Scientific article

Design and validation of a trust-based opportunity-enabled risk management system

Published inInformation & computer security, vol. 25, no. 1, p. 2-25
Publication date2017

Purpose – The Bring-Your-Own-Device (BYOD) paradigm favors the use of personal and public devices and communication means in corporate environments, thus representing a challenge for the traditional security and risk management systems. In this dynamic and heterogeneous setting, the purpose of this paper is to present a methodology called opportunity-enabled risk management (OPPRIM), which supports the decision-making process in access control to remote corporate assets. Design/methodology/approach – OPPRIM relies on a logic-based risk policy model combining estimations of trust, threats and opportunities. Moreover, it is based on a mobile client – server architecture, where the OPPRIM application running on the user device interacts with the company IT security server to manage every access request to corporate assets. Findings – As a mandatory requirement in the highly flexible BYOD setting, in the OPPRIM approach, mobile device security risks are identified automatically and dynamically depending on the specific environment in which the access request is issued and on the previous history of events. Originality/value – The main novelty of the OPPRIM approach is the combined treatment of threats (resp., opportunities) and costs (resp., benefits) in a trust-based setting. The OPPRIM system is validated with respect to an economic perspective: cost-benefit sensitivity analysis is conducted through formal methods using the PRISM model checker and through agent-based simulations using the Anylogic framework.

  • Trust engine
  • Reputation
  • Simulation
  • Cooperation
  • Model checking
  • Risk management
  • Formal methods
  • BYOD
  • Opportunity-based decision-making
  • Opprim
  • Trust system
Citation (ISO format)
ALDINI, Alessandro et al. Design and validation of a trust-based opportunity-enabled risk management system. In: Information & computer security, 2017, vol. 25, n° 1, p. 2–25. doi: 10.1108/ICS-05-2016-0037
Main files (1)
Article (Published version)
ISSN of the journal2056-4961

Technical informations

Creation03/13/2017 3:25:00 PM
First validation03/13/2017 3:25:00 PM
Update time03/15/2023 1:28:02 AM
Status update03/15/2023 1:28:02 AM
Last indexation08/30/2023 2:11:43 PM
All rights reserved by Archive ouverte UNIGE and the University of GenevaunigeBlack