Ontology-Based Business Knowledge for Simulating Threats to Corporate Assets
We propose a security ontology, to provide a solid base for an applicable and holistic IT-Security approach for SMEs, enabling low-cost threat analysis. Based on the taxonomy of computer security and dependability by Landwehr [ALRL04] and the threat classification according to Peltier [Pel01], a heavy-weight ontology can be used to organize and systematically structure knowledge on threats, safeguards, and assets. The ontology is used in an organization to capture business knowledge required for and created during a security risk analysis where instances of concepts are added to the ontology to allow the simulation of different attack and disaster scenarios. Each scenario can be replayed with a different protection profile as to evaluate the effectiveness and the cost/benefit ratio of individual safeguards.
KeywordsInfrastructure Element Disaster Scenario Entire Building Security Ontology Outage Cost
Unable to display preview. Download preview PDF.
- [COB06]Cobit (2006), http://www.isaca.org/
- [Don03]Donner, M.: Toward a security ontology. IEEE Security and Privacy 1(3), 6–7 (2003)Google Scholar
- [Hau00]Hauser, H.E.: Smes in germany, facts and figures 2000. Institut für Mittelstandsforschung, Bonn (2000)Google Scholar
- [ISO06]Iso17799 (2006), http://www.iso.org/
- [OWL04]Owl web ontology language (2004), http://www.w3.org/TR/owl-features/
- [Pel01]Peltier, T.R.: Information Security Risk Analysis Boca Raton. Auerbach Publications, Boca Raton, Florida (2001)Google Scholar
- [Pro05]The protege ontology editor and knowledge acquisition system (2005), http://protege.stanford.edu/
- [SPA06]Sparql query language for rdf (2006), http://www.w3.org/TR/rdf-sparql-query/