Search

There are a number of standards and frameworks for security risk assessment; however, it appears that their application and adaptation to real organisational practices are rather limited. This paper reports some results from inquiries into risk assessment practices of security professionals in Ireland. The key findings show a lack of consensus on basic terminology when it comes to defining risk and risk assessment. The interviewed security professionals have developed varied approaches in practice and rather refer to their intuition and previous experiences. While the paper focuses on Ireland, the lack of consensus regarding the definition, and use of security terminology and practices, especially in the area of security risk management, is not necessarily limited to Ireland. [ABSTRACT FROM AUTHOR]

Pei-Cheng Yeh,1,2 Kuen-Wei Yeh,3– 5 Jiun-Lang Huang6,7 1Graduate Institute of Clinical Dentistry, School of Dentistry, College of Medicine, National Taiwan University, Taipei, Taiwan, Republic of China; 2Division of Endodontics, Department of Stomatology, Taichung Veterans General Hospital, Taichung, Taiwan, Republic of China; 3Investigation Bureau, Ministry of Justice, New Taipei City, Taiwan, Republic of China; 4Department of Electrical Engineering, Chinese Culture University, Taipei, Taiwan, Republic of China; 5Department of Information, Chinese Culture University, Taipei, Taiwan, Republic of China; 6Department of Electrical Engineering, National Taiwan University, Taipei, Taiwan, Republic of China; 7Graduate Institute of Electronics Engineering, National Taiwan University, Taipei, Taiwan, Republic of ChinaCorrespondence: Kuen-Wei Yeh, Email m49009@mjib.gov.twBackground: Growing cyberattacks have made it more challenging to maintain healthcare information system (HIS) security in medical institutes, especially for hospitals that provide patient portals to access patient information, such as electronic health record (EHR).Objective: This work aims to evaluate the patient portal security risk of Taiwan’s EEC (EMR Exchange Center) member hospitals and analyze the association between patient portal security, hospital location, contract category and hospital type.Methods: We first collected the basic information of EEC member hospitals, including hospital location, contract category and hospital type. Then, the patient portal security of individual hospitals was evaluated by a well-known vulnerability scanner, UPGUARD, to assess website if vulnerable to high-level attacks such as denial of service attacks or ransomware attacks. Based on their UPSCAN scores, hospitals were classified into four security ratings: absolute low risk, low to medium risk, medium to high risk and high risk. Finally, the associations between security rating, contract category and hospital type were analyzed using chi-square tests.Results: We surveyed a total of 373 EEC member hospitals. Among them, 20 hospital patient portals were rated as “absolute low risk”, 104 hospital patient portals as “low to medium risk”, 99 hospital patient portals as “medium to high risk” and 150 hospital patient portals as “high risk”. Further investigation revealed that the patient portal security of EEC member hospitals was significantly associated with the contract category and hospital type (P< 0.001).Conclusion: The analysis results showed that large-scale hospitals generally had higher security levels, implying that the security of low-tier and small-scale hospitals may warrant reinforcement or strengthening. We suggest that hospitals should pay attention to the security risk assessment of their patient portals to preserve patient information privacy.Keywords: security risk assessment, healthcare information system, electronic health record, electronic medical record, EMR Exchange Center, vulnerability scanner

The ecological and geological problems caused by the rise of groundwater level due to the development of underground space in cold and arid canyon cities are particularly typical. Reasonably assessing the ecological and geological security risks of utilizing underground space is conducive to reducing the occurrence of ecological and geological problems during the construction and operation of underground engineering projects. Taking Ping'an District of Haidong City as an example, the topography and geomorphology of the research area were investigated in the field, and the distribution of topography and geomorphology in the research area was understood; through geological drilling and geotechnical engineering testing, the distribution of different strata in the research area was obtained; through pumping and seepage experiments, the recharge, runoff, and discharge relationship between surface water and groundwater in the research area and the water abundance of different strata are obtained, and the causes and mechanisms of geological safety risks in forest and grassland ecosystems, farmland ecosystems, and human settlements ecosystems were analyzed based on literature. Corresponding ecological geological safety risk assessment index systems and methods were established, and the ecological geological safety risks before and after the development of underground rail transit projects along both banks of the Huangshui River in the study area were evaluated. Practitioner Points: The development of underground space in canyon type cities can easily lead to ecological and geological problems.Taking Haidong City, Qinghai Province, as an example, this study investigates the causes of ecological and geological problems caused by the development of underground spaces in canyon type cities.An ecological geological security risk assessment index system and method for canyon‐type cities were established.An evaluation was conducted on the ecological and geological safety risks before and after the development of the underground rail transit projects on both sides of the research area. [ABSTRACT FROM AUTHOR]

