Decision support systems for IT security risk management

Decision Support System (DSS)

Assuring a safe and secure it (IT) atmosphere for that exchange of business has been a significant problem. The degree related to the task has been increasing annually, as assailants become a little more well-informed, more driven, and more vivid within their endeavours. Based on a lead security professional at International Data Corporation, a worldwide supplier of marketplace data and advisory services to the IT network, "Rising brand new assault vectors, more specific activities, conformity, and also the adding of recent technologies around the corporate facilities have been all elements creating a huge effect on the general risk for an organization" (IDC, 2006). Considering that corporate costs have been often a good sign related to the degree of worry about a problem, security has been clearly on top of numerous IT executives' listings. Based on IDC, the worldwide marketplace for companies of information security solutions has been estimated to surpass 32.5 billion dollars (IDC, 2006).

1.1 Description of the decision making processes

Due to the number of strategies attackers utilize to try and infiltrate as well as disrupt it infrastructures, a whole lot of hard work continues to be dedicated to the introduction of several engineering tools as well as measures for example invasion blocking software program, mitigation application, or secure transmission standards to bar these kinds of intrusions or even offset the harmful results of an incursion. Most of these measures have been referred to as countermeasures or perhaps controls. Although this kind of investigation has been definitely essential, within their 2005 document, the President's It Advisory Council (PITAC) emphasized the vital importance related to the requirement for several other investigation endeavours (2005). They recommended that people really need "strategies to alter the broadly held notion that higher networked protection has not been really worth the expense to the people as well as companies -- a notion that definitely discourages required software growth in this discipline" (PITAC, 2005).

Particularly, one needs extra research which has been centred on assisting organizations figure out, out of this huge variety of countermeasures, which set has been far better to utilize for their specified business scenario. This method of controlling the price of possible failures coming from security breaches vs. The investment cost necessary to avoid or offset those breaches has been referred to as security risk management.

1.2 Description of the problem

The New York Times not long ago mentioned that "the invasion into Google's computer systems as well as similar assaults from inside China upon some 30 other businesses indicate increasing intricacy of these attacks and also the weaknesses of perhaps the most effective defences" (Lohr 2010). The paper additionally declares that, based on the Computer Security Institute, adware and spyware attacks have been further up from one-half to just about two-thirds of businesses interviewed this past year, with an average price of $235,000 for every organization. Lastly, the newspaper notices, spyware and adware have been used in brand new areas with harmful code which activates mobile phone microphones as well as digital cameras with the intention of business spying (Lohr 2010).

1.3 Description of the objectives of DSS (or the benefits a DSS may provide)

To be able to help planners in lessening security risk through developing any cost-effective profile of countermeasures, many professionals structure and produce a decision support system (DSS) that will permit these people to convey threat information, mitigation usefulness, and possible per-event cash failures in reasonable terms and conditions that seize this high level of uncertainness. For that DSS's design base management program, many professionals synthesize via the literature the fuzzy math concepts which will allow professionals to define the doubtful risk (threats targeting resources to create damages) related to any range of offered countermeasures. This permits economic evaluations together with the expense of those countermeasures and also the accessible risk spending budget. Next, this paper employs a metaheuristic for that smart allocation associated with countermeasure money. For the database control element of the DSS, this paper offers a unique strategy to accumulating doubtful IT-security information which stem from interactions together with IT industry specialists. We feel this as being a crucial part of creating a system which will be functional (Rees et al., 2011).

1.4 Description of the key stakeholders of the decision making processes

Top notch stakeholders -- finance businesses, board of directors, overseas shareholders (individuals and firms)

Non-elite stakeholders - customers, personnel

2. The Organization

JPMorgan Chase & Co. (New York stock exchange: JPM) has been a top rated world-wide financial products and services company and one that can be considered the biggest financial institutions within the U.S., with more than 2.0 trillion dollars in assets and 165.4 billion dollars in stockholders' equity along with functional operations in excess of 60 nations since December 31, 2009 (McConnell et al., 2012).

2.3 Description of the current organizational culture, and how it influences performance

In organization, as with almost every other world, moral behaviour doesn't simply occur. It needs to be developed as well as frequently confirmed through the entire business. J.P. Morgan's Code of Conduct pertains to everybody in JPMorgan Chase due to the fact they will attain the finest progress and good in the event that their employees possess common moral specifications and adhere to steady guidelines. It leads not just what venture they carry out, but additionally they way they work with their customers, investors, vendors as well as peers (Corporate Responsibility, 2012).

