Model-Based Risk Assessment to Improve Enterprise Security

The main objective of the CORAS project is to provide methods and tools for precise, unambiguous, and efficient risk assessment of security critical systems. To this end, we advocate a model-based approach to risk assessment, and this paper attempts to define the required models for this. Whereas traditional risk assessment is performed without any formal description of the target of evaluation or results of the risk assessment, CORAS aims to provide a well defined set of models well suited to (1) describe the f assessment at the right level of abstraction, (2) as a medium for communication between different groups of stakeholders involved in a risk assessment, and (3) to document risk assessment results and the assumptions on which these results depend. We propose here models for each step in a risk assessment process and report results of use.

• Type: Conference
• Year: 2002
• Where: EDOC
• Authors: Jan Øyvind Aagedal, Folker den Braber, Theodosis Dimitrakos, Bjørn Axel Gran, Dimitris Raptis, Ketil Stølen
• Keywords: Distributed And Parallel Computing, EDOC 2002, Efficient Risk Assessment, Risk Assessment, Traditional Risk Assessment