This study aims to protect software development by creating a Software Risk Assessment (SRA) model for each phase of the Software Development Life Cycle (SDLC) using an Adaptive Neuro-Fuzzy Inference System (ANFIS) model. Software developers discovered and validated the risk variables affecting each SDLC phase, following which relevant data about risk factors and associated SRA for each SDLC phase were collected. To create the SRA model for SDLC phases, risk factors were used as inputs, and SRA was used as an output. The formulated model was simulated using 70 % and 80 % of the data for training, while 30 % and 20 % were used for testing the model. The performance of the SRA models using the test datasets was evaluated based on accuracy. According to the study findings, many risk variables were discovered and confirmed for the requirement, design, implementation, integration, and operation phases of SDLC 11, 8, 9, 4, and 6, respectively. The SRA model was formulated using the risk factors using 2048, 256, 512, 16, and 64 inference rules for the requirement, design, implementation, integration, and operation phases, respectively. The study concluded that using the SRA model to assess security risk at each SDLC phase provided a secured software development process.

Copyright of Transportation Science & Technolgy is the property of Transportation Science & Technology Editorial Office and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Blockchain (BC) has recently paved the way for developing Decentralized Identity Management (IdM) systems for different information systems. Researchers widely use it to develop decentralized IdM systems for the Health Internet of Things (HIoT). HIoT is considered a vulnerable system that produces and processes sensitive data. BC-based IdM systems have the potential to be more secure and privacy-aware than centralized IdM systems. However, many studies have shown potential security risks to using BC. A Systematic Literature Review (SLR) conducted by the authors on BC-based IdM systems in HIoT systems showed a lack of comprehensive security and risk management frameworks for BC-based IdM systems in HIoT. Conducting a further SLR focusing on risk management and supplemented by Grey Literature (GL), in this paper, a security taxonomy, security framework, and cybersecurity risk management framework for the HIoT BC-IdM systems are identified and proposed. The cybersecurity risk management framework will significantly assist developers, researchers, and organizations in developing a secure BC-based IdM to ensure HIoT users' data privacy and security. [ABSTRACT FROM AUTHOR]

With the increasing digitalization and informatization of distribution network systems, distribution networks have gradually developed into distribution network cyber physical systems (CPS) which are deeply integrated with traditional power systems and cyber systems. However, at the same time, the network risk problems that the cyber systems face have also increased. Considering the possible cyber attack vulnerabilities in the distribution network CPS, a dynamic Bayesian network approach is proposed in this paper to quantitatively assess the security risk of the distribution network CPS. First, the Bayesian network model is constructed based on the structure of the distribution network and common vulnerability scoring system (CVSS). Second, a combination of the fuzzy analytic hierarchy process (FAHP) and entropy weight method is used to correct the selectivity of the attacker to strike the target when cyber attack vulnerabilities occur, and then after considering the defense resources of the system, the risk probability of the target nodes is obtained. Finally, the node loads and node risk rates are used to quantitatively assess the risk values that are applied to determine the risk level of the distribution network CPS, so that defense strategies can be given in advance to counter the adverse effects of cyber attack vulnerabilities. [ABSTRACT FROM AUTHOR]

Key nodes of sea lanes are important hubs for global trade and cargo transportation and play important roles in ensuring the safety of maritime transportation and maintaining the stability of the global supply chain. The safety guarantee of key nodes of sea lanes is facing more risks and higher requirements currently because the global shipping industry is gradually recovering. This paper focuses on key nodes of sea lanes, conducting regional security risk assessment and risk spatial scale visualization. A set of security risk assessment and visualization study methods for key nodes of sea lanes is constructed, which includes constructing a security risk assessment index system of key nodes of sea lanes with 25 indicators selected from three risk categories (hazard, vulnerability and exposure, and mitigation capacity) and using geospatial analysis to form the multi-criteria spatial mapping layers and then creating comprehensive risk layers to realize the risk visualization in the strait area by weighted overlaying based on the combined weights calculated by Analytic Hierarchy Process and Grey Relational Analysis. After taking the Tsugaru Strait and Makassar Strait as case studies, the results show that the comprehensive risk layers can effectively present the spatial distribution of security risks of key nodes of sea lanes, reflecting the spatial changes of risk levels (i.e., very low, low, medium, high and very high) and the methods can precisely identify and analyze crucial factors affecting the security risk of key nodes. These findings may strengthen the risk prevention and improve the safety of the navigation environment in the strait to ensure the safety and stability of maritime trade. [ABSTRACT FROM AUTHOR]