Code of Ethics for Financial Specialists

Due to the fact JPMorgan Chase's venture and status rely on the precision of their finance data, they have followed a Code of Ethics which relates to an extensive array of experts assisting in finance roles throughout the business, which includes accounting, corporate treasury as well as investor relationships. Collectively, their Codes of Conduct as well as Ethics signify their resolve for high-quality expectations (Corporate Responsibility, 2012).

2.4 Description of the influences of power and politics within the organization on the decision making process

In order to successfully curb unconstructive influences of power and politics within the organization on the decision making process, the firm needs innovation as more than half of economic growth during 1945 -- 2005 has been defined by innovation (Makri, Lan, & Gomez-Mejia, 2006). Furthermore, challenging existing power and political culture and management leads to a new identity (Gareis, 2009). Introduction of flexible change management based on leadership competencies is required to successfully integrate the aforementioned technology solutions. (Herold and Fedor, 2008; Karp and Helgo, 2008). A successful innovation must be based upon a systematic approach for change (Appelbaum et al., 2008; Griffith- Cooper and King, 2007), taking ownership for that innovation, increasing accountability through better vision, and an open dialogue atmosphere.

The majority of leadership studies (Elenkov, Judge, & Wright, 2005; Jung, Chow, & Wu, 2003; Makri, Lane and Gomez-Mejia, 2006) conform to the old models of transactional and transformational leadership (developed by Bass, 1985) to discern what should a CEO have. However, an overall efficacy in leading invention, innovation and commercialization is what the new concept of strategic leadership requires in this case. Distinctively speaking, the very measures which are supposed to gauge a CEO's leadership and creating creativity abilities need change. The interaction between innovation quality, quantity, and uniqueness and creative leadership has become extremely complex. The best leaders are thought to be those who can explore and exploit concurrently, while also lead imaginatively and operationally because today's innovation process involves three interrelated concepts, i.e. idea generation (invention), idea development, and idea commercialization (Bartels and Reinders, 2010). Therefore, the leadership plays an integral role in the successful implementation and integration of this particular Decision Support Systems.

3. Decision Support System (DSS) Proposal

The majority of IT security management strategies contain check-lists which decision makers utilize to build up a protection method; these usually have been nothing more than a triage strategy to categorizing risks. A very common method for risk creation continues to be the making of the risk cube, in which every single axis or perhaps dimension signifies one among the 3 pieces of risk (threats, resources, as well as weaknesses), and also the volume related to the cube signifies the quantity of risk (Brewer, 2006). Any kind of countermeasure which could lessen the length related to the face alongside a dimension ought to be considered, as being a smaller sized cube right after mitigation endeavours happen to be carried out, signifies a reduced risk. Although this visualization continues to be useful to managers to understand risks, it doesn't recommend any organized mechanism for lowering the risk elements or creating economic tradeoffs.

3.1 Discuss how a decision support system can help in each process

Several designs have been produced which make an effort to cope with risk analysis within a qualitative method. Mark Egan (the then CTO in Symantec) within his publication The Executive Guide To Information Security, introduced an easy to use tabular design that enables end users to rate risk severities directly into 1 of 3 groups/posts (low, medium, as well as high) and after that to average along posts (Egan, 2005). This straightforward triage method of subjective threat influence evaluation, even though useful, has been unable to seize system uncertainness. Bistarelli et al. (2007) utilized defence trees as well as conditional preference networking systems (CP-nets) like formalism to pick groups of countermeasures and also to factor with qualitative as well as conditional preference data. Alberts and Dorofee (2002) created a program called OCTAVE that also makes use of qualitative data to evaluate risk. GAO/AMID (1999) prioritized threat according to a risk examination matrix that is representative of risk ranges based on the intensity and also the possibility of prevalence of dangerous events; both of these elements have been subsequently scaled within a qualitative method. Nevertheless, none of those qualitative techniques permits the kind of threat tradeoffs required for systematic evaluation resulting in an ideal portfolio.

3.2 In which portion related to the decision making process is a DSS most helpful for decision makers? Why?

Security planning entails applying the very best countermeasures to lessen the specific risks that confront the company. Nevertheless, equally the degree of risks and also the usefulness of countermeasures in opposition to those risks have been hard to measure as well as quantify. The actual contribution of the paper may be the introduction of a decision support system which clearly understands that insufficient accuracy by assessing system risk for any situation when risks levels, countermeasure expenses, as well as asset damages have been doubtful. Managers might use this system to organize smartly which countermeasures to use to satisfy a particular spending plan, whilst characterizing the spectrum of threats towards the firm. This technique ought to be accepted by professionals who've contended that they have no idea which countermeasures to spend money on and just how beneficial such costs are going to be (Baker et al., 2007). The system permits the specification regarding model inputs in "buckets" to satisfy the demand of managers to convey data at the degree of significance they could believe.

