Information Security Risk Assessment Measures of Facility Management in Transport Industry
DOI:
https://doi.org/10.53840/myjict9-1-142Keywords:
Information Security Risk Assessment, Risk Assessment Measures, Information Security, Facility ManagementAbstract
The objective of this study is to identify the necessary information security measures for facility management (FM) firms in the transportation industry to control risks. This study was founded on the three phases of the OCTAVE framework, the Information Security Risk Assessment checklist, the nine stages of NIST SP800-30 2012, and ISO 27005:2011 on Information System Risk Management. This study finalized eight significant risk management measures for FM enterprises based on a descriptive analysis of sixty questionnaires containing responses from key respondents employed by FM companies in Malaysia. Beforehand, the information security experts reviewed and validated the appropriateness of the following measures for managing risks in this study context: system characteristics; threat identification; vulnerability identification; control analysis; likelihood determination; impact analysis; risk determination; and recommendation for controls. Consequently, the result of this study reveals the outcomes of descriptive analysis comprising mean and standard deviation for the information system security measures for risk management of the respective transport company. Lastly, our research could be advantageous to FM companies, particularly those in the transportation industry, by providing standardized measures for managing information security risk.
Downloads
References
Cigolini, R. D., Van der Zwan, J., Straub, A., Martinez, D., Aiello, G., Mazziotta, V., & Micale, R. (2009). Facility management, outsourcing and contracting overview. In Recent advances in maintenance and infrastructure management (pp. 225-290). Springer London.
Fortune Business Insight. (2022). Market Research Report. https://www.fortunebusinessinsights.com/industry-reports/facility-management-market-101658.
Nota, G., Peluso, D., & Lazo, A. T. (2021). The contribution of Industry 4.0 technologies to facility management. International Journal of Engineering Business Management, 13, 18479790211024131.
Marcinkowski, B., & Gawin, B. (2020). Data-driven business model development–insights from the facility management industry. Journal of Facilities Management, 19(2), 129-149.
Choubey, S., & Bhargava, A. (2018). Significance of ISO/IEC 27001 in the implementation of governance, risk and compliance. International Journal of Scientific Research in Network Security and Communication, 6(2), 30-33.
Fenz, S., Heurix, J., Neubauer, T., & Pechstein, F. (2014). Current challenges in information security risk management. Information Management & Computer Security, 22(5), 410-430.
Shedden, P., Ahmad, A., Smith, W., Tscherning, H., & Scheepers, R. (2016). Asset identification in information security risk assessment: A business practice approach. Communications of the Association for Information Systems, 39(1), 15.
Abdullah, N. A. S., Md Noor, N. L., & Mior Ibrahim, E. N. (2015). Contributing factor to business continuity management (BCM) failure-A case of Malaysia public sector.
Groš, S. (2021). A critical view on CIS controls. In 2021 16th International Conference on Telecommunications (ConTEL) (pp. 122-128). IEEE.
Shameli-Sendi, A., Aghababaei-Barzegar, R., & Cheriet, M. (2016). Taxonomy of information security risk assessment (ISRA). Computers & security, 57, 14-30.
Agrawal, V. (2017). A framework for the information classification in ISO 27005 standard. In 2017 IEEE 4th International Conference on Cyber Security and Cloud Computing (CSCloud) (pp. 264-269). IEEE.
Weil, T. (2020). Risk assessment methods for cloud computing platforms. IT Professional, 22(1), 63-66.
Wangen, G., Hallstensen, C., & Snekkenes, E. (2018). A framework for estimating information security risk assessment method completeness: Core Unified Risk Framework, CURF. International Journal of Information Security, 17, 681-699.
Suroso, J. S., & Fakhrozi, M. A. (2018). Assessment of information system risk management with octave allegro at education institution. Procedia Computer Science, 135, 202-213.
Caralli, R. A., Stevens, J. F., Young, L. R., & Wilson, W. R. (2007). Introducing octave allegro: Improving the information security risk assessment process. Carnegie-Mellon Univ Pittsburgh PA Software Engineering Inst.
National Institute of Standards and Technology.: NIST Special Publication 800-30 Revision 1, Guide for Conducting Risk Assessments (2012).
Pereira, D., Hirata, C., Pagliares, R., & Nadjm-Tehrani, S. (2017). Towards combined safety and security constraints analysis. In Computer Safety, Reliability, and Security: SAFECOMP 2017 Workshops, ASSURE, DECSoS, SASSUR, TELERISE, and TIPS, Trento, Italy, September 12, 2017, Proceedings 36 (pp. 70-80). Springer International Publishing.
Zio, E. (2016). Challenges in the vulnerability and risk analysis of critical infrastructures. Reliability Engineering & System Safety, 152, 137-150.
Aven, T. (2016). Risk assessment and risk management: Review of recent advances on their foundation. European Journal of Operational Research, 253(1), 1-13.
Kawasaki, R., & Hiromatsu, T. (2014). Proposal of a model supporting decision-making on information security risk treatment. International Journal of Economics and Management Engineering, 8(4), 583-589.
Elena, G., & Johnson, C. W. (2015). Factors influencing risk acceptance of cloud computing services in the UK government. arXiv preprint arXiv:1509.06533.
Kumar, P. R., Raj, P. H., & Jelciana, P. (2018). Exploring data security issues and solutions in cloud computing. Procedia Computer Science, 125, 691-697.
Shamala, P., Ahmad, R., & Yusoff, M. (2013). A conceptual framework of info structure for information security risk assessment (ISRA). Journal of Information Security and Applications, 18(1), 45-52.
Downloads
Published
Issue
Section
License
Copyright (c) 2024 Malaysian Journal of Information and Communication Technology (MyJICT)
This work is licensed under a Creative Commons Attribution 4.0 International License.