In the related literature, conventional approaches to assessing security risk and prioritising bridges have focused on unique characteristics. Although the unique characteristics appropriately reflect the economic and social consequences of failure, they neglect the consequences of a bridge failure at the network level. If network owners and operators prioritise bridges solely based on their unique characteristics, bridges with low object-level importance and high network-level importance have very low chances to get priority. In this paper, a bridge importance measurement index α(e) has been presented, prioritising bridges based on their unique characteristics, location and network topology. To describe how to use this index α(e), three numerical examples were provided. While the first example was related to a simple hypothetical network, the second and third examples were real networks related to the bridges of Wroclaw city. Using these examples, the results of bridge prioritisation obtained in the unique-characteristics-only state were compared to the state in which α(e) had been used. Results showed that considering the location of the bridge and the topological characteristics of the network change the bridges prioritisation. For instance, in the second example, it was observed that the use of the α(e), made bridge Bolesława Krzywoustego the essential bridge, while bridge Grunwaldzki was the essential bridge under the previous prioritisation made by researchers. However, the results of the third example showed that bridge Milenijny, which was considered the essential network bridge as stated in the previous prioritisation made by researchers, was again selected as the most critical bridge based on the α(e).

The industrial internet depends on the development of cloud computing, artificial intelligence, and big data analysis. Intelligent fusion is dependent on the architecture and security features of the industrial internet. Firstly, the paper studies the infrastructure mode that needs to be solved urgently in the industrial internet and provides a possible infrastructure mode and related security evaluation system. Secondly, it analyses the digital transformation process with the case of G.E.os industrial nternet development practice. It clarifies that G.E. is forming a new value closed-loop through digital and strategy mixed channels. Thirdly, industrial internet security research is described within multiple viewpoints based on industrial internet applications, the security service and security assurance defense systemos architecture, and the non-user entrance probability model. Finally, the paper illustrates the changes in knowledge workflow and social collaboration caused by the industrial internet under intelligent manufacture.

In the field of software development, the efficient prioritizing of software risks was essential and play significant roles. However, finding a viable solution to this issue is a difficult challenge. The software developers have to adhere strictly to risk management practice because each phase of SDLC is faced with its individual type of risk rather than considering it as a general risk. Therefore, this study proposes an adaptive neuro-fuzzy inference system (ANFIS) for selection of appropriate risk factors in each stages of software development process. Existing studies viewed the SDLC's Security risk assessment (SRA) as a single integrated process that did not offer a thorough SRA at each stage of the SDLC process, which resulted in unsecure software development. Hence, this study identify and validate the risk factors needed for assessing security risk at each phase of SDLC. For each phase, an SRA model based on an ANFIS was suggested, using the identified risk factors as inputs. For the logical representation of the fuzzification as an input and output variables of the SRA risk factors for the ANFIS-based model employing the triangular membership functions. The proposed model utilized two triangular membership functions to represent each risk factor's label, while four membership functions were used to represent the labels of the target SRA value. Software developers chose the SRA risk factors that were pertinent in their situation from the proposed taxonomy for each level of the SDLC process as revealed by the results. As revealed from the study's findings, knowledge of the identified risk factors may be valuable for evaluating the security risk throughout the SDLC process. [ABSTRACT FROM AUTHOR]

Trusted computing has received further attention as an effective technique to safeguani information systems, and it has been widely applied in various fields. Trusted chain establishment, as an essential model of trusted comptiting technology that ensures the credibility of the computing platform, still brings poor system elficiency due to the complex environment of the platform. To optimize the procedure of trusted chain establishment for trusted computing platforms, our research improved traditional trusted chain establishment from static to dynamic with innovative security risk level assessment step during trusted chain establishment. First, we comprehensively analyzed threats and their source for platforms. Based on the main indicators of the platform, the fixed weight clustering evaluation method in the grey system theory was used to evaluate the security risk level for platforms. With the recorded data of software and hardware changes for the platform, we assessed the security risk level for this platform and demonstrated the clustering results and improved measurement strategy for the platform during trusted chain establishment. It is more systematic and more efficient than the traditional static trusted chain establishment method, which could find more files tampered during the measurement procedure. [ABSTRACT FROM AUTHOR]

Life-critical embedded systems, including medical devices, are becoming increasingly interconnected and interoperable, providing great efficiency to the healthcare ecosystem. These systems incorporate complex software that plays a significantly integrative and critical role. However, this complexity substantially increases the potential for cybersecurity threats, which directly impact patients' safety and privacy. With software continuing to play a fundamental role in life-critical embedded systems, maintaining its trustworthiness by incorporating fail-safe modes via a multimodal design is essential. Comprehensive and proactive evaluation and management of cybersecurity risks are essential from the very design to deployment and long-term management. In this paper, we present FIRE, a finely integrated risk evaluation methodology for life-critical embedded systems. Security risks are carefully evaluated in a bottom-up approach from operations-to-system modes by adopting and expanding well-established vulnerability scoring schemes for life-critical systems, considering the impact to patient health and data sensitivity. FIRE combines a static risk evaluation with runtime dynamic risk evaluation to establish comprehensive risk management throughout the lifecycle of the life-critical embedded system. We demonstrate the details and effectiveness of our methodology in systematically evaluating risks and conditions for risk mitigation with a smart connected insulin pump case study. Under normal conditions and eight different malware threats, the experimental results demonstrate effective threat mitigation by mode switching with a 0% false-positive mode switching rate. [ABSTRACT FROM AUTHOR]

