RiskREP: Risk-Based Security Requirements Elicitation and Prioritization

Autor:	Herrmann, Andrea, Morali, A., Etalle, Sandro, Wieringa, Roelf J., Niedrite, Laila, Strazdina, Renate, Wangler, Benkt
Rok vydání:	2011
Předmět:	EWI-20462 METIS-278771 Prioritization Risk-Based RiskREP IR-78045 SCS-Cybersecurity Security Elicitation Requirements SCS-Services
Zdroj:	Perspectives in Business Informatics Research, 155-162 STARTPAGE=155;ENDPAGE=162;TITLE=Perspectives in Business Informatics Research
Popis:	Companies are under pressure to be in control of their assets but at the same time they must operate as efficiently as possible. This means that they aim to implement “good-enough security‿ but need to be able to justify their security investment plans. In this paper, we present a Risk-Based Requirements Prioritization method (RiskREP) that extends misuse case-based methods with IT architecture based risk assessment and countermeasure definition and prioritization. Countermeasure prioritization is linked to business goals to achieve and based on cost of countermeasures and their effectiveness in reducing risks. RiskREP offers the potential to elicit complete security countermeasures, but also supports the deliberate decision and documentation of why the security analysis is focused on certain aspects. We illustrate RiskREP by an application to an action case.
Databáze:	OpenAIRE
Externí odkaz:	https://explore.openaire.eu/search/publication?articleId=narcis______::3b7f52cec48069b4129a19eacc8f4510 https://research.utwente.nl/en/publications/riskrep-riskbased-security-requirements-elicitation-and-prioritization(76cd81e3-0e51-4a94-bcf6-a31700f9ce9b).html Zobrazit plný text záznamu