A framework for estimating information security risk assessment method completeness: Core Unified Risk Framework, CURF
Open accessAbstract
In general, an information security risk assessment (ISRA) method produces risk estimates, where risk is the product of the probability of occurrence of an event and the associated consequences for the given organization. ISRA practices vary among industries and disciplines, resulting in various approaches and methods for risk assessments. There exist several methods for comparing ISRA methods, but these are scoped to compare the content of the methods to a predefined set of criteria, rather than process tasks to be carried out and the issues the method is designed to address. It is the lack of an all-inclusive and comprehensive comparison that motivates this work. This paper proposes the Core Unified Risk Framework (CURF) as an all-inclusive approach to compare different methods, all-inclusive since we grew CURF organically by adding new issues and tasks from each reviewed method. If a task or issue was present in surveyed ISRA method, but not in CURF, it was appended to the model, thus obtaining a measure of completeness for the studied methods. The scope of this work is primarily functional approaches risk assessment procedures, which are the formal ISRA methods that focus on assessments of assets, threats, vulnerabilities, and protections, often with measures of probability and consequence. The proposed approach allowed for a detailed qualitative comparison of processes and activities in each method and provided a measure of completeness. This study does not address aspects beyond risk identification, estimation, and evaluation; considering the total of all three activities, we found the “ISO/IEC 27005 Information Security Risk Management” to be the most complete approach at present. For risk estimation only, we found the Factor Analysis of Information Risk and ISO/IEC 27005:2011 as the most complete frameworks. In addition, this study discovers and analyzes several gaps in the surveyed methods.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
A Core Unified Risk Framework (CURF) compares different existing methods and provides a measure of completeness.
“A Core Unified Risk Framework (CURF) [41] compares different existing methods and provides a measure of completeness.”
From IoT cyber risk: A holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process (2020) · cites this paper as [41]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Design Science in Information Systems Research1
Hevner, A. R., March, S. T., Park, J., & Ram, S. (2004) · MIS Quarterly · doi:10.2307/25148625 · Cited by 10,707 · cited 1× · see citing works
“DSR is a problem-solving process specifically designed for research in complex information systems [28].”
BackgroundDesign science in information systems research
(2004) · Journal of the Association for Information Systems · doi:10.5555/2017212.2017217 · Cited by 8,254 · see citing works
The black swan: the impact of the highly improbable
(2007) · Choice Reviews Online · doi:10.5860/choice.45-1430 · Cited by 3,456 · see citing works
Positioning and Presenting Design Science Research for Maximum Impact1
Gregor, S. D., & Hevner, A. R. (2013) · MIS Quarterly · doi:10.25300/misq/2013/37.2.01 · Cited by 3,154 · see citing works
On the quantitative definition of risk
Kaplan, S., & Garrick, B. J. (1981) · Risk Analysis · doi:10.1111/j.1539-6924.1981.tb01350.x · Cited by 3,103 · see citing works
Design Science Research in Information Systems
Hevner, A. R., & Chatterjee, S. (2010) · Integrated series on information systems/Integrated series in information systems · doi:10.1007/978-1-4419-5653-8_2 · Cited by 1,414 · see citing works
Design Research in Information Systems: Theory and Practice
Hevner, A., & Chatterjee, S. (2010) · Integrated Series in Information Systems · doi:10.1007/978-1-4419-5653-8 · Cited by 1,382 · see citing works
On risk defined as an event where the outcome is uncertain
Aven, T., & Renn, O. (2009) · Journal of Risk Research · doi:10.1080/13669870802488883 · Cited by 787 · see citing works
The Black Swan: The Impact of the Highly Improbable
Millkey, A. M. (2009) · Psychiatric Services · doi:10.1176/appi.ps.60.11.1564 · Cited by 657 · see citing works
The risk concept—historical and recent development trends
Aven, T. (2012) · Reliability Engineering & System Safety · doi:10.1016/j.ress.2011.11.006 · Cited by 596 · see citing works
Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process
Caralli, R. A., Stevens, J. F., Young, L. R., & Wilson, W. R. (2007) · doi:10.21236/ada470450 · Cited by 294 · see citing works
ISRAM: information security risk analysis method
Karabacak, B., & Sogukpinar, I. (2005) · Computers & Security · doi:10.1016/j.cose.2004.07.004 · Cited by 243 · see citing works
Information security is information risk management
Blakley, B., McDermott, E., & Geer, D. (2001) · New Security Paradigms Workshop · doi:10.1145/508171.508187 · Cited by 208 · see citing works
Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process
Caralli, R. A., Stevens, J. F., Young, L. R., et al. (2007) · KiltHub Repository · doi:10.1184/r1/6574790.v1 · Cited by 203 · see citing works
Model-based security analysis in seven steps — a guided tour to the CORAS method
den Braber, F., Hogganvik, I., Lund, M. S., et al. (2007) · BT Technology Journal · doi:10.1007/s10550-007-0013-9 · Cited by 199 · see citing works
Dent, P. (2010) · Journal of Property Investment and Finance · doi:10.1108/jpif.2010.28.6.475.1 · Cited by 138 · see citing works
The IS risk analysis based on a business model
Suh, B., & Han, I. (2003) · Information & Management · doi:10.1016/s0378-7206(03)00044-2 · Cited by 138 · see citing works
Aven, T. (2009) · Wiley eBooks · doi:10.1002/9780470686539 · Cited by 128 · see citing works
Measuring and Managing Information Risk: A FAIR Approach
Freund, J., & Jones, J. B. (2014) · Cited by 110 · see citing works
Current challenges in information security risk management
Fenz, S., Heurix, J., Neubauer, T., et al. (2014) · Information Management & Computer Security · doi:10.1108/imcs-07-2013-0053 · Cited by 103 · see citing works
Obwanda, A. E. O. (2018) · Cited by 95 · see citing works
A conceptual framework of info structure for information security risk assessment (ISRA)
Shamala, P., Ahmad, R., & Yusoff, M. (2013) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2013.07.002 · Cited by 62 · see citing works
Information Security Risk Assessment: A Method Comparison
Wangen, G. (2017) · Computer · doi:10.1109/mc.2017.107 · Cited by 52 · see citing works
Self-citationSyalim, A., Hori, Y., & Sakurai, K. (2009) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2009.75 · Cited by 51 · see citing works
Risk Analysis of Changing and Evolving Systems Using CORAS
Lund, M. S., Solhaug, B., & Stølen, K. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-23082-0_9 · Cited by 42 · see citing works
A classification scheme for risk assessment methods.
