Incorporating a knowledge perspective into security risk assessments

Purpose – Many methodologies exist to assess the security risks associated with unauthorized leakage, modification and interruption of information used by organisations. This paper argues that these methodologies have a traditional orientation towards the identification and assessment of technical information assets. This obscures key risks associated with the cultivation and deployment of organisational knowledge. The purpose of this paper is to explore how security risk assessment methods can more effectively identify and treat the knowledge associated with business processes.

Design/methodology/approach – The argument was developed through an illustrative case study in which a well-documented traditional methodology is applied to a complex data backup process. Follow-up interviews were conducted with the organisation’s security managers to explore the results of the assessment and the nature of knowledge “assets” within a business process.

Findings – It was discovered that the backup process depended, in subtle and often informal ways, on tacit knowledge to sustain operational complexity, handle exceptions and make frequent interventions. Although typical information security methodologies identify people as critical assets, this study suggests a new approach might draw on more detailed accounts of individual knowledge, collective knowledge and their relationship to organisational processes.

Originality/value – Drawing on the knowledge management literature, the paper suggests mechanisms to incorporate these knowledge-based considerations into the scope of information security risk methodologies. A knowledge protection model is presented as a result of this research. This model outlines ways in which organisations can effectively identify and treat risks around process knowledge critical to the business.

Rock slope risk analysis based on non-linear failure criterion

The probability of failure of a rock slope is generally estimated by using the Limit Equilibrium Method (LEM) in conjunction with a reliability analysis. Although the LEM is relatively simple and time efficient, recent studies have indicated that using the LEM may overestimate the factor of safety by 21%, when based on a non-linear failure criterion. Fortunately, the solutions presented by Li et al. (2008, 2009) can provide more accurate evaluations for rock slope stability as the numerical upper and lower bound limit analysis methods (2002a, 2002b, 2005) were employed. The advantages of these methods are used in this study to assess the rock slope probability of failure. The motivation is that with more accurate methods to evaluate the factor of safety, more economic designs can be performed.

Major quantitative techniques for risk analysis in the construction industry : a comparative analysis

Risk analysis is one of the critical functions of the risk management process. It relies on a detailed understanding of risks and their possible implications. Construction projects, because of their large and complex nature, are plagued by a variety of risks which must be considered and responded to in order to ensure project success. This study conducts an extensive comparative analysis of major quantitative risk analysis techniques in the construction industry. The techniques discussed and comparatively analyzed in this report include: Programme Evaluation and Review Technique (PERT), Judgmental Risk Analysis Process (JRAP), Estimating Using Risk Analysis (ERA), Monte Carlo Simulation technique, Computer Aided Simulation for Project Appraisal and Review (CASPAR), Failure Modes and Effects Analysis technique (FMEA) and Advanced Programmatic Risk Analysis and Management model (APRAM). The findings highlight the fact that each risk analysis technique addresses risks in any or all of the following areas – schedule risks, budget risks or technical risks. Through comparative analysis, it has been revealed that a majority of risk analysis techniques focus on schedule or budget risks. Very little has been documented in terms of technical risk analysis techniques. In an era where clients are demanding and expecting higher quality projects and finishes, project managers must endeavor to invest time and resources to ensure that the few existing technical risk analysis techniques are developed and further refined, and that new technical risk analysis techniques are developed to suit the current construction industries requirements.

Does traditional security risk assessment have a future in information security?

The current information security standards still advocate the use of risk assessment in the prioritisation of security investments. However, prior research on the use of risk assessment methodologies in organisational security has shown that the use of the traditional monolithic risk assessment process described in the current risk management standard is simply not practical at the organisational level. This paper first examines the problems in performing a systematic risk assessment and then discusses the limitations of a traditional risk assessment. To address these limitations, this paper proposes splitting up the current monolithic risk assessment process. The result is an information security assessment framework that puts greater emphasis on situational awareness and allows for better decision making on the prioritization of security investments.

Attributable risk analysis reveals potential healthcare savings from increased consumption of dairy products.

With rising burdens of obesity and chronic disease, the role of diet as a modifiable risk factor is of increasing public health interest. There is a growing body of evidence that low consumption of dairy products is associated with elevated risk of chronic metabolic and cardiovascular disorders. Surveys also suggest that dairy product consumption falls well below recommended targets for much of the population in many countries, including the USA, UK, and Australia. We reviewed the scientific literature on the health effects of dairy product consumption (both positive and negative) and used the best available evidence to estimate the direct healthcare expenditure and burden of disease [disability-adjusted life years (DALY)] attributable to low consumption of dairy products in Australia. We implemented a novel technique for estimating population attributable risk developed for application in nutrition and other areas in which exposure to risk is a continuous variable. We found that in the 2010-2011 financial year, AUD$2.0 billion (USD$2.1 billion, €1.6 billion, or ∼1.7% of direct healthcare expenditure) and the loss of 75,012 DALY were attributable to low dairy product consumption. In sensitivity analyses, varying core assumptions yielded corresponding estimates of AUD$1.1-3.8 billion (0.9-3.3%) and 38,299-151,061 DALY lost. The estimated healthcare cost attributable to low dairy product consumption is comparable with total spending on public health in Australia (AUD$2.0 billion in 2009-2010). These findings justify the development and evaluation of cost-effective interventions that use dairy products as a vector for reducing the costs of diet-related disease.