The positioning system based on satellite navigation can meet the requirements of CTCS-4 train control, improve the transportation efficiency, reduce the operation and maintenance costs, which is the trend of train positioning system in the future, and the security risk assessment is of great significance to the future application of this system. In this paper, combined with the self-developed train positioning system based on satellite navigation, and an improved fault tree-interval analytic hierarchy process (FTA-IAHP) method for evaluating the safety risk of train positioning system is proposed. Firstly, a security risk assessment model based on FTA-IAHP is established by combining FTA and IAHP. Secondly, two judgment matrices are constructed by using the basic events and structural importance based on FTA, and the IAHP model based on expert scoring, the difference between FTA and IAHP is adjusted by combining the weighting factor. The new method of trial of weighting can determine the degree of each factor in the system fault. This method has great significance to the safety design and protection of the new train positioning system based on satellite navigation. [ABSTRACT FROM AUTHOR]

The current power distribution Internet of Things (PDIoT) lacks security protection terminals and techniques. Network security has a large exposure surface that can be attacked from multiple paths. In addition, there are many network security vulnerabilities and weak security protection capabilities of power distribution Internet of Things terminals. Therefore, it is crucial to conduct a scientific assessment of the security of PDIoT. However, traditional security assessment methods are relatively subjective and ambiguous. To address the problems, we propose to use the entropy-weight method and cloud model theory to assess the security risk of the PDIoT. We first analyze the factors of security risks in PDIoT systems and establish a three-layer PDIoT security evaluation index system, including a perception layer, network layer, and application layer. The index system has three first-level indicators and sixteen second-level indicators. Then, the entropy-weight method is used to optimize the weight of each index. Additionally, the cloud model theory is employed to calculate the affiliation degree and eigenvalue of each evaluation index. Based on a comprehensive analysis of all evaluation indexes, we can achieve the security level of PDIoT. Taking the PDIoT of Meizhou Power Supply Bureau of Guangdong Power Grid as an example for empirical testing, the experimental results show that the evaluation results are consistent with the actual situation, which proves that the proposed method is effective and feasible. [ABSTRACT FROM AUTHOR]

Explosives continue to be the primary tactic used by terrorists across the world and given the high security risk faced by mega infrastructure, a systematic security risk assessment framework is proposed in this paper. Classification and rating criteria are established for this framework pertaining to threat/vulnerability and impact/consequence assessment, based on which asset risk rating can be calculated. The proposed risk assessment framework refines the author's previous work of risk rating criteria and evaluates risks in both qualitative and quantitative ways. Risk ratings are classified both numerically and in color codes for the ease of analysis and application. This framework is validated in a case study of risk assessment of a mega infrastructure facility and can support further risk management and investment policy. A case study of a chemical facility utilizing the risk assessment framework is provided. [ABSTRACT FROM AUTHOR]

Information security risk assessment is an important part of enterprises’ management practices that helps to identify, quantify, and prioritize risks against criteria for risk acceptance and objectives relevant to the organization. Risk management refers to a process that consists of identification, management, and elimination or reduction of the likelihood of events that can negatively affect the resources of the information system to reduce security risks that potentially have the ability to affect the information system, subject to an acceptable cost of protection means that contain a risk analysis, analysis of the “cost-effectiveness” parameter, and selection, construction, and testing of the security subsystem, as well as the study of all aspects of security.

Background and Objective: In today's world, intentional accidents occur in many organizations due to numerous reasons. These intentional accidents usually aim to cause substantial damages to industries. To minimize the risk of these threats, it is essential to design and implement risk identification and risk assessment programs. The present study aimed to assess the risk associated with conscious threats with Federal Emergency Management Agency (FEMA) and fuzzy FEMA and compare the results of these two methods. Materials and Methods: In the present study, FMEA and fuzzy FMEA methods were used to identify and assess terrorist threats in a combined cycle power plant. The risks were identified using FEMA checklist. Risk assessment was performed through field observation, the examination of documents, and expert opinion. The Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) method was used for prioritizing and selecting the optimum approach. Data were analyzed in SPSS software (version 21). Results: Based on the results, although the fuzzy FEMA method requires more time, as well as higher cost of implementation and educational needs, this method allows a more accurate estimation of risk levels due to the high level of accuracy of the results, and therefore, it prioritizes the units more efficiently. Therefore, the fuzzy FEMA was introduced as the preferred method. Conclusion: As evidenced by the results of the current study, the fuzzy FEMA method could be applied to overcome the weakness of the traditional method of FEMA. Moreover, it reduces uncertainty and increases the efficiency of organizations.