3.3 What type of DSS do you recommend your proposed decision making processes? Explain.

We recommend a blend of the following DSS systems. Firstly, it is noteworthy that individuals have attempted strategies that evaluate IT security threat analysis. Beauregard (2001) utilized the specific Value Focused Thinking (VFT) strategy from standard threat analysis to evaluate the amount of information reassurance inside the Department of Defence divisions. Whilst subjective ratings in VFT have been normalized towards the spectrum (0, 1) and have been similar conceptually to fuzzy account valuations in fuzzy-set assessment, they have been basically point estimations related to the value (reduction) of a specified result. Consequently, they are afflicted by the lack of ability to convey any kind of distributional qualities, as has been feasible by using fuzzy units. Within a related line of thinking, Buckshaw et al. (2005) handled the appearance of critical DOD methods within an analysis strategy they referred to as MORDA, "Mission Oriented Risk and Design Analysis." MORDA holds VFT as well as embeds it inside a planning program referred to as, "Security Optimization Countermeasure Risk and Threat Evaluation System," (SOCRATES). Nevertheless, once more, threat determinations have been restricted to point estimations. Kujawski and Miller (2007) explain a quantitative threat-founded evaluation application for picking military counterterrorism programs which "enables confidence degrees instead of just point estimations," however it demands conditional probability syndication information on risk levels as well as implications. As one example of their strategy, they presume Weibull distributions for each and every procedure; however recognize that insufficient probabilistic data has been difficult.

3.4 Provide the design specifications for the system:

We think about a scenario where IT-associated resources have been under breach by possibly external or perhaps internal provocations. A company might encounter numerous threats at any time eventually (Baker et al., 2007). If effective, these threats assault assets related to numerous business procedures, and when the assets have not been safeguarded, their harm and damage can lead to financial losses to the company. To protect its resources, the company makes use of countermeasures made to obstruct or offset the intensity related to the attack, and perhaps use a higher level of protection as soon as the assets have been assaulted (file recovery, system re-load, etc.). Given that countermeasures have been expensive to put into action, the company has been compelled to tradeoff countermeasure expenses vs. The anticipated decrease in financial losses.

We determine risk as being the product of risk incidences (anticipated events/year) as well as their resulting damages in dollars/event. Therefore, yearly threat has been

R = ?iEiLi (C) where

R= risk in us dollars each year i= index which represents the various risks confronting the company

Ei= the actual expected volume of security situations of kind I each year

Li (C) = anticipated dollar losses brought on by security event I considering the current range of countermeasures C.

We make reference to the word Li (C) as being the single-event loss expectations. There have been 3 main kinds of single-event loss expectations. The very first has been brand harm which signifies harm to a company's persona (for instance, when associates within a supply chain with, say for instance, Equifax or perhaps Visa have data files with exclusive customer details compromised from their store). The 2nd has been regulation penalties. This sort of loss may happen, for instance, in the event that a medical centre does not adhere to the federal 1996 Health Insurance Portability and Accountability Act (HIPAA) conditions and terms, and also the discretion of patients' data has been breached. The 3rd has been production damages because of interruption of IT assets that help output (Rees et al., 2011).

4.1 Summary of the problem

Information security breaches are taking places at many levels and in many forms. For instance, it is a known fact that computer software is liable to be infringed and misused which can result in numerous hazardous and damaging situations. Also, One of the most common and significant vulnerabilities of computer systems information security is the creation of faults or deletion of steps in databases or software programs. Another downside that computer systems information security, especially financial systems, might have is the threat of fraud and/or theft. One more problem is that a dysfunctional nature of the peripheral infrastructure can result in the indefinite period of shutdown of the whole system.

4.2 Summary of the DSS proposed

We recommend a blend of the following DSS systems:

Value Focused Thinking (VFT) strategy from standard threat analysis to evaluate the amount of information reassurance

MORDA, "Mission Oriented Risk and Design Analysis." MORDA holds VFT as well as embeds it inside a planning program referred to as, "Security Optimization Countermeasure Risk and Threat Evaluation System," (SOCRATES).

4.3 Summary of the benefits from the proposed DSS

The decision support system introduced in this paper has the ability to tackle insufficient accuracy by assessing system risk for any situation when risks levels, countermeasure expenses, as well as asset damages. Managers might use this system to organize smartly which countermeasures to use to satisfy a particular spending plan, whilst characterizing the spectrum of threats towards the firm. This technique ought to be accepted by professionals who've contended that they have no idea which countermeasures to spend money on and just how beneficial such costs are going to be (Baker et al., 2007). The system permits the specification regarding model inputs in "buckets" to satisfy the demand of managers to convey data at the degree of significance they could believe.