Thesis (Ph. D.)--University of Texas at Austin, 2007. / Vita. Includes bibliographical references.

With widespread of harmful attacks against enterprises' electronic services, information security readiness of these enterprises is becoming of increasing importance for establishing the required safe environment for such services. Various approaches are proposed to manage enterprise information security risks and to assess its information security readiness. These approaches are, however, not adequate to manage information security risks, as all required information security components of its structural and procedural dimensions have not considered. In addition, current assessment approaches lack numerical indicators in assessing enterprise information security readiness. Furthermore, there is no standard approach for analysing cost versus benefit in selecting recommended protection measures. This thesis aims at contributing to the knowledge by developing comprehensive Enterprise Information Security Risk Management (EISRM) framework that integrates typical approaches for information security risk management, and incorporates main components of key risk management methodologies. In addition, for supporting phases of the proposed EISRM framework, analytical models for enterprise information security readiness assessment and cost-benefit analysis are developed. The practical evaluation, using the proposed enterprise information security readiness assessment model has been performed depending on a developed investigation form that used to investigate nine enterprises inside Saudi Arabia. The results demonstrate the effectiveness of the model in assessing and comparing enterprises information security readiness at all levels of the model, using numerical indicators and graphical representations. The EISRM framework and the analytical models presented in this research can be used by enterprises as single point of reference for assessing and cost effectively improving their information security readiness.

L’essor du Cloud Computing, permettant de partager les coûts et les ressources au travers de la virtualisation, présage une interconnexion dynamique et flexible entre entreprises et fournisseurs. Cependant, cette mise en commun de ressources, données et savoir-faire implique de nouvelles exigences en termes de sécurité. En effet, le manque de confiance dans les structures du Cloud est souvent vu comme un frein au développement de tels services. L’objectif de cette thèse est d’étudier les concepts d’orchestration de services, de confiance et de gestion des risques dans le contexte du Cloud. La contribution principale est un framework permettant de déployer des processus métiers dans un environnement Cloud, en limitant les risques de sécurité liés à ce contexte. La contribution peut être séparée en trois partie distinctes qui prennent la forme d'une méthode, d'un modèle et d'un framework. La méthode catégorise des techniques pour transformer un processus métier existant en un modèle sensibilisé (ou averti) qui prend en compte les risques de sécurité spécifiques aux environnements Cloud. Le modèle formalise les relations et les responsabilités entre les différents acteurs du Cloud. Ce qui permet d'identifier les différentes informations requises pour évaluer et quantifier les risques de sécurité des environnements Cloud. Le framework est une approche complète de décomposition de processus en fragments qui peuvent être automatiquement déployés sur plusieurs Clouds. Ce framework intègre également un algorithme de sélection qui combine les information de sécurité avec d'autres critère de qualité de service pour générer des configuration optimisées. Finalement, les travaux sont implémentés pour démontrer la validité de l'approche. Le framework est implémenté dans un outil. Le modèle d'évaluation des risques de sécurité Cloud est également appliqué dans un contexte de contrôle d'accès. La dernière partie présente les résultats de l'implémentation de nos travaux sur un cas d'utilisation réel. / Nowadays service ecosystems rely on dynamic software service chains that span over multiple organisations and providers. They provide an agile support for business applications, governments of end-users. This trend is reinforced by the Cloud based economy that allows sharing of costs and resources. However, the lack of trust in such cloud environments, that involve higher security requirements, is often seen as a braking force to the development of such services. The objective of this thesis is to study the concepts of service orchestration and trust in the context of the Cloud. It proposes an approach which supports a trust model in order to allow the orchestration of trusted business process components on the cloud. The contribution is threefold and consists in a method, a model and a framework. The method categorizes techniques to transform an existing business process into a risk-aware process model that takes into account security risks related to cloud environments. The model formalizes the relations and the responsibilities between the different actors of the cloud. This allows to identify the different information required to assess and quantify security risks in cloud environments. The framework is a comprehensive approach that decomposes a business process into fragments that can automatically be deployed on multiple clouds. The framework also integrates a selection algorithm that combines security information with other quality of service criteria to generate an optimized configuration. Finally, the work is implemented in order to validate the approach. The framework is implemented in a tool. The security assessment model is also applied over an access control model. The last part presents the results of the implementation of our work on a real world use case.

