The DOI matches its Crossref record; 34 of the 34 references it cites were found in a registry or an index.
Quantitatively assessing the vulnerability of critical information systems: A new method for evaluating security enhancements
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Attack and vulnerability trees, which belong to PRA methods, usually concentrate on a specific type of attack and at best attempt to cover all known threats and vulnerabilities in an infrastructure, ignoring unknown threats.
“Attack and vul-nerability trees, which belong to PRA methods, usually concentrate on a specific type of attack and at best attempt to cover “all known threats and vulnerabilities in an infrastruc-ture” (Patel et al., 2008, p. 484), ignoring unknown threats.”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Patel et al., 2008
Tree-based methods are similar in their logic and aim to define the probability of the top event or its reliability.
“Tree-based methods are similar in their logic and aim to define the probability of the top event or its reliability (Patel et al., 2008).”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Patel et al., 2008
Among probabilistic tree-based methods for SCADA systems, inductive and deductive methods are distinguished.
“In Cheminod et al. (2013), Patel et al. (2008), Ralston et al. (2007), Taylor et al. (2002), among proba-bilistic tree-based methods for SCADA systems inductive and deductive methods are distinguished.”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Patel et al., 2008
Most often, risk assessment methods in general are classified into qualitative and quantitative, with semi-quantitative methods being distinguished in some publications.
“Most often, risk assessment methods in general are classi-fied into qualitative and quantitative (Campbell and Stamp, 2004; Karabacak and Sogukpinar, 2005; Patel et al., 2008), with semi-quantitative methods being distinguished in some pub-lications (Campbell and Stamp, 2004; Markovic-Petrovic and Stojanovic, 2014).”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Patel et al., 2008
Citations
Cites
The economics of information security investment
Gordon, L. A., & Loeb, M. P. (2002) · ACM Transactions on Information and System Security · doi:10.1145/581271.581274 · Cited by 1,341
Principles of Information Security
Whitman, M. E., & Mattord, H. J. (2002) · DigitalCommons - Kennesaw State University (Kennesaw State University) · Cited by 993
Cavusoglu, H., Mishra, B. K., & Raghunathan, S. (2004) · International Journal of Electronic Commerce · doi:10.1080/10864415.2004.11044320 · Cited by 777
Campbell, K., Gordon, L. A., Loeb, M. P., & Zhou, L. (2003) · Journal of Computer Security · doi:10.3233/jcs-2003-11308 · Cited by 736
Common Vulnerability Scoring System
Mell, P., Scarfone, K. A., & Romanosky, S. (2006) · IEEE Security & Privacy · doi:10.1109/msp.2006.145 · Cited by 691
Modeling and simulating critical infrastructures and their interdependencies
Rinaldi, S. M. (2004) · Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences · doi:10.1109/hicss.2004.1265180 · Cited by 431
A model for evaluating IT security investments
Cavusoglu, H., Mishra, B. K., & Raghunathan, S. (2004) · Communications of the ACM · doi:10.1145/1005817.1005828 · Cited by 361
Information Security Risk Analysis
Peltier, T. R., & Peltier, T. R. (2005) · Auerbach Publications eBooks · doi:10.1201/9781420031195 · Cited by 347
Risk Analysis in Engineering and Economics
Ayyub, B. M., & Ayyub, B. M. (2003) · Chapman & Hall/CRC eBooks · doi:10.1201/9780203497692 · Cited by 313
Introduction to the OCTAVE Approach
Alberts, C., Dorofee, A., Stevens, J. F., & Woody, C. (2003) · doi:10.21236/ada634134 · Cited by 262
The Impact of Denial‐of‐Service Attack Announcements on the Market Value of Firms
Hovav, A., & D’Arcy, J. (2003) · Risk Management and Insurance Review · doi:10.1046/j.1098-1616.2003.026.x · Cited by 248
Risk Filtering, Ranking, and Management Framework Using Hierarchical Holographic Modeling
Haimes, Y. Y., Kaplan, S., & Lambert, J. H. (2002) · Risk Analysis · doi:10.1111/0272-4332.00020 · Cited by 216
Kumamoto, H., & Henley, E. J. (2009) · Institute of Electrical and Electronics Engineers eBooks · doi:10.1109/9780470546277.ch3 · Cited by 197
The Principled Design of Computer System Safety Analyses
Pumfrey, D. (1999) · White Rose eTheses Online (University of Leeds, The University of Sheffield, University of York) · Cited by 129
Information Security Risk Analysis
Peltier, T. R. (2001) · Auerbach Publications eBooks · doi:10.1201/b12444 · Cited by 124
Simulating cyber attacks, defences, and consequences
Cohen, F. (1999) · Computers & Security · doi:10.1016/s0167-4048(99)80115-1 · Cited by 111
Model-based risk assessment to improve enterprise security
Aagedal, J. Ø., den Braber, F., Dimitrakos, T., Gran, B. A., Raptis, D., & Stølen, K. (2003) · IEEE International Enterprise Distributed Object Computing Conference (EDOC) · doi:10.1109/edoc.2002.1137696 · Cited by 107
Are we forgetting the risks of information technology?
