<abstract xmlns="http://www.w3.org/1999/xhtml"><p> For contemporary software systems, security is considered to be a key quality factor and the analysis of IT security risk becomes an indispensable stage during software deployment. However, performing risk assessment according to methodologies and standards issued for the public sector or large institutions can be too costly and time consuming. Current business practice tends to circumvent risk assessment by defining sets of standard safeguards and applying them to all developed systems. This leads to a substantial gap: threats are not re-evaluated for particular systems and the selection of security functions is not based on risk models. This paper discusses a new lightweight risk assessment method aimed at filling this gap. In this proposal, Fuzzy Cognitive Maps (FCMs) are used to capture dependencies between assets, and FCM-based reasoning is performed to calculate risks. An application of the method is studied using an example of an e-health system providing remote telemonitoring, data storage and teleconsultation services. Lessons learned indicate that the proposed method is an efficient and low-cost approach, giving instantaneous feedback and enabling reasoning on the effectiveness of the security system.</p></abstract>

For contemporary software systems, security is considered to be a key quality factor and the analysis of IT security risk becomes an indispensable stage during software deployment. However, performing risk assessment according to methodologies and standards issued for the public sector or large institutions can be too costly and time consuming. Current business practice tends to circumvent risk assessment by defining sets of standard safeguards and applying them to all developed systems. This leads to a substantial gap: threats are not re-evaluated for particular systems and the selection of security functions is not based on risk models. This paper discusses a new lightweight risk assessment method aimed at filling this gap. In this proposal, Fuzzy Cognitive Maps (FCMs) are used to capture dependencies between assets, and FCM-based reasoning is performed to calculate risks. An application of the method is studied using an example of an e-health system providing remote telemonitoring, data storage and teleconsultation services. Lessons learned indicate that the proposed method is an efficient and low-cost approach, giving instantaneous feedback and enabling reasoning on the effectiveness of the security system.

A new lightweight method for security risk assessment based on fuzzy cognitive maps

Department of Applied Computer Science AGH University of Science and Technology, al. Mickiewicza 30, 30-059 Cracow, Poland

International Journal of Applied Mathematics and Computer Science

For contemporary software systems, security is considered to be a key quality factor and the analysis of IT security risk becomes an indispensable stage during...

A new lightweight method for security risk assessment based on fuzzy cognitive maps

Published Online: Mar 25, 2014

Page range: 213 - 225

DOI: https://doi.org/10.2478/amcs-2014-0016

Keywords
security, risk assessment, telemedicine, fuzzy cognitive maps.

This content is open access.

A new lightweight method for security risk assessment based on fuzzy cognitive maps

Published Online: Mar 25, 2014

Page range: 213 - 225

DOI: https://doi.org/10.2478/amcs-2014-0016

Keywordssecurity, risk assessment, telemedicine, fuzzy cognitive maps.

This content is open access.

Keywords
security, risk assessment, telemedicine, fuzzy cognitive maps.