Electric power grids, which form an essential part of the critical infrastructure, are evolving into highly distributed, dynamic networks in order to address the climate change. This fundamental transition relies on extensive automation solutions based on communications and information technologies. Thus, it also gives rise to new attack points for malicious actors and consequently, increases the vulnerability of the electric energy system. This study presents a qualitative assessment of power grid cybersecurity through expert interviews across countries in Europe and the U.S. to gain understanding of the latest developments and trends in the cybersecurity of future electric energy systems. The horizon of the assessment is 10 years spanning until the early 2030s. Thereafter, the study identifies how and to which extent the risks identified to be most significant are understood and addressed in the latest research and industry publications aiming at identifying areas deserving specific further attention. The most significant threats based on the assessment are False Data Injection (FDI), Denial of Service (DoS) supply chain, and ransomware and malware attacks. [ABSTRACT FROM AUTHOR]

The supervision of security risk level of carbofuran pesticide residues can guarantee the food quality and security of residents effectively. In order to predict the potential key risk vegetables and regions, this paper constructs a security risk assessment model, combined with the k-means++ algorithm, to establish the risk security level. Then the evaluation index value of the security risk model is predicted to determine the security risk level based on the deep learning model. The model consists of a convolutional neural network (CNN) and a long short-term memory network (LSTM) optimized by an arithmetic optimization algorithm (AOA), namely, CNN-AOA-LSTM. In this paper, a comparative experiment is conducted on a small sample data set of independently constructed security risk assessment indicators. Experimental results show that the accuracy of the CNN-AOA-LSTM prediction model based on attention mechanism is 6.12% to 18.99% higher than several commonly used deep neural network models (gated recurrent unit, LSTM, and recurrent neural networks). The prediction model proposed in this paper provides scientific reference to establish the priority order of supervision, and provides forward-looking supervision for the government. [ABSTRACT FROM AUTHOR]

Internet of Things (IoT) devices are becoming more widespread not only in areas such as smart homes and smart cities but also in research and office environments. The sheer number, heterogeneity, and limited patch availability provide significant challenges for the security of both office networks and the Internet in general. The systematic estimation of device risks, which is essential for mitigation decisions, is currently a skillintensive task that requires expertise in network vulnerability scanning, as well as manual effort in firmware binary analysis. This article introduces SAFER, the Security Assessment Framework for Embedded-device Risks, which enables a semi-automated risk assessment of IoT devices in any network. SAFER combines information from network device identification and automated firmware analysis to estimate the current risk associated with the device. Based on past vulnerability data and vendor patch intervals for devicemodels, SAFER extrapolates those observations into the future using different automatically parameterized prediction models. Based on that, SAFER also estimates an indicator for future security risks. This enables users to be aware of devices exposing high risks in the future. One major strength of SAFER over other approaches is its scalability, achieved through significant automation. To demonstrate this strength, we apply SAFER in the network of a large multinational organization, to systematically assess the security level of hundreds of IoT devices on large-scale networks. Results indicate that SAFER successfully identified 531 out of 572 devices leading to a device identification rate of 92.83 %, analyzed 825 firmware images, and predicted the current and future security risk for 240 devices. [ABSTRACT FROM AUTHOR]

In the related literature, conventional approaches to assessing security risk and prioritising bridges have focused on unique characteristics. Although the unique characteristics appropriately reflect the economic and social consequences of failure, they neglect the consequences of a bridge failure at the network level. If network owners and operators prioritise bridges solely based on their unique characteristics, bridges with low object-level importance and high network-level importance have very low chances to get priority. In this paper, a bridge importance measurement index a(e) has been presented, prioritising bridges based on their unique characteristics, location and network topology. To describe how to use this index a(e), three numerical examples were provided. While the first example was related to a simple hypothetical network, the second and third examples were real networks related to the bridges of Wroclaw city. Using these examples, the results of bridge prioritisation obtained in the unique-characteristics-only state were compared to the state in which a(e) had been used. Results showed that considering the location of the bridge and the topological characteristics of the network change the bridges prioritisation. For instance, in the second example, it was observed that the use of the a(e), made bridge Bolesława Krzywoustego the essential bridge, while bridge Grunwaldzki was the essential bridge under the previous prioritisation made by researchers. However, the results of the third example showed that bridge Milenijny, which was considered the essential network bridge as stated in the previous prioritisation made by researchers, was again selected as the most critical bridge based on the a(e). [ABSTRACT FROM AUTHOR]