Information security (IS)-related risks affect global public and private organizations on a daily basis. These risks may be introduced through technical or human-based activities, and can include fraud, hacking, malware, insider abuse, physical loss, mobile device misconfiguration or unintended disclosure. Numerous and diverse regulatory and contractual compliance requirements have been mandated to assist organizations proactively prevent these types of risks. Two constants are noted in these requirements. The first constant is requiring organizations to disseminate security policies addressing risk management through secure behavior. The second constant is communicating policies through IS awareness, training and education (ISATE) programs. Compliance requirements direct that these policies provide instruction about making compliant and positive security decisions to reduce risk. Policy-driven and organizationally-relevant ISATE content is understood to be foundational and critical to prevent security risk. The problem identified for investigation is inconsistency of the terms awareness, training and education as found in security-related regulatory, contractual and policy compliance requirements. Organizations are mandated to manage a rapidly increasing portfolio of inconsistent ISATE compliance requirements generated from many sources. Since there is no one set of common guidance for compliance, organizations struggle to meet global, diverse and inconsistent compliance requirements. Inconsistent policy-related content and instructions, generated from differing sources, may cause incorrect security behavior that can present increased security risk. Traditionally, organizations were required to provide only internally-developed programs, with content left to business, regulatory/contractual, and cultural discretion. Updated compliance requirements now require organizations to disseminate externally-developed content in addition to internally-provided content. This real-world business requirement may cause compliance risks due to inconsistent instruction, guidance gaps and lack of organizational relevance. The problem has been experienced by industry practitioners within the last five years due to increased regulatory and contractual compliance requirements. Prior studies have not yet identified specific impacts of multiple and differing compliance requirements on organizations. The need for organizational relevance in ISATE content has been explored in literature, but the amount of organizationally-relevant content has not been examined in balance of newer compliance mandates.The goal of the research project was to develop a standard content definition and framework. Experienced practitioners responsible for ISATE content within their organizations participated in a survey to validate definitions, content, compliance and organizational relevance requirements imposed on their organizations. Fifty-five of 80 practitioners surveyed (68.75% participation rate) provided responses to one or more sections of the survey. This research is believed to be the first to suggest a standardized content definition for ISATE program activities based on literature review, assessment of existing regulatory, contractual, standard and framework definitions and information obtained from specialized practitioner survey data. It is understood to be the first effort to align and synthesize cross-industry compliance requirements, security awareness topics and organizational relevance within information security awareness program content. Findings validated that multiple and varied regulatory and contractual compliance requirements are imposed on organizations. A lower number of organizations were impacted by third party program requirements than was originally expected. Negative and positive impacts of third party compliance requirements were identified. Program titles and content definitions vary in respondent organizations and are documented in a variety of organizational methods. Respondents indicated high acceptance of a standard definition of awareness, less so for training and education. Organizationally-relevant program content is highly important and must contain traditional and contemporary topics. Results are believed to be an original contribution to information/cyber security practitioners, with findings of interest to academic researchers, standards/framework bodies, auditing/risk management practitioners and learning/development specialists.

Due to its environmental attributes, Liquefied Natural Gas (LNG) as a clean fossil fuel source of energy has witnessed a steady increase in demand worldwide over the last decade. This increase is mainly attributed to higher demand from the power generation sector as well as from domestic and industrial usages .This growing role of LNG among competing energy sources has raised concerns over the safety and security of the LNG chain of production, transport and distribution and its related infrastructure. Within this context, LNG ports and marine terminals, being strategically located at the midstream of the LNG Supply Chain (SC), are further exposed to safety and security risks and represent credible targets for international terrorism. Ensuring uninterrupted, robust and resilient LNG SC requires first, adequate management of safety and security risks in LNG ports and marine terminals. While each discipline of risk, be it safety or security, has received significant attention both in theory and practice, less attention was given to the management of interfaces and shared impacts among LNG Ports safety and security risks which led to the existence of gaps in the risk management (RM) systems of LNG ports and may represent a major source of risk and disruption to LNG ports. This research addresses such gaps which are poorly addressed in the current literature and proposes a holistic and integrated approach to the issues of LNG ports safety and security risks assessment and management. It also aims to model safety and security RM from a SC perspective and examines the relationships and shared impacts among LNG ports safety and security risks in the present context of increased LNG demand worldwide in the post 9/11 terrorism era. A unique combination of multiple methods within port and maritime SCs, including a Delphi survey, quantitative survey, Soft Systems Methodology (SSM) and a focus group expert consultation, is applied to reformulate the prevailing RM approach marked by dichotomy and a disciplinary silo and to propose a more enhanced and holistic approach to safety and security RM. The results of the study confirm that an integrated and holistic approach to the issue of RM in LNG ports and marine terminals is necessary to cost-effectively address safety and security risks and ensure reliable and resilient LNG SCs. Furthermore, a practical framework, in the form of a conceptual model, for LNG ports risks and emergencies management is proposed which integrates all facets of safety and security risks and emergencies management, including risk prevention, mitigation, emergency planning and response and port business continuity. The proposed conceptual model shows how the proposed RM approach can be practically applied in the context of LNG ports in the Middle East and North Africa (MENA) region, as well as in any LNG port worldwide which lacks an integrated approach to risks and emergencies management.