Stamp, J. E., & Campbell, P. (2004) · doi:10.2172/925643 · Cited by 42 · see citing works
A Comparative Study on Information Security Risk Analysis Methods
Agrawal, V. (2017) · Journal of Computers · doi:10.17706/jcp.12.1.57-67 · Cited by 38 · see citing works
Toward Risk Assessment of Large-Impact and Rare Events
Hole, K. J., & Netland, L. (2010) · IEEE Security & Privacy · doi:10.1109/msp.2010.55 · Cited by 31 · see citing works
Security and Privacy Protection in Information Processing Systems
Janczewski, L. J., Wolfe, H. B., & Shenoi, S. (2013) · IFIP advances in information and communication technology · doi:10.1007/978-3-642-39218-4 · Cited by 20 · see citing works
Using the Conflicting Incentives Risk Analysis Method
Rajbhandari, L., & Snekkenes, E. A. (2013) · IFIP advances in information and communication technology · doi:10.1007/978-3-642-39218-4_24 · Cited by 19 · see citing works
Self-citationA Framework for Information Security Risk Management Communication.
Bornman, W., & Labuschagne, L. (2005) · Cited by 6 · see citing works
Risk Analysis Using "Conflicting Incentives" as an Alternative Notion of Risk
Rajbhandari, L. (2013) · NORA - Norwegian Open Research Archives · Cited by 3 · see citing works
Flagged first, then by citations
Research works printed but not linked: 8
- Aven, T., Renn, O.: On risk defined as an event where the outcome is uncertain. J. Risk Res. 12(1), 1-11 (2009)
- Jones, J.: An introduction to factor analysis of information risk (fair). Norwich J. Inf. Assur. 2(1), 67 (2006)
- Freund, J., Jones, J.: Measuring and Managing Information Risk: A FAIR Approach. Butterworth-Heinemann, Oxford (2014)
- Gregor, S., Hevner, A.R.: Positioning and presenting design sci- ence research for maximum impact. MIS Quart. 37(2), 337-355 (2013)
- Jones, J.: An introduction to factor analysis of information risk (fair). Norwich J. Inf. Assur. 2(1), 67 (2006)
- Fenz, S., Heurix, J., Neubauer, T., Pechstein, F.: Current challenges in information security risk management. Inf. Manag. Comput. Sec. 22(5), 410-430 (2014)
- Hole, K.J., Netland, L.H.: Toward risk assessment of large-impact and rare events. IEEE Sec. Priv. 8(3), 21-27 (2010)
- Suh, B., Han, I.: The IS risk analysis based on a business model. Inf. Manag. 41(2), 149-158 (2003)
Cited by
Sorted by citations
Kandasamy, K., Srinivas, S., Achuthan, K., & Rangan, V. P. (2020) · EURASIP Journal on Information Security · doi:10.1186/s13635-020-00111-0 · Cited by 160 · see citing works
- Authors
- Wangen, G., Hallstensen, C., & Snekkenes, E.
- Affiliations
- Norwegian University of Science and Technology (NO)
- Corresponding author
- Wangen, Gaute
- Venue
- International Journal of Information Security
- Published
- 2017-06-28
- Volume
- 17
- Issue
- 6
- Pages
- 681-699
- ISSN
- 1615-5262 (ISSN-L)
- 1615-5270
- OpenAlex
- W2727435480
- Cited by
- 109
- References
- 32
- Citations by year
- 2026: 6 · 2025: 9 · 2024: 7 · 2023: 18 · 2022: 18 · 2021: 15 · 2020: 14 · 2019: 11 · 2018: 5 · 2017: 3 · 2016: 1 · 2013: 1
- FWCI
- 16.80
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- International Journal of Information Security (publishedVersion, cc-by)
- BIBSYS Brage (BIBSYS (Norway)) (acceptedVersion, cc-by)
- NORA - Norwegian Open Research Archives (submittedVersion, cc-by)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Information Systems › Advanced Decision-Making Techniques
- Social Sciences › Business, Management and Accounting › Management Information Systems › Information Technology Governance and Strategy
- Keywords
- information security risk assessment, ISO/IEC 27005, risk estimation, risk identification, risk assessment, method comparison
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