Jasleen Kaur,1 Asif Irshad Khan,2 Yoosef B Abushark,2 Md Mottahir Alam,3 Suhel Ahmad Khan,4 Alka Agrawal,1 Rajeev Kumar,1 Raees Ahmad Khan1 1Department of Information Technology, Babasaheb Bhimrao Ambedkar University, Lucknow, UP, India; 2Computer Science Department, Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah, Saudi Arabia; 3Department of Electrical & Computer Engineering, Faculty of Engineering, King Abdulaziz University, Jeddah, Saudi Arabia; 4Department of Computer Science, Indira Gandhi National TribalUniversity, Amarkantak, MP, IndiaCorrespondence: Rajeev Kumar Email rs0414@gmail.comIntroduction: The imperative need for ensuring optimal security of healthcare web applications cannot be overstated. Security practitioners are consistently working at improvising on techniques to maximise security along with the longevity of healthcare web applications. In this league, it has been observed that assessment of security risks through soft computing techniques during the development of web application can enhance the security of healthcare web applications to a great extent.Methods: This study proposes the identification of security risks and their assessment during the development of the web application through adaptive neuro-fuzzy inference system (ANFIS). In this article, firstly, the security risk factors involved during healthcare web application development have been identified. Thereafter, these security risks have been evaluated by using the ANFIS technique. This research also proposes a fuzzy regression model.Results: The results have been compared with those of ANFIS, and the ANFIS model is found to be more acceptable for the estimation of security risks during the healthcare web application development.Conclusion: The proposed approach can be applied by the healthcare web application developers and experts to avoid the security risk factors during healthcare web application development for enhancing the healthcare data security.Keywords: healthcare web application, security risk assessment, fuzzy systems, neural network, adaptive neuro-fuzzy inference system

Most cyber-attacks and data breaches in cloud infrastructure are due to human errors and misconfiguration vulnerabilities. Cloud customer-centric tools are imperative for mitigating these issues, however existing cloud security models are largely unable to tackle these security challenges. Therefore, novel security mechanisms are imperative, we propose Risk-driven Fault Injection (RDFI) techniques to address these challenges. RDFI applies the principles of chaos engineering to cloud security and leverages feedback loops to execute, monitor, analyze and plan security fault injection campaigns, based on a knowledge-base. The knowledge-base consists of fault models designed from secure baselines, cloud security best practices and observations derived during iterative fault injection campaigns. These observations are helpful for identifying vulnerabilities while verifying the correctness of security attributes (integrity, confidentiality and availability). Furthermore, RDFI proactively supports risk analysis and security hardening efforts by sharing security information with security mechanisms. We have designed and implemented the RDFI strategies including various chaos engineering algorithms as a software tool: CloudStrike. Several evaluations have been conducted with CloudStrike against infrastructure deployed on two major public cloud infrastructure: Amazon Web Services and Google Cloud Platform. The time performance linearly increases, proportional to increasing attack rates. Also, the analysis of vulnerabilities detected via security fault injection has been used to harden the security of cloud resources to demonstrate the effectiveness of the security information provided by CloudStrike. Therefore, we opine that our approaches are suitable for overcoming contemporary cloud security issues.

Maritime terrorist accidents have a significant low-frequency-high-consequence feature and, thus, require new research to address the associated inherent uncertainty and the scarce literature in the field. This article aims to develop a novel method for maritime security risk analysis. It employs real accident data from maritime terrorist attacks over the past two decades to train a data-driven Bayesian network (DDBN) model. The findings help pinpoint key contributing factors, scrutinize their interdependencies, ascertain the probability of different terrorist scenarios, and describe their impact on different manifestations of maritime terrorism. The established DDBN model undergoes a thorough verification and validation process employing various techniques, such as sensitivity, metrics, and comparative analyses. Additionally, it is tested against recent real-world cases to demonstrate its effectiveness in both retrospective and prospective risk propagation, encompassing both diagnostic and predictive capabilities. These findings provide valuable insights for the various stakeholders, including companies and government bodies, fostering comprehension of maritime terrorism and potentially fortifying preventive measures and emergency management., (© 2024 The Author(s). Risk Analysis published by Wiley Periodicals LLC on behalf of Society for Risk Analysis.)

With the increasing digitalization and informatization of distribution network systems, distribution networks have gradually developed into distribution network cyber physical systems (CPS) which are deeply integrated with traditional power systems and cyber systems. However, at the same time, the network risk problems that the cyber systems face have also increased. Considering the possible cyber attack vulnerabilities in the distribution network CPS, a dynamic Bayesian network approach is proposed in this paper to quantitatively assess the security risk of the distribution network CPS. First, the Bayesian network model is constructed based on the structure of the distribution network and common vulnerability scoring system (CVSS). Second, a combination of the fuzzy analytic hierarchy process (FAHP) and entropy weight method is used to correct the selectivity of the attacker to strike the target when cyber attack vulnerabilities occur, and then after considering the defense resources of the system, the risk probability of the target nodes is obtained. Finally, the node loads and node risk rates are used to quantitatively assess the risk values that are applied to determine the risk level of the distribution network CPS, so that defense strategies can be given in advance to counter the adverse effects of cyber attack vulnerabilities.