A hybrid approach to fuzzy risk analysis in stock market

The analysis and prediction of stock market has always been well recognized as a difficult problem due to the level of uncertainty and the factors that affect the price. To tackle this challenge problem, this paper proposed a hybrid approach which mines the useful information utilizing grey system and fuzzy risk analysis in stock prices prediction. In this approach, we firstly provide a model which contains the fuzzy function, k-mean algorithm and grey system (shorted for FKG), then provide the model of fuzzy risk analysis (FRA). A practical example to describe the development of FKG and FRA in stock market is given, and the analytical results provide an evaluation of the method which shows promote results. © 2013 IEEE.

Risky business: social media metrics and political risk analysis

A quantificação do risco país – e do risco político em particular – levanta várias dificuldades às empresas, instituições, e investidores. Como os indicadores econômicos são atualizados com muito menos freqüência do que o Facebook, compreender, e mais precisamente, medir – o que está ocorrendo no terreno em tempo real pode constituir um desafio para os analistas de risco político. No entanto, com a crescente disponibilidade de “big data” de ferramentas sociais como o Twitter, agora é o momento oportuno para examinar os tipos de métricas das ferramentas sociais que estão disponíveis e as limitações da sua aplicação para a análise de risco país, especialmente durante episódios de violência política. Utilizando o método qualitativo de pesquisa bibliográfica, este estudo identifica a paisagem atual de dados disponíveis a partir do Twitter, analisa os métodos atuais e potenciais de análise, e discute a sua possível aplicação no campo da análise de risco político. Depois de uma revisão completa do campo até hoje, e tendo em conta os avanços tecnológicos esperados a curto e médio prazo, este estudo conclui que, apesar de obstáculos como o custo de armazenamento de informação, as limitações da análise em tempo real, e o potencial para a manipulação de dados, os benefícios potenciais da aplicação de métricas de ferramentas sociais para o campo da análise de risco político, particularmente para os modelos qualitativos-estruturados e quantitativos, claramente superam os desafios.

Business Plan, financial and risk analysis from the start-up mathrix

Mathrix is an e-learning math website that will be launched in March 2016. This master thesis offered a unique chance to interact with experienced supervisors in venture capitalism and project investment. It could serve as guidelines for entrepreneurs who intend to raise funds. Starting with the company’s business plan, the thesis focuses on estimating the company’s value with its return on investment using three scenarios and taking into consideration the risks evolved.

Preliminary risk analysis applied to the handling of health-care waste

Between 75% and 90% of the waste produced by health-care providers no risk or is "general" health-care waste, comparable to domestic waste. The remaining 10-25% of health-care waste is regarded as hazardous due to one or more of the following characteristics: it may contain infectious agents, sharps, toxic or hazardous chemicals or it may be radioactive. Infectious health-care waste, particularly sharps, has been responsible for most of the accidents reported in the literature. In this work the preliminary risks analysis (PRA) technique was used to evaluate practices in the handling of infectious health-care waste. Currently the PRA technique is being used to identify and to evaluate the potential for hazard of the activities, products, and services from facilities and industries. The system studied was a health-care establishment which has handling practices for infectious waste. Thirty-six procedures related to segregation, containment, internal collection, and storage operation were analyzed. The severity of the consequences of the failure (risk) that can occur from careless management of infectious health-care waste was classified into four categories: negligible, marginal, critical, and catastrophic. The results obtained in this study showed that events with critics consequences, about 80%, may occur during the implementation of the containment operation, suggesting the need to prioritize this operation. As a result of the methodology applied in this work, a flowchart the risk series was also obtained. In the flowchart the events that can occur as a consequence of a improper handling of infectious health-care waste, which can cause critical risks such as injuries from sharps and contamination (infection) from pathogenic microorganisms, are shown.

Optimal Reactive Power Planning Using Risk Analysis

In this paper, the optimal reactive power planning problem under risk is presented. The classical mixed-integer nonlinear model for reactive power planning is expanded into two stage stochastic model considering risk. This new model considers uncertainty on the demand load. The risk is quantified by a factor introduced into the objective function and is identified as the variance of the random variables. Finally numerical results illustrate the performance of the proposed model, that is applied to IEEE 30-bus test system to determine optimal amount and location for reactive power expansion.

