Portal de Periódicos da CAPES

Motivation-Based Risk Analysis Process for IT Systems

2014; Springer Science+Business Media; Linguagem: Inglês

10.1007/978-3-642-55032-4_45

1611-3349

Agata Niescieruk, Bogdan Księżopolski,

Software Engineering Techniques and Practices

Information security management is one of the most important issues to be resolved. The key element of this process is risk analysis. The standards are (ISO/IEC 27000, ISO/IEC 31000) based on the complex and time consuming process of defining vulnerabilities and threats for all organisation assets. In the article we present a new approach to analysing the risk of an attack on information systems. We focus on human factor - motivation, and show its relation to hacker profiles, as well as impacts. At the beginning we introduce a new model of motivation-based risk analysis. Then we describe case study illustrating our approach for a simple set of organisation processes.