Risk Mitigation, Regime Security, and Militias: Beyond Coup-proofing

Information Security Risk Assessment, Aggregation, and Mitigation

As part of their compliance process with the Basel 2 operational risk management requirements, banks must define how they deal with information security risk management. In this paper we describe work in progress on a new quantitative model to assess and aggregate information security risks that is currently under development for deployment. We show how to find a risk mitigation strategy that i...

Software Safety and Security Risk Mitigation in Cyber-physical Systems

Dynamic Risk Measurement and Mitigation for Proactive Security Configuration Management

The factors on which security depends are of dynamic nature. These include emergence of new vulnerabilities and threats, policy structure and network traffic. Due to the dynamic nature of these factors, objectively identifying and measuring security metrics is a major challenge. However, such an evaluation can significantly help security professionals in decision making such as choosing between...

Beyond usability: Security Interactions as Risk Perceptions

Translucent security argues for the integration of the human element in the design of secure systems and secure components in a systematic manner. The following work details the theoretical arguments for translucent security and enumerates the principles behind the approach. After briefly listing the principles, the browser experience is critiqued for lack of translucence. Straight-forward chan...

Beyond the Castle Model of cyber-risk and cyber-security

Article history: Received 13 July 2015 Received in revised form 27 January 2016 Accepted 29 January 2016 Available online xxxx The predominant metaphor for secure computing today is modeled on ever higher, ever better layers of walls. This article explains why that approach is as outmoded for cyber security today as it became for physical security centuries ago. Three forces are undermining the...