Modifications of the Formal Risk Analysis and Assessment for the Information System Security

Abstract

In the article, a modification of formal model of risk analysis (FoMRA) was proposed. The modified FoMRA1 method takes into account the guidelines of ISO/IEC 27001 and ISO/IEC 27005 standards. The applied modifica - tion and abstraction by resources and security controls (also called countermeasures) significantly shortened the time of risk weight calculation in comparison with the MEHARI method. An attempt was also made to further reduce the time of risk analysis using agents collecting information and data from various network nodes, from operating systems and devices, and additional agents containing information on reports on security procedures, security services, security management and organizational activities related to the information systems (mainte - nance, insurance, outsourcing contracts, etc.) and transfer it to the local FoMRA1 database. The obtained results indicate that the proposed method together with agents installed in various nodes enable a quick reaction to the system threats and prevention of their impacts (quasi-real-time security monitoring system).