City University of Hong Kong
DSpace
 

CityU Institutional Repository >
3_CityU Electronic Theses and Dissertations >
ETD - Dept. of Computer Science  >
CS - Master of Philosophy  >

Please use this identifier to cite or link to this item: http://hdl.handle.net/2031/4942

Title: A knowledge framework for dynamic vulnerability assessment in information risk management
Other Titles: Yi ge xin xi feng xian guan li dong tai cui ruo xing ping gu de zhi shi kuang jia
一個信息風險管理動態脆弱性評估的知識框架
Authors: Liu, Shuangyan (劉雙燕)
Department: Dept. of Computer Science
Degree: Master of Philosophy
Issue Date: 2007
Publisher: City University of Hong Kong
Subjects: Computer security -- Management
Data protection -- Management
Notes: CityU Call Number: QA76.9.A25 L587 2007
Includes bibliographical references (leaves 115-120)
Thesis (M.Phil.)--City University of Hong Kong, 2007
ix, 144 leaves : ill. ; 30 cm.
Type: Thesis
Abstract: Managing risk is an important aspect of managing information security in an organization. The process of risk management includes identifying, controlling and minimizing the impact of adverse events. Risk assessment, as a fundamental part of risk management cycle, is a study of the vulnerabilities, threats, their relationship and likelihood to happen, effectiveness of security measures, and loss or impact to an organization when such an event happens. Risk assessment thus, provides a basis for establishing policies and selecting related controls. Vulnerability assessment, as a critical step in risk assessment, is a process of examining the weaknesses of the complex risk environment of an organization. However, the exercise of vulnerability assessment requires extensive expert knowledge in information security management and risk analysis. The success of a vulnerability assessment exercise also relies on the availability of up-to-date security related data, which is often a bottleneck of any risk analysis exercise. In this research, we propose a knowledge framework that aims to facilitate dynamic vulnerability assessment via utilizing available knowledge of information risk assessment. The proposed knowledge framework consists of ontology-based information security knowledge for the vulnerability assessment, a data integration mechanism and a vulnerability assessment tool. Security knowledge in the ontology is to be utilized to analyze the risk data requirement for a particular vulnerability assessment activity. After risk data requirement is extracted from the ontology for a given list of identified threat, schema matching between risk data requirement and data sources is performed via a pre-defined mapping table. This data is then imported into a central database and will be used as evidence for reasoning the existence of a threat. The existence of a threat is determined via a Threat-Vulnerability-Entity (TVE) chain by checking the existence of vulnerabilities related to the threat acting on an entity. The resulting TVE chains will be presented as a threat model graphically. Dynamic Vulnerability Assessment Workbench (DVAW), a prototype applying concepts of the knowledge framework, was developed. A case study, using our departmental laboratory as an example, was presented to show how the knowledge framework is utilized.
Online Catalog Link: http://lib.cityu.edu.hk/record=b2217995
Appears in Collections:CS - Master of Philosophy

Files in This Item:

File Description SizeFormat
fulltext.html159 BHTMLView/Open
abstract.html159 BHTMLView/Open

Items in CityU IR are protected by copyright, with all rights reserved, unless otherwise indicated.

 

Valid XHTML 1.0!
DSpace Software © 2013 CityU Library - Send feedback to Library Systems
Privacy Policy · Copyright · Disclaimer