Blockchain (BC) has recently paved the way for developing Decentralized Identity Management (IdM) systems for different information systems. Researchers widely use it to develop decentralized IdM systems for the Health Internet of Things (HIoT). HIoT is considered a vulnerable system that produces and processes sensitive data. BC-based IdM systems have the potential to be more secure and privacy-aware than centralized IdM systems. However, many studies have shown potential security risks to using BC. A Systematic Literature Review (SLR) conducted by the authors on BC-based IdM systems in HIoT systems showed a lack of comprehensive security and risk management frameworks for BC-based IdM systems in HIoT. Conducting a further SLR focusing on risk management and supplemented by Grey Literature (GL), in this paper, a security taxonomy, security framework, and cybersecurity risk management framework for the HIoT BC-IdM systems are identified and proposed. The cybersecurity risk management framework will significantly assist developers, researchers, and organizations in developing a secure BC-based IdM to ensure HIoT users’ data privacy and security.

This study aims to protect software development by creating a Software Risk Assessment (SRA) model for each phase of the Software Development Life Cycle (SDLC) using an Adaptive Neuro-Fuzzy Inference System (ANFIS) model. Software developers discovered and validated the risk variables affecting each SDLC phase, following which relevant data about risk factors and associated SRA for each SDLC phase were collected. To create the SRA model for SDLC phases, risk factors were used as inputs, and SRA was used as an output. The formulated model was simulated using 70 % and 80 % of the data for training, while 30 % and 20 % were used for testing the model. The performance of the SRA models using the test datasets was evaluated based on accuracy. According to the study findings, many risk variables were discovered and confirmed for the requirement, design, implementation, integration, and operation phases of SDLC 11, 8, 9, 4, and 6, respectively. The SRA model was formulated using the risk factors using 2048, 256, 512, 16, and 64 inference rules for the requirement, design, implementation, integration, and operation phases, respectively. The study concluded that using the SRA model to assess security risk at each SDLC phase provided a secured software development process., Competing Interests: The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper., (© 2024 The Authors.)

In recent years, cybersecurity certification is gaining momentum as the baseline to build a structured approach to mitigate cybersecurity risks in the Internet of Things (IoT). This initiative is driven by industry, governmental institutions, and research communities, which have the goal to make IoT more secure for the end-users. In this survey, we analyze the current cybersecurity certification schemes, as well as the potential challenges to make them applicable for the IoT ecosystem. We also examine current efforts related to risk assessment and testing processes, which are widely recognized as the processes to build a cybersecurity certification framework. Our work provides a multidisciplinary perspective of a possible IoT cybersecurity certification framework by integrating research and technical tools and processes with policies and governance structures, which are analyzed against a set of identified challenges. This survey is intended to give a comprehensive overview of cybersecurity certification to facilitate the definition of a framework that its in emerging scenarios, such as the IoT paradigm. [ABSTRACT FROM AUTHOR]

Definition: Information security risk assessment is an important part of enterprises' management practices that helps to identify, quantify, and prioritize risks against criteria for risk acceptance and objectives relevant to the organization. Risk management refers to a process that consists of identification, management, and elimination or reduction of the likelihood of events that can negatively affect the resources of the information system to reduce security risks that potentially have the ability to affect the information system, subject to an acceptable cost of protection means that contain a risk analysis, analysis of the "cost-effectiveness" parameter, and selection, construction, and testing of the security subsystem, as well as the study of all aspects of security. [ABSTRACT FROM AUTHOR]

In the field of software development, the efficient prioritizing of software risks was essential and play significant roles. However, finding a viable solution to this issue is a difficult challenge. The software developers have to adhere strictly to risk management practice because each phase of SDLC is faced with its individual type of risk rather than considering it as a general risk. Therefore, this study proposes an adaptive neuro-fuzzy inference system (ANFIS) for selection of appropriate risk factors in each stages of software development process. Existing studies viewed the SDLC’s Security risk assessment (SRA) as a single integrated process that did not offer a thorough SRA at each stage of the SDLC process, which resulted in unsecure software development. Hence, this study identify and validate the risk factors needed for assessing security risk at each phase of SDLC. For each phase, an SRA model based on an ANFIS was suggested, using the identified risk factors as inputs. For the logical representation of the fuzzification as an input and output variables of the SRA risk factors for the ANFIS-based model employing the triangular membership functions. The proposed model utilized two triangular membership functions to represent each risk factor’s label, while four membership functions were used to represent the labels of the target SRA value. Software developers chose the SRA risk factors that were pertinent in their situation from the proposed taxonomy for each level of the SDLC process as revealed by the results. As revealed from the study’s findings, knowledge of the identified risk factors may be valuable for evaluating the security risk throughout the SDLC process.