Conselho Nacional de Desenvolvimento Científico e Tecnológico / The lack of an alignment among concepts that involve security risk management has caused the stalemate in the adoption of security risks management models for organizations. There are several standards and risk management methodologies, having a large set of concepts, defined in many ways. In order to get an alignment of concepts and establish a suitable vocabulary for risk management, the conceptual modeling was used within the realm of security risks management. By using the conceptual modeling it was possible to abstract concepts and obtain a conceitual model for the specification of security risks management, called GRiSSI - Gestão de Riscos de Segurança de Sistemas de Informação (Information Systems Security Risk Management). Some metrics were also proposed for the identified concepts in the conceitual model, to make further improvements and corrections in security processes. The proposed conceitual model was validated through the application audits and metrics for UML models. / A falta de alinhamento entre os conceitos que envolvem a gestão de riscos de segurança tem causado um impasse na adoção de modelos de gestão de riscos de segurança pelas organizações. Há diversas normas e metodologias de gestão de riscos e de segurança que possuem uma série de conceitos e são definidos de várias maneiras. Para obter o alinhamento desses conceitos e estabelecer um vocabulário próprio para a gestão de riscos, este trabalho utilizou a modelagem conceitual para o domínio da gestão de riscos de segurança. Com a modelagem conceitual foi possível abstrair esses conceitos e obter um modelo conceitual para a especificação da gestão de riscos de segurança, chamado GRiSSI (Gestão de Riscos de Segurança de Sistemas de Informação). Algumas métricas também foram propostas para os conceitos identificados no modelo conceitual, com o intuito de contribuir para promover melhorias e efetuar correções em processos de segurança. O modelo conceitual proposto foi validado por meio da verificação feita como a aplicação de auditorias e métricas para modelos UML.

Bakgrund: Informationssäkerhet är någonting som företag inom alla branscher bör ägna sig åt eftersom samtliga organisationer är utsatta för informationsrisker. Avsikten med informationssäkerhet är att skydda information så att den finns tillgänglig vid behov, är tillförlitlig och för att säkerställa att endast behöriga har åtkomst (Informationssäkerhet, 2015). Bristande informationshantering kan exempelvis resultera i dataförluster och läckt kunddata vilket i sin tur kan leda till försämrat kundförtroende och stora intäktsförluster. Företags utsatthet för informationsrisker påverkas både av interna och externa faktorer. Utbrottet av Covid-19 är ett exempel på en extern faktor (Humla, 2020). Enligt en rapport är svensk tillverkningsindustris hantering av informationsrisker kraftigt eftersatt i förhållande till övriga sektorers hantering av informationsrisker (Radar Ecosystems Specialists, 2017). Syfte: Denna uppsats undersöker hur ett företag inom svensk tillverkningsindustri arbetar med informationssäkerhet (eng. information security risk management, ISRM). Vidare applicerar vi en teoretisk lins i form av prospektteorin för att förklara informationssäkerhetsarbetet. Vi undersöker även om beslutfattare inom IT-säkerhet uppvisar tendens till övermod och huruvida detta kan påverka företagets arbete med informationssäkerhet. Metod: Uppsatsen är en kvalitativ fallstudie och det empiriska materialet har inhämtats genom semistrukturerade intervjuer med beslutfattare och utvecklare som arbetar medinformationssäkerhet. Fallföretaget är ett anonymiserat svenskt tillverkningsföretag som tillhandahåller produkter och tjänster inom säkerhetsbranschen. Resultat: Enligt vår studie utgår beslutfattare från tidigare erfarenheter av informationssäkerhet när hanteringsstrategier utformas. Det framkommer även att beslutfattarens resonemang och riskhantering förändras i takt med personens erfarenhet. Vi kan även konstatera att beslutfattarens agerande kan förklaras utifrån prospektteorin och att hanteringen påverkas av kognitiva aspekter såsom övermod. / Background: Every organization needs to manage its information security risks (ISRM) as all industries are exposed to information risks. The purpose of ISRM is to protect information so that it is accessible when needed, reliable and to ensure only authorized access (Informationssäkerhet, 2015). Lack of ISRM may result in data loss or personal data leaks, which in turn may lead to a decrease of consumer confidence and reduced revenue streams. Enterprises exposure to information risks are affected by both internal and external factors. The outbreak of Covid-19 is an example of an external factor (Humla, 2020). According to a report, the Swedish manufacturing industry's management of information risks is severely neglected in relation to other sectors ́ handling of information risks (Radar Ecosystems Specialists, 2017). Purpose: This thesis explores how a Swedish manufacturing company manages its information security risks. This is explored by applying a theoretical framework of Prospect Theory to explain decision makers ́ reasoning behind its current ISRM practices. We are also exploring whether decision makers within IT-security have a tendency towards Overconfidence bias and whether it may affect the company's ISRM. Method: The thesis is a qualitative case study and the empirical data has been obtained through semi structured interviews with decision-makers and developers working with information security. The case company is an anonymous Swedish manufacturing company that provides products and services in the security industry. Results: According to our thesis, decision makers rely on previous information security experiences when designing management strategies. It also appears that the decision maker's reasoning and risk management change as the person's experience. We can also note that the decision maker's behavior can be explained on the basis of Prospect Theory and that the ISRM is influenced by cognitive aspects such as overconfidence.

