Information Security Risk Management - The Practice of Enterprise Modeling Access content directly
Conference Papers Year : 2017

Information Security Risk Management

Salimeh Dashti
  • Function : Author
  • PersonId : 1030809
Paolo Giorgini
  • Function : Author
  • PersonId : 1030791
Elda Paja
  • Function : Author
  • PersonId : 1030810


Security breaches on the socio-technical systems organizations depend on cost the latter billions of dollars of losses each year. Although information security is a growing concern, most organizations deploy technical security measures to prevent security attacks, overlooking social and organizational threats and the risks faced because of them. In this paper, we propose a method to information security risk analysis inspired by the ISO27k standard series and based on two state-of-art methods, namely the socio-technical security requirements method STS and the risk analysis method CORAS. The method captures social interactions among stakeholders, while capturing both the risks that threaten their assets as well as those arising while interacting with others. Then, the method suggests how assets are to be protected based on the information classification and potential losses incurred by security breaches. An example from the healthcare domain is used throughout the paper to illustrate the method.
Fichier principal
Vignette du fichier
459826_1_En_2_Chapter.pdf (945.5 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-01765266 , version 1 (12-04-2018)





Salimeh Dashti, Paolo Giorgini, Elda Paja. Information Security Risk Management. 10th IFIP Working Conference on The Practice of Enterprise Modeling (PoEM), Nov 2017, Leuven, Belgium. pp.18-33, ⟨10.1007/978-3-319-70241-4_2⟩. ⟨hal-01765266⟩
510 View
318 Download



Gmail Facebook X LinkedIn More