artykułu podany jest przykład pokazujący, jak zastosować proponowany model do opisania systemu bezpieczeństwa SI i obliczyć jego wagę ryzyka.

Słowa kluczowe

EN

risk analysis; risk management; risk analysis method; graph-based model

PL

analiza ryzyka; zarządzanie ryzykiem; metoda analizy ryzyka; model grafowy

• Wydawca: Wydawnictwo SIGMA-NOT
• Czasopismo: Przegląd Elektrotechniczny
• Rocznik: 2017
• Tom: R. 93, nr 1
• Strony: 91--95
• Opis fizyczny: Bibliogr. 28 poz., rys., tab.

Twórcy

autor

El Fray I.

• Warsaw University of Life Sciences, Faculty of Applied Informatics and Mathematics, ul. Nowoursynowska 159, 02-776 Warszawa
• Zachodniopomorski Uniwersytet Technologiczny w Szczecinie, Katedra Inżynierii Oprogramowania, ul. Żołnierska 52, 71-210 Szczecin

autor

Pejaś J.

• Zachodniopomorski Uniwersytet Technologiczny w Szczecinie, Katedra Inżynierii Oprogramowania, ul. Żołnierska 52, 71-210 Szczecin

Bibliografia

• [1] PN-ISO/IEC 13335-1 Information technology -- Security techniques -- Management of information and communications technology security -- Part 1: Concepts and models for information and communications technology security management, :1999
• [2] PN-ISO/IEC 27002 Information technology -- Security techniques -- Code of practice for information security management, 2014
• [3] PN-ISO/IEC 27001 Information technology -- Security techniques -- Information security management systems – Requirements, 2014
• [4] ISO/IEC 27003 Information technology – Security techniques – Information security management system implementation guidance, 2010
• [5] ISO/IEC 27005 Information technology -- Security techniques - - Information security risk management, 2014
• [6] El Fray, I., A comparative study of risk assessment methods, MEHARI & CRAMM with a new formal model of risk assessment (FoMRA) in information systems. Computer Information Systems and Industrial Management. Springer Berlin Heidelberg, (2012), 428-442
• [7] Federal Information Processing Standard (FIPS) 65, Guideline for Automatic Data Processing Risk Analysis, National Bureau of Standard, US 1979
• [8] R. Baskerville: Information Systems Security Design Methods: Implications for Information Systems Development, Computing Surveys 25 (4), 1993, 375-414
• [9] D. B. Parker, Computer Security Management, Reston Publishing Company Inc., Reston VA, 1981
• [10] Méthodologie d'Analyse des Risques Informatique et d'Optimation par Niveau « MARION », CLUSIF, France 1998
• [11] Méthode Harmonisée d'Analyse de Risques « MEHARI » CLUSIF, France 2007
• [12] Microsoft Security Assessment Tool « MSAT », http://technet. Microsoft.com/en-us/security/cc18512.aspx
• [13] G. Stoneburner, A. Goguen, A. Feringa, Risk Management Guide for Information Technology Systems, Recommendations of the National Institute of Standards and Technology, Technology Administration. U.S. Department of Commerce, Special Publication 800-30, Washington DC 2002
• [14] CCTA Risk Analysis and Management Method « CRAMM », Central Computing and Telecommunications Agency, United Kingdom Government, UK 1987
• [15] Consultative, Objective and Bi-functional Risk Analysis « COBRA », Disaster Recovery Planning Group, UK 1991
• [16] Operationally Critical Threat, Asset, and Vulnerability Evaluation « OCTAVE » Carnegie Mellon University, US 2006
• [17] Control Objectives for Information and related Technology « COBIT » ISACA, IT Governance Institute, US 2007
• [18] K. Pickard, P. Muller, B. Bertsche, Multiple failure mode and effects analysis-an approach to risk assessment of multiple failures with FMEA. IEEE Xplore, 2005
• [19] R. Ferdous, F .I. Khan, B. Veitch, P. R. Amyotte: Methodology for computer-aided faulttreeanalysis, Elsevier, 85 (1), 2007, 70- 80
• [20] M. Rausand: System Analysis Event Tree Analysis, 2005
• [21] J.D. Andrews, L.M. Ridley: Application of the causeconsequence diagram method to static systems, Elsevier, 75 (1), 2002, 47-58
• [22] M. Ferjencik, R. Kuracina: Mort worksheet or how to make mort analysis easy, Elsevier, 151 (1), 2008, 143-154
• [23] Nri mort user’s manual second edition, 2009
• [24] A. HakobyanT. Aldemir, R. Denning, S. Dunagan, D. Kunsman, B. Rutt, U. Katalyurek: Dynamic generation of accident progression event trees, Elsevier, 238 (12), 2008, 3457-3467
• [25] M. Bartlett, E. E. Hurdle, E. M. Kelly: Integrated system fault diagnostics utilising digraph and fault tree-based approaches, Elsevier, 94 (6), 2009, 1107-1115
• [26] J. Kontio: Risk management, compliance and competitive advantage: process, responsibilities and stakeholders”, 2008
• [27] S. M. Jacoub, H. H. Ammar: A methodology for architecturallevel reliability risk analysis, IEEE Transctions on Softwre Engineering, 28 (6), 2002, 529-547
• [28] Reliability/availability of electrical & mechanical systems for command, control, communications, computer, intelligence, surveillance and reconnaissance (c4isr) facilities, 200727

Uwagi

Opracowanie ze środków MNiSW w ramach umowy 812/P-DUN/2016 na działalność upowszechniającą naukę (zadania 2017).