Abstract
Due to spread in usage of information systems and
network technologies, the importance of information
security has also increased in recent years. Risk
analysis is the key concept in information security
activities. To determine and improve the security level in the systems, one has to determine the current
risks, to analyze them, to generate solution; that is to
manage them. Using specialized methods for
managing risk would be useful for organizations
since it will bring a more planned perspective to
their future work. There are several risk analysis
methods developed till now, varying in their
characteristics and their applications. It is not
possible just to mention the superiority of one over
another. A method may be more advantageous than
others depending on the organization in which it is
applied. For this purpose, there is need to find
guiding tools for choosing a method that can satisfy
organizations’ needs in the most useful way. This
study recommends the approach for selecting the
proper method. Test results of application are given
in this article for the proposed approach.
References
- ISO/IEC. ISO/IEC 17799 International Standard, Information technology, 2000. Code of pactice for information security management, Switzerland.
- Aime, M. D., Atzeni A., Pomi, P. C., 2007. AMBRA: Automated Model-based Risk Analysis, QoP ’07: ACM workshop on Quality of protection.
- Swanson, M., Guttman, B., 1996. Generally Accepted Principles and Practices for Securing Information Technology Systems, NIST Special Publication 800-14.
- NIST. NIST, An Introduction to Computer Security: The NIST Handbook, NIST Special Publication 800-12.
- Dhillon, G. (Repasky, N.), 2007. Principles of Information System Security, Wiley, USA.
- Blakley, B., McDermott, E., Geer, D., 2001. Information security is information risk management, NSPW '01: Proceedings of the 2001 workshop on New security paradigms.
- Karabacak, B., Sogukpinar, I., 2004. ISRAM: Information Security Risk Analysis Method, Computers & Security, 24(2), 147-129.
- Bella, G., Bistarelli, S., Peretti, P., Riccobene, S., 2007. Augmented Risk Analysis, Electronic Notes in Theoretical Computer Science, Volume 168, Pages 207-220.
- Vorster, A., Labuschagne, L., 2005. A framework for comparing different information security risk analysis methodologies, Proceedings of the 2005 annual research conference of the SAICSIT '05.
- UK Central Computer and Telecommunication Agency (CCTA), 2001. Risk Analysis and Management Method, CRAMM User Guide, Issue 2.0.
- Braber, F., Hogganvik, I., Lund, M.S., Stolen, K., Vraalsen, F., 2007. Model-based security analysis in seven steps - A guided tour to the CORAS method, BT Technology Journal, v 25, n 1, p 101-117.
Abstract
Son yıllarda bilgi sistemleri ve ağ teknolojilerinin
kullanım alanlarının yaygınlaşmasıyla beraber, bilgi
güvenliğinin de önemi artmıştır. Bilgi güvenliği
faaliyetlerinde anahtar kavram risk analizidir.
Sistemlerdeki güvenlik seviyesini tespit etmek ve
daha iyi hale getirebilmek için, mevcut riskleri
belirleyebilmek, bunları analiz etmek, karşı tedbirler
geliştirebilmek, kısacası yönetmek gerekmektedir.
Risk yönetiminde uzmanlaşmış yöntemler kullanmak,
organizasyonlar için ilerideki çalışmalarına daha
planlı bir anlayış getireceğinden faydalı olacaktır.
Bugüne kadar geliştirilmiş, karakteristikleri ve
uygulanışları farklı pek çok yöntem bulunmaktadır.
Bu yöntemlerin salt olarak birbirlerinden
üstünlüklerinden bahsedebilmek mümkün değildir.
Bir yöntem uygulandığı organizasyona bağlı olarak
diğerlerine göre daha avantajlı hale gelebilir. Bu
amaçla, organizasyonların kendi ihtiyaçlarına en
uygun şekilde cevap verebilecek olan yöntemi
seçebilmelerine yol gösterecek araçlara ihtiyaç
duyulmaktadır. Bu çalışmada uygun yöntem seçimi
için bir yaklaşım önerilmektedir. Önerilen yaklaşım
dört adet risk analizi yöntemi üzerinde test edilerek
sonuçları verilmiştir.
References
- ISO/IEC. ISO/IEC 17799 International Standard, Information technology, 2000. Code of pactice for information security management, Switzerland.
- Aime, M. D., Atzeni A., Pomi, P. C., 2007. AMBRA: Automated Model-based Risk Analysis, QoP ’07: ACM workshop on Quality of protection.
- Swanson, M., Guttman, B., 1996. Generally Accepted Principles and Practices for Securing Information Technology Systems, NIST Special Publication 800-14.
- NIST. NIST, An Introduction to Computer Security: The NIST Handbook, NIST Special Publication 800-12.
- Dhillon, G. (Repasky, N.), 2007. Principles of Information System Security, Wiley, USA.
- Blakley, B., McDermott, E., Geer, D., 2001. Information security is information risk management, NSPW '01: Proceedings of the 2001 workshop on New security paradigms.
- Karabacak, B., Sogukpinar, I., 2004. ISRAM: Information Security Risk Analysis Method, Computers & Security, 24(2), 147-129.
- Bella, G., Bistarelli, S., Peretti, P., Riccobene, S., 2007. Augmented Risk Analysis, Electronic Notes in Theoretical Computer Science, Volume 168, Pages 207-220.
- Vorster, A., Labuschagne, L., 2005. A framework for comparing different information security risk analysis methodologies, Proceedings of the 2005 annual research conference of the SAICSIT '05.
- UK Central Computer and Telecommunication Agency (CCTA), 2001. Risk Analysis and Management Method, CRAMM User Guide, Issue 2.0.
- Braber, F., Hogganvik, I., Lund, M.S., Stolen, K., Vraalsen, F., 2007. Model-based security analysis in seven steps - A guided tour to the CORAS method, BT Technology Journal, v 25, n 1, p 101-117.
Details
| Other ID | JA37HC58AU |
|---|---|
| Journal Section | Makaleler(Araştırma) |
| Authors | |
| Publication Date | June 24, 2016 |
| Published in Issue | Year 2010 Volume: 3 Issue: 1 - Volume: 3 Issue: 1 |
Cite
Article Acceptance
Use user registration/login to upload articles online.
The acceptance process of the articles sent to the journal consists of the following stages:
1. Each submitted article is sent to at least two referees at the first stage.
2. Referee appointments are made by the journal editors. There are approximately 200 referees in the referee pool of the journal and these referees are classified according to their areas of interest. Each referee is sent an article on the subject he is interested in. The selection of the arbitrator is done in a way that does not cause any conflict of interest.
3. In the articles sent to the referees, the names of the authors are closed.
4. Referees are explained how to evaluate an article and are asked to fill in the evaluation form shown below.
5. The articles in which two referees give positive opinion are subjected to similarity review by the editors. The similarity in the articles is expected to be less than 25%.
6. A paper that has passed all stages is reviewed by the editor in terms of language and presentation, and necessary corrections and improvements are made. If necessary, the authors are notified of the situation.
.
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.