Risk Assessment of Security Requirements of Banking Information Systems Based on Attack Patterns

  • Krissada Rongrat
  • Twittie SenivongseEmail author
Part of the Studies in Computational Intelligence book series (SCI, volume 727)


Security risk assessment is an important process for the implementation of any information systems including those in the banking sector. When a bank initiates or implements an information system project, requirements engineers or business analysts in the project conduct an initial validation of system security requirements to check if they comply with banking security regulations before an audit takes place. This paper presents an initial risk assessment method to assist the project team in validating security requirements of a banking information system. Text similarity analysis is used to identify which security regulations are missing from the security requirements of the bank, and a quantitative risk index model is also proposed to determine the level of risk associated with the regulations missing from the requirements. The risk level is based on the harm any potential attacks can do to the information system if the missing regulations are not implemented. Using a case study of banking in Thailand, we apply the method to assess security requirements of Thai commercial banks against the IT Best Practices of the Bank of Thailand. We evaluate the performance of security compliance checking in terms of F-measure and accuracy, and validity of risk assessment in terms of correlation with security expert judgment.


Security requirement Risk assessment Attack pattern Regulatory compliance Text similarity Banking 


  1. 1.
    Security Scorecard HQ: 2016 Financial Industry Cybers ecurity Report: SecurityScorecard. (2016). Accessed 20 May 2017
  2. 2.
    Bank of Thailand: IT Best Practices Phase I, Thailand (2013)Google Scholar
  3. 3.
    Bank of Thailand: IT Best Practices Phase II, Thailand (2014)Google Scholar
  4. 4.
    The MITRE Corporation: CAPEC-Common Attack Pattern Enumeration and Classification. Accessed 15 April 2017
  5. 5.
    Li, T., Paja, E., Mylopoulos, J., Horkoff, J., Beckers, K.: Security attack analysis using attack patterns. In: Proceeding of 2016 IEEE 10th International Conference on Research Challenges in Information Science (RCIS), pp. 1–13 (2016). doi: 10.1109/RCIS.2016.7549303
  6. 6.
    Steirna, E.J., Rowe, N.C.: Applying information-retrieval methods to software reuse: a case study. J. Inf. Process. Manage. 39(1), 67–74 (2003). doi: 10.1016/S0306-4573(02)00025-0 CrossRefzbMATHGoogle Scholar
  7. 7.
    Baeza-Yates, R., Ribeiro-Neto, B.L: Modern Information Retrieval, 2nd ed. ACM Press, New York (2011)Google Scholar
  8. 8.
    Ilyas, M., Kung, J.: A similarity measurement framework for requirements engineering. In: Proceeding of 2009 Fourth International Multi-Conference on Computing in the Global Information Technology, Cannes, La Bocca, pp. 31–34 (2009). doi: 10.1109/ICCGI.2009.12
  9. 9.
    Dag, J.N.O., Regnell, B., Carlshamre, P., Andersson, M., Karlsson, J.: A feasibility study of automated natural language requirements analysis in market-driven development. J. Requirements Eng. 7, 20 (2002). doi: 10.1007/s007660200002
  10. 10.
    Yu, Y., Franqueira, V.N.L., Tun, T.T., Wieringa, R.J., Nuseibeh, B.: Automated analysis of security requirements through risk-based argumentation. J. Syst. Softw. 106, 102–116 (2015). doi: 10.1016/j.jss.2015.04.065 CrossRefGoogle Scholar
  11. 11.
    Piromsopa, K., Rojkangsadan, T., Prompoon, N.: A Risk assessment of web server Impact classification by loss type. In: Proceeding of Networks and Communication Systems (NCS), pp. 173–178 (2005)Google Scholar
  12. 12.
    Banklongsi, T., Senivongse, T.: A security measurement model for web services based on provision of attack countermeasure. In: Proceeding of 15th International Annual Symposium Computational Science and Engineering (ANSCSE15), pp. 593–598 (2011)Google Scholar
  13. 13.
    Firesmith, Donald G.: Engineering security requirements. J. Object Technol. 2754, 53–68 (2003)Google Scholar

Copyright information

© Springer International Publishing AG 2018

Authors and Affiliations

  1. 1.Department of Computer Engineering, Faculty of EngineeringChulalongkorn UniversityBangkokThailand

Personalised recommendations