Performance Evaluation of Information Security Risk Identification

Abstract

In recent decade, information security becomes a crucial issue on protecting the benefits of business operation. Many organizations perform information security risk management in order to analysis their weakness, and ensure the security of the business processes. However, identifying the threat-vulnerability pairs for each asset during the processes of risk assessment is both difficult and time-consuming for the risk assessor. Furthermore, if the identified results diverged from the real situation, the organization may put emphasis on the unnecessary controls to prevent the non-existing risk. In order to resolve the problem mentioned above, we utilize the data mining approach to discover the relationship between asset and threat-vulnerability pair. And then, we propose a risk recommendation system for assisting user identifying threat and vulnerability . The experiment result shows that the risk recommendation system can improve the performance of efficiency and accuracy of the risk assessment. We also develop a risk assessment system in order to collect the historical selection records and measure the elapsed time for further research.