fr
Article scientifique
Anglais

Design and validation of a trust-based opportunity-enabled risk management system

Publié dansInformation & computer security, vol. 25, no. 1, p. 2-25
Date de publication2017
Résumé

Purpose – The Bring-Your-Own-Device (BYOD) paradigm favors the use of personal and public devices and communication means in corporate environments, thus representing a challenge for the traditional security and risk management systems. In this dynamic and heterogeneous setting, the purpose of this paper is to present a methodology called opportunity-enabled risk management (OPPRIM), which supports the decision-making process in access control to remote corporate assets. Design/methodology/approach – OPPRIM relies on a logic-based risk policy model combining estimations of trust, threats and opportunities. Moreover, it is based on a mobile client – server architecture, where the OPPRIM application running on the user device interacts with the company IT security server to manage every access request to corporate assets. Findings – As a mandatory requirement in the highly flexible BYOD setting, in the OPPRIM approach, mobile device security risks are identified automatically and dynamically depending on the specific environment in which the access request is issued and on the previous history of events. Originality/value – The main novelty of the OPPRIM approach is the combined treatment of threats (resp., opportunities) and costs (resp., benefits) in a trust-based setting. The OPPRIM system is validated with respect to an economic perspective: cost-benefit sensitivity analysis is conducted through formal methods using the PRISM model checker and through agent-based simulations using the Anylogic framework.

Mots-clés
  • Trust engine
  • Reputation
  • Simulation
  • Cooperation
  • Model checking
  • Risk management
  • Formal methods
  • BYOD
  • Opportunity-based decision-making
  • Opprim
  • Trust system
Citation (format ISO)
ALDINI, Alessandro et al. Design and validation of a trust-based opportunity-enabled risk management system. In: Information & computer security, 2017, vol. 25, n° 1, p. 2–25. doi: 10.1108/ICS-05-2016-0037
Fichiers principaux (1)
Article (Published version)
accessLevelRestricted
Identifiants
ISSN du journal2056-4961
1341vues
5téléchargements

Informations techniques

Création13/03/2017 15:25:00
Première validation13/03/2017 15:25:00
Heure de mise à jour15/03/2023 01:28:02
Changement de statut15/03/2023 01:28:02
Dernière indexation16/01/2024 23:30:07
All rights reserved by Archive ouverte UNIGE and the University of GenevaunigeBlack