Life-critical embedded systems, including medical devices, are becoming increasingly interconnected and interoperable, providing great efficiency to the healthcare ecosystem. These systems incorporate complex software that plays a significantly integrative and critical role. However, this complexity substantially increases the potential for cybersecurity threats, which directly impact patients’ safety and privacy. With software continuing to play a fundamental role in life-critical embedded systems, maintaining its trustworthiness by incorporating fail-safe modes via a multimodal design is essential. Comprehensive and proactive evaluation and management of cybersecurity risks are essential from the very design to deployment and long-term management. In this paper, we present FIRE, a finely integrated risk evaluation methodology for life-critical embedded systems. Security risks are carefully evaluated in a bottom-up approach from operations-to-system modes by adopting and expanding well-established vulnerability scoring schemes for life-critical systems, considering the impact to patient health and data sensitivity. FIRE combines a static risk evaluation with runtime dynamic risk evaluation to establish comprehensive risk management throughout the lifecycle of the life-critical embedded system. We demonstrate the details and effectiveness of our methodology in systematically evaluating risks and conditions for risk mitigation with a smart connected insulin pump case study. Under normal conditions and eight different malware threats, the experimental results demonstrate effective threat mitigation by mode switching with a 0% false-positive mode switching rate.

Security risk assessment is an important challenge in the design of Cyber Physical Systems (CPS). Even more importantly, the intrinsically dynamical nature of these systems, due to changes in their environment, as well as evolutions in their infrastructures, makes them self-adaptive systems, where security aspects have to be considered in terms of management of detections and reactions for self-protection. In this work, we propose an approach to autonomously mitigate the threats in each reconfiguration at application or infrastructure levels of CPS. We propose and implement a framework for self-adaptive security: software architecture, design method, and integration with model-based decision. We use Attack-Defense Trees for modeling threats, and our approach involves security risk assessment, taking into account its balancing and coordination with quality-of-service aspects. We formulate and formalize the on-line decision problem to be solved at each cycle of the self-adaptation control loop in terms of Constraint Programming (CP) modeling and resolution. The CP model implements a set of constraints that allow to specify secure configurations, evaluated regarding their impact on system performance to pinpoint the most relevant one portraying a good balance between the security and quality of service. We perform validation of our approach with its application to Smart Grids, more particularly to an industrial case study from RTE (the French Energy Transmission company). • We propose and implement a framework for self-adaptive security in CPS. • Our approach involves Security Risk Assessment, taking into account QoS aspects. • We formalize the on-line decision problem to be solved using Constraint Programming. • We perform the validation of our approach on RTE's Smart Grids case study. [ABSTRACT FROM AUTHOR]

For problems that information security protection measures of industrial Internet of coal mine were mostly applied to small areas and it was difficult to assess the whole information security risk, an information security risk assessment method of industrial Internet of coal mine was proposed which was based on static and dynamic dimensions. In the method, security protection regulations carried out in coal mine information systems are feature-transformed according to Information Security Technology-baseline for Classified Protection of Cybersecurity and GB/T 34679-2017 General Technical Specifications for Smart Mine Information Systems, and a correlation coefficient matrix of security protection requirements for each system is established, so as to calculate the number of security protection regulations which are actually carried out in the system. Then, a security risk assessment model is established by combining with risk number and probability of higher risk category, so as to assess information security risk of industrial Internet of coal mine. The test result shows that the method can effectively assess information security status of industrial Internet of coal mine, and guide coal mine enterprise to analyze information security risk and design and carry out security protection plan, so as to decrease information security risk of industrial Internet of coal mine.

With the deepening penetration of renewable resources worldwide, power system operators are faced with emerging challenges, e.g., the increase of operating risks due to the volatility and uncertainty of wind and solar power. To efficiently identify the operational limit violations, a switch from deterministic to stochastic framework for assessing the system security, which could manage various types of uncertainties, has been advocated in this paper. The established model is based on an improved probabilistic load flow, which is adapted to incorporate the steady-state behavior of frequency regulation. An efficient importance sampling (IS) technique is also developed to speed up the crude Monte Carlo (MC) simulation in estimating the low probability of violations of security constraints. Extensive computational experiments on both the IEEE 14-bus test case and a simplified regional system show that the proposed IS estimator makes significant enhancement to the crude MC in the computational efficiency and has better numerical performance as compared with other IS schemes.