A Study on Implementations of Information Security Risk Assessment: Application to Chlorine Processing System of Water Treatment

The international standard of information security risk management (ISO/IEC 27005:2011(E)) adopts an iterative approach and risk assessment methodology of information security incident scenarios analyses, applying the principle of 80/20 to calculate, and therefore should be able to save cost and to increase its effectiveness. On such a basis, we propose a rigorous and systematic approach to addressing related implementation issues involved in employing such an information security risk assessment standard, and use the chlorine processing system in a water treatment plant as an example to fully demonstrate the effectiveness of the proposed method. In particular, we would discuss the isought side of ISO/IEC 27005:2011(E), respectively. Moreover, an implementation of information security risk assessment is carried out.