Development of Security Risk Measurement Model within Misuse Cases and BPMN
Name
Anna Preobrazenskaja
Abstract
One of the most important tasks of any organization is to secure its assets. Since no system could be made completely secure, in order to prevent security flaws, companies apply controls to safeguard their assets from different threats. Therefore, risk analysis is an important step for the management of information systems security (ISS). Today various ISS risk analysis methods have been developed, but they mainly provide general guidelines to estimate the risk. The problem defined in the thesis is how to measure the risk illustrated with the help of a modeling languages. For that two modeling languages were chosen: misuse cases and BPMN.
This is a problem, because we can see from a practical experience that the same security events are happening periodically, but the security risks are not treated. This may occur either because people do not see the repeated exploitation of vulnerabilities, the risk level and losses are not measured, considering the problems of a less importance. Without knowing exactly how much damage the security event makes, the management is not able to decide whether the risk should be fixed or not. If a risk is measured and values are visible, it is easier to do a proper decision about the risk mitigation.
Our goal is to help understand the severity of the security risks by visualizing the metrics and calculations of a risk. For that in modeling languages a visualization of thread cases is needed. Then security cases need to be measured. Today there is no existing model that can visualize the measurement together with the case itself. The contribution of this thesis will be the development of measurement model within misuse case and BPMN diagrams.
These models will facilitate the evaluation of an overall risk, by dividing the risk into sub-components and individually measuring the asset value, potentiality of thread, level of vulnerability. It will also give information about cost and benefit of implementation of countermeasures. This means that the metrics and the severity of a risk will be visible straight away. This will help the security specialist to make a decision whether the investment into a particular security flaw is reasonable or not. It should give a clear picture of the company's losses from exploitation of risk and will make it easier to understand whether it is a substantial loss or not.
Two models will be developed using both theoretical and empirical data. Existing assessment approaches and standards together with different modeling languages will be studied. At the same moment the cases from the working organization will be taken. Two models will be developed and applied to investigate the visibility of metrics proposed.
The developed security risk measurement models will give a solution how to calculate the risks taken from a real world example using misuse cases and BPMN. During validation we have tested our two models, which of them gives better visibility of the metrics introduced.
Graduation Thesis language
English
Graduation Thesis type
Master - Cyber Security
Supervisor(s)
Raimundas Matulevičius
Defence year
2014