With widespread of harmful attacks against enterprises¿ electronic services, information security readiness of these enterprises is becoming of increasing importance for establishing the required safe environment for such services. Various approaches are proposed to manage enterprise information security risks and to assess its information security readiness. These approaches are, however, not adequate to manage information security risks, as all required information security components of its structural and procedural dimensions have not considered. In addition, current assessment approaches lack numerical indicators in assessing enterprise information security readiness. Furthermore, there is no standard approach for analysing cost versus benefit in selecting recommended protection measures. This thesis aims at contributing to the knowledge by developing comprehensive Enterprise Information Security Risk Management (EISRM) framework that integrates typical approaches for information security risk management, and incorporates main components of key risk management methodologies. In addition, for supporting phases of the proposed EISRM framework, analytical models for enterprise information security readiness assessment and cost-benefit analysis are developed. The practical evaluation, using the proposed enterprise information security readiness assessment model has been performed depending on a developed investigation form that used to investigate nine enterprises inside Saudi Arabia. The results demonstrate the effectiveness of the model in assessing and comparing enterprises information security readiness at all levels of the model, using numerical indicators and graphical representations. The EISRM framework and the analytical models presented in this research can be used by enterprises as single point of reference for assessing and cost effectively improving their information security readiness.

Today's environment is filled with the proliferation of cyber-attacks that result in losses for organizations and individuals. Hackers often use compromised websites to distribute malware, making it difficult for individuals to detect. The impact of clicking through a link on the Internet that is malware infected can result in consequences such as private information theft and identity theft. Hackers are also known to perpetrate cyber-attacks that result in organizational security breaches that adversely affect organizations' finances, reputation, and market value. Risk management approaches for minimizing and recovering from cyber-attack losses and preventing further cyber-attacks are gaining more importance. Many studies exist that have increased our understanding of how individuals and organizations are motivated to reduce or avoid the risks of security breaches and cyber-attacks using safeguard mechanisms. The safeguards are sometimes technical in nature, such as intrusion detection software and anti-virus software. Other times, the safeguards are procedural in nature such as security policy adherence and security awareness and training. Many of these safeguards fall under the risk mitigation and risk avoidance aspects of risk management, and do not address other aspects of risk management, such as risk transfer. Researchers have argued that technological approaches to security risks are rarely sufficient for providing an overall protection of information system assets. Moreover, others argue that an overall protection must include a risk transfer strategy. Hence, there is a need to understand the risk transfer approach for managing information security risks. Further, in order to effectively address the information security puzzle, there also needs to be an understanding of the nature of the perpetrators of the problem – the hackers. Though hacker incidents proliferate the news, there are few theory based hacker studies. Even though the very nature of their actions presents a difficulty in their accessibility to research, a glimpse of how hackers perpetrate attacks can be obtained through the examination of their knowledge sharing behavior. Gaining some understanding about hackers through their knowledge sharing behavior may help researchers fine-tune future information security research. The insights could also help practitioners design more effective defensive security strategies and risk management efforts aimed at protecting information systems. Hence, this dissertation is interested in understanding the hackers that perpetrate cyber-attacks on individuals and organizations through their knowledge sharing behavior. Then, of interest also is how individuals form their URL click-through intention in the face of proliferated cyber risks. Finally, we explore how and why organizations that are faced with the risk of security breaches, commit to cyberinsurance as a risk management strategy. Thus, the fundamental research question of this dissertation is: how do individuals and organizations manage information security risks?

This diploma thesis deals with the management of security information, according to ISO/IEC 27005 and it is implementation in the Verinice software environment. The risk information management process is applied to a critical infrastructure, that is connected to a optical fiber network. The work focuses on incidents aimed at threatening data from optical threats and active network elements in transmission systems. The result of the work is defined as a risk file in the .VNA format containing identified risks, for which appropriate measures are implemented in connection with the requirements of ISO/IEC 27001, for the protection of critical infrastructures and transmitted data in the transmission system.