Longstaff, T. A., Chittister, C., Pethia, R., et al. (2000) · Computer · doi:10.1109/2.889092 · Cited by 99
Managing Information System Security
Dhillon, G. S. (1997) · doi:10.1007/978-1-349-14454-9 · Cited by 97
The Impact of Virus Attack Announcements on the Market Value of Firms
Hovav, A., & D’Arcy, J. (2004) · Information Systems Security · doi:10.1201/1086/44530.13.3.20040701/83067.5 · Cited by 95
Managing vulnerabilities of information systems to security incidents
Farahmand, F., Navathe, S. B., Enslow, P. H., & Sharp, G. P. (2003) · International Conference on Electronic Commerce · doi:10.1145/948005.948050 · Cited by 94
A Management Perspective on Risk of Security Threats to Information Systems
Farahmand, F., Navathe, S. B., Sharp, G. P., & Enslow, P. H. (2005) · Information Technology and Management · doi:10.1007/s10799-005-5880-5 · Cited by 89
Assessing the risk in e-commerce
Ettredge, M., & Richardson, V. J. (2003) · Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences · doi:10.1109/hicss.2002.994192 · Cited by 67
Proceedings of the 7th international conference on Electronic commerce
Li, Q., & Liang, T. (2005) · Cited by 52
Visualization strategies and tools for enhancing customer relationship management
Ganapathy, S., Ranganathan, C., & Sankaranarayanan, B. (2004) · Communications of the ACM · doi:10.1145/1029496.1029500 · Cited by 50
Toward a Unified Security-Safety Model
Stoneburner, G. (2006) · Computer · doi:10.1109/mc.2006.283 · Cited by 50
Haimes, Y. Y., & Chittester, C. G. (2005) · Journal of Homeland Security and Emergency Management · doi:10.2202/1547-7355.1117 · Cited by 46
A classification scheme for risk assessment methods.
Stamp, J. E., & Campbell, P. (2004) · doi:10.2172/925643 · Cited by 42
Assessing the performance of interdependent infrastructures and optimizing investments
Nozick, L. K., Turnquist, M. A., Jones, D. A., Davis, J. R., & Lawton, C. R. (2004) · Hawaii International Conference on System Sciences (HICSS) · doi:10.1109/hicss.2004.1265181 · Cited by 35
Assessing the performance of interdependent infrastructures and optimising investments
Nozick, L. K., Turnquist, M. A., Jones, D. A., Davis, J. R., & Lawton, C. R. (2005) · International Journal of Critical Infrastructures · doi:10.1504/ijcis.2005.006116 · Cited by 29
Modarres, M., & Kim, I. S. (2020) · Elsevier eBooks · doi:10.1016/b978-0-12-409548-9.12161-x · Cited by 27
Secure internet-based communication protocol for scada networks
Graham, J. H., & Patel, S. C. (2006) · Cited by 17
Self-citationAnalyzing Internet security protocols
Yasinsac, A., & Childs, J. (2002) · doi:10.1109/hase.2001.966816 · Cited by 17
Secure SCADA Communications, Monitoring and Control over the Internet.
Patel, S. C., Graham, J. H., Ralston, P. A. S., et al. (2005) · Computer Applications in Industry and Engineering · Cited by 2
Self-citation
Flagged first, then by citations
Research works printed but not linked: 3
- Iheagwara, 2003, More effective risk assessment, Computer Security Journal, 19, 8
- Miller, 2005, Risk assessment: The first step, InTech, 52, 68
- Schneier, 1999, Attack trees, Dr. Dobb's Journal of Software Tools, 24, 21
Cited by
Sorted by citations
A review of cyber security risk assessment methods for SCADA systems
Cherdantseva, Y., Burnap, P., Blyth, A., Eden, P., Jones, K., Soulsby, H., & Stoddart, K. (2016) · Computers & Security · doi:10.1016/j.cose.2015.09.009 · Cited by 606
Metadata
- Authors
- Patel, S. C., Graham, J. H., & Ralston, P. A. S.
- Affiliations
- Morgan State University (US)
- University of Louisville (US)
- Corresponding author
- Patel, Sandip C.
- Venue
- International Journal of Information Management
- Publisher
- Elsevier BV
- Published
- 2008-12
- Volume
- 28
- Issue
- 6
- Pages
- 483-491
- ISSN
- 0268-4012 (ISSN-L)
- OpenAlex
- W2070907750
- Cited by
- 90
- References
- 34
- Citations by year
- 2026: 2 · 2025: 6 · 2024: 7 · 2023: 6 · 2022: 5 · 2021: 10 · 2020: 8 · 2019: 6 · 2018: 7 · 2017: 2 · 2016: 3 · 2015: 1 · 2014: 5 · 2013: 5 · 2012: 7
- FWCI
- 10.35
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- International Journal of Information Management (publishedVersion)
- RePEc: Research Papers in Economics (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Engineering › Civil and Structural Engineering › Infrastructure Resilience and Vulnerability Analysis
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Keywords
- critical information systems, vulnerability assessment, SCADA systems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