Risk analysis of tractor rollover in the normal operation in field

Tractor rollover represent a primary cause of death or serious injury in agriculture and despite the mandatory Roll-Over Protective Structures (ROPS), that reduced the number of injuries, tractor accidents are still of great concern. Because of their versatility and wide use many studies on safety are concerned with the stability of tractors, but they often prefer controlled tests or laboratory tests. The evaluation of tractors working in field, instead, is a very complex issue because the rollover could be influenced by the interaction among operator, tractor and environment. Recent studies are oriented towards the evaluation of the actual working conditions developing prototypes for driver assistance and data acquisition. Currently these devices are produced and sold by manufacturers. A warning device was assessed in this study with the aim to evaluate its performance and to collect data on different variables influencing the dynamics of tractors in field by monitoring continuously the working conditions of tractors operating at the experimental farm of the Bologna University. The device consists of accelerometers, gyroscope, GSM/GPRS, GPS for geo-referencing and a transceiver for the automatic recognition of tractor-connected equipment. A microprocessor processes data and provides information, through a dedicated algorithm requiring data on the geometry of the tested tractor, on the level of risk for the operator in terms of probable loss of stability and suggests corrective measures to reduce the potential instability of the tractor.

Dynamics of coastal aquifers: data-driven forecasting and risk analysis

This work is focused on the study of saltwater intrusion in coastal aquifers, and in particular on the realization of conceptual schemes to evaluate the risk associated with it. Saltwater intrusion depends on different natural and anthropic factors, both presenting a strong aleatory behaviour, that should be considered for an optimal management of the territory and water resources. Given the uncertainty of problem parameters, the risk associated with salinization needs to be cast in a probabilistic framework. On the basis of a widely adopted sharp interface formulation, key hydrogeological problem parameters are modeled as random variables, and global sensitivity analysis is used to determine their influence on the position of saltwater interface. The analyses presented in this work rely on an efficient model reduction technique, based on Polynomial Chaos Expansion, able to combine the best description of the model without great computational burden. When the assumptions of classical analytical models are not respected, and this occurs several times in the applications to real cases of study, as in the area analyzed in the present work, one can adopt data-driven techniques, based on the analysis of the data characterizing the system under study. It follows that a model can be defined on the basis of connections between the system state variables, with only a limited number of assumptions about the "physical" behaviour of the system.

Quantitative risk analysis as a tool in process design

La Quantitative Risk Analysis costituisce un valido strumento per la determinazione del rischio associato ad un’installazione industriale e per la successiva attuazione di piani di emergenza. Tuttavia, la sua applicazione nella progettazione di un lay-out richiede la scelta di un criterio in grado di valutare quale sia la disposizione ottimale al fine di minimizzare il rischio. In tal senso, le numerose procedure esistenti, sebbene efficaci, risultano piuttosto faticose e time-consuming. Nel presente lavoro viene dunque proposto un criterio semplice ed oggettivo per comparare i risultati di QRA applicate a differenti designs. Valutando l’area racchiusa nelle curve iso-rischio, vengono confrontate dapprima le metodologie esistenti per lo studio dell’effetto domino, e successivamente, viene applicata al caso di serbatoi in pressione una procedura integrata di Quantitative Risk Domino Assessment. I risultati ottenuti dimostrano chiaramente come sia possibile ridurre notevolmente il rischio di un’attività industriale agendo sulla disposizione delle apparecchiature, con l’obiettivo di limitare gli effetti di possibili scenari accidentali.

Risk analysis of light-frame wood construction due to multiple hazards

Light-frame wood buildings are widely built in the United States (U.S.). Natural hazards cause huge losses to light-frame wood construction. This study proposes methodologies and a framework to evaluate the performance and risk of light-frame wood construction. Performance-based engineering (PBE) aims to ensure that a building achieves the desired performance objectives when subjected to hazard loads. In this study, the collapse risk of a typical one-story light-frame wood building is determined using the Incremental Dynamic Analysis method. The collapse risks of buildings at four sites in the Eastern, Western, and Central regions of U.S. are evaluated. Various sources of uncertainties are considered in the collapse risk assessment so that the influence of uncertainties on the collapse risk of lightframe wood construction is evaluated. The collapse risks of the same building subjected to maximum considered earthquakes at different seismic zones are found to be non-uniform. In certain areas in the U.S., the snow accumulation is significant and causes huge economic losses and threatens life safety. Limited study has been performed to investigate the snow hazard when combined with a seismic hazard. A Filtered Poisson Process (FPP) model is developed in this study, overcoming the shortcomings of the typically used Bernoulli model. The FPP model is validated by comparing the simulation results to weather records obtained from the National Climatic Data Center. The FPP model is applied in the proposed framework to assess the risk of a light-frame wood building subjected to combined snow and earthquake loads. The snow accumulation has a significant influence on the seismic losses of the building. The Bernoulli snow model underestimates the seismic loss of buildings in areas with snow accumulation. An object-oriented framework is proposed in this study to performrisk assessment for lightframe wood construction. For home owners and stake holders, risks in terms of economic losses is much easier to understand than engineering parameters (e.g., inter story drift). The proposed framework is used in two applications. One is to assess the loss of the building subjected to mainshock-aftershock sequences. Aftershock and downtime costs are found to be important factors in the assessment of seismic losses. The framework is also applied to a wood building in the state of Washington to assess the loss of the building subjected to combined earthquake and snow loads. The proposed framework is proven to be an appropriate tool for risk assessment of buildings subjected to multiple hazards. Limitations and future works are also identified.