Systematic Review: Cybersecurity Risk Taxonomy
- 1k Downloads
In cybersecurity, the identification of risks is a fundamental part because this activity is not unique to cybersecurity and it is hard to know what the risks in this area are. This study aims to identify if there are some risk taxonomies in cybersecurity. For this, a systematic review of the studies published from 1990 to 2017 was carried out. We found 132 papers and some of them mention some risk taxonomies within the scope of IT (information technologies) cybersecurity, although only five primary elements were selected, identifying the main risk taxonomies. A classification of cybersecurity risk taxonomy types has been adapted, with the inclusion of new categories, categorized according to their perspective and domain. We have analysed the taxonomies form a proposed five level perspective. Finally, it has been observed that risk taxonomies may be shifting the focus from the asset level to service and business level.
KeywordsCybersecurity risk taxonomy Cybersecurity risk Risk taxonomy Cyber risk taxonomy
Unable to display preview. Download preview PDF.
- 1.ISACA Glosary (2016), https://www.isaca.org/Pages/Glossary.aspx?tid=1784&char=R.
- 3.Kitchenham, B., Dybå, T., Jørgensen, M.: “Evidence-based software engineering,” Proceedings of the International Conference on Software Engineering, pp. 273–281 (2004)Google Scholar
- 4.Kitchenham, B.: “Guidelines for performing systematic literature reviews in software engineering,” EBSE Technical Report EBSE-2007-01, Keele University (2007)Google Scholar
- 5.Greitzer, F., Strozer, J., Cohen, S., Moore, A., Mundie, D., Cowley, J.: Analysis of Unintentional Insider Threats Deriving from Social Engineering Exploits. IEEE Security and Privacy Workshops, vol 35, 236-250 (2014)Google Scholar
- 6.Herzfeldt, A., Hausen, M., Briggs, R. O., Krcmar, H.: European Conference on Information Systems ECIS 2012. Developing a risk management process and risk taxonomy for medium-sized it solution providers. Association for Information Systems, Barcelona Spain (2012)Google Scholar
- 7.Alireza, S., Rouzbeh, B., Cheriet, M. (2016) Taxonomy of information security risk assessment (ISRA). Computers & security, vol 57, 14-30 (2016)Google Scholar
- 8.Elnagdy, S., Meikang, Q., Keke, G. (2016) Understanding Taxonomy of Cyber Risks for Cybersecurity Insurance of Financial Industry in Cloud Computing. IEEE International Conference on Cyber Security and Cloud Computing, vol 3, 295-300 (2016)Google Scholar
- 9.Kanel, J., Cope, E., Deleris, L., Nayak, N., Torok, R.: Three key enablers to successful enterprise risk management. IBM J. RES. & DEV, vol 54, 1-15 (2010)Google Scholar
- 10.Cebula, J., Young L.: A Taxonomy of Operational Cyber Security Risks. Software engineering institute. Recovered from: http://resources.sei.cmu.edu/library/asset-view.cfm?assetid=91013 (2010)
- 11.Delmee, F.: Graduation research, The structure of a cyber risk a scenario based approach in cyber risk assessment. Utrecht University, Deloitte Nederland (2016)Google Scholar
- 12.Li, X., Liang, X., Lu, R., Lu, Shen, X., Lin, X., Zhu, H.: Securing smart grid: cyber attacks, countermeasures, and challenges. IEEE Communications Magazine, 50(8):38–45 (2012)Google Scholar
- 13.Bompard, E., Huang, T., Wu, Y., Cremenescu, M.: Classification and trend analysis of threats origins to the security of power systems. International Journal of Electrical Power & Energy Systems, 50:50– 64 (2013)Google Scholar
- 14.Laribee, L.: Development of methodical social engineering taxonomy. Master’s Thesis, Monterey, CA: Naval Postgraduate School. Amazon Digital Services (2006)Google Scholar