The development of the Internet of Things(IoT)calls for a comprehensive in-formation security evaluation framework to quantitatively measure the safety score and risk(S&R)value of the network urgently.In this pape...The development of the Internet of Things(IoT)calls for a comprehensive in-formation security evaluation framework to quantitatively measure the safety score and risk(S&R)value of the network urgently.In this paper,we summarize the architecture and vulnerability in IoT and propose a comprehensive information security evaluation model based on multi-level decomposition feedback.The evaluation model provides an idea for information security evaluation of IoT and guides the security decision maker for dynamic protection.Firstly,we establish an overall evaluation indicator system that includes four primary indicators of threat information,asset,vulnerability,and management,respectively.It also includes eleven secondary indicators of system protection rate,attack detection rate,confidentiality,availability,controllability,identifiability,number of vulnerabilities,vulnerability hazard level,staff organization,enterprise grading and service continuity,respectively.Then,we build the core algorithm to enable the evaluation model,wherein a novel weighting technique is developed and a quantitative method is proposed to measure the S&R value.Moreover,in order to better supervise the performance of the proposed evaluation model,we present four novel indicators includes residual risk,continuous conformity of residual risk,head-to-tail consistency and decrease ratio,respectively.Simulation results show the advantages of the proposed model in the evaluation of information security for IoT.展开更多
In today’s digitally driven landscape, robust Information Technology (IT) risk assessment practices are essential for safeguarding systems, digital communication, and data. This paper introduces “AssessITS,” an act...In today’s digitally driven landscape, robust Information Technology (IT) risk assessment practices are essential for safeguarding systems, digital communication, and data. This paper introduces “AssessITS,” an actionable method designed to provide organizations with comprehensive guidelines for conducting IT and cybersecurity risk assessments. Drawing extensively from NIST 800-30 Rev 1, COBIT 5, and ISO 31000, “AssessITS” bridges the gap between high-level theoretical standards and practical implementation challenges. The paper outlines a step-by-step methodology that organizations can simply adopt to systematically identify, analyze, and mitigate IT risks. By simplifying complex principles into actionable procedures, this framework equips practitioners with the tools needed to perform risk assessments independently, without too much reliance on external vendors. The guidelines are developed to be straightforward, integrating practical evaluation metrics that allow for the precise quantification of asset values, threat levels, vulnerabilities, and impacts on confidentiality, integrity, and availability. This approach ensures that the risk assessment process is not only comprehensive but also accessible, enabling decision-makers to implement effective risk mitigation strategies customized to their unique operational contexts. “AssessITS” aims to enable organizations to enhance their IT security strength through practical, actionable guidance based on internationally recognized standards.展开更多
For many dam projects in China, the 50-year designed life time is coming to an end. It is urgent to study the theory and method to evaluate the dam service life. In this paper, firstly, the probability theory of fuzzy...For many dam projects in China, the 50-year designed life time is coming to an end. It is urgent to study the theory and method to evaluate the dam service life. In this paper, firstly, the probability theory of fuzzy event and time-varying effect theory are used to analyze the time-variety of various risk factors in the process of dam operations. A method is proposed to quantify the above time-variety and a model to describe the fuzzy time-varying risk probability for the dam structure is also built. Secondly, the information entropy theory is used to analyze the uncertain degree relationship between the characteristic value of membership function and fuzzy risk probability, and a mathematical method is presented to calculate the time-varying risk probability accordingly. Thirdly, the relation mode between time-varying risk probability and service life is discussed. Based on this relation mode and the acceptable risk probability of dams in China, a method is put forward to evaluate and forecast the dam service life. Finally, the proposed theory and method are used to analyze one concrete dam. The dynamic variability and mutation feature of the dam risk probability are analyzed. The remaining service life of this dam is forecasted. The obtained results can provide technology support for the project management department to make treatment measures of engineering and reasonably arrange reinforce cost. The principles in this paper have wide applicability and can be used in risk analysis for slope instability and other fields.展开更多
基金This work was supported in part by National Key R&D Program of China under Grant 2019YFB2102400in part by the BUPT Excellent Ph.D.Students Foundation under Grant CX2019117.
文摘The development of the Internet of Things(IoT)calls for a comprehensive in-formation security evaluation framework to quantitatively measure the safety score and risk(S&R)value of the network urgently.In this paper,we summarize the architecture and vulnerability in IoT and propose a comprehensive information security evaluation model based on multi-level decomposition feedback.The evaluation model provides an idea for information security evaluation of IoT and guides the security decision maker for dynamic protection.Firstly,we establish an overall evaluation indicator system that includes four primary indicators of threat information,asset,vulnerability,and management,respectively.It also includes eleven secondary indicators of system protection rate,attack detection rate,confidentiality,availability,controllability,identifiability,number of vulnerabilities,vulnerability hazard level,staff organization,enterprise grading and service continuity,respectively.Then,we build the core algorithm to enable the evaluation model,wherein a novel weighting technique is developed and a quantitative method is proposed to measure the S&R value.Moreover,in order to better supervise the performance of the proposed evaluation model,we present four novel indicators includes residual risk,continuous conformity of residual risk,head-to-tail consistency and decrease ratio,respectively.Simulation results show the advantages of the proposed model in the evaluation of information security for IoT.
文摘In today’s digitally driven landscape, robust Information Technology (IT) risk assessment practices are essential for safeguarding systems, digital communication, and data. This paper introduces “AssessITS,” an actionable method designed to provide organizations with comprehensive guidelines for conducting IT and cybersecurity risk assessments. Drawing extensively from NIST 800-30 Rev 1, COBIT 5, and ISO 31000, “AssessITS” bridges the gap between high-level theoretical standards and practical implementation challenges. The paper outlines a step-by-step methodology that organizations can simply adopt to systematically identify, analyze, and mitigate IT risks. By simplifying complex principles into actionable procedures, this framework equips practitioners with the tools needed to perform risk assessments independently, without too much reliance on external vendors. The guidelines are developed to be straightforward, integrating practical evaluation metrics that allow for the precise quantification of asset values, threat levels, vulnerabilities, and impacts on confidentiality, integrity, and availability. This approach ensures that the risk assessment process is not only comprehensive but also accessible, enabling decision-makers to implement effective risk mitigation strategies customized to their unique operational contexts. “AssessITS” aims to enable organizations to enhance their IT security strength through practical, actionable guidance based on internationally recognized standards.
基金Supported by the National Natural Science Foundation of China(Grant Nos.50809025,50539110,50539010,50539030)the Science and Technology Sup-port Plan(Grant Nos.2008BAB29B03,2006BAC14B03)
文摘For many dam projects in China, the 50-year designed life time is coming to an end. It is urgent to study the theory and method to evaluate the dam service life. In this paper, firstly, the probability theory of fuzzy event and time-varying effect theory are used to analyze the time-variety of various risk factors in the process of dam operations. A method is proposed to quantify the above time-variety and a model to describe the fuzzy time-varying risk probability for the dam structure is also built. Secondly, the information entropy theory is used to analyze the uncertain degree relationship between the characteristic value of membership function and fuzzy risk probability, and a mathematical method is presented to calculate the time-varying risk probability accordingly. Thirdly, the relation mode between time-varying risk probability and service life is discussed. Based on this relation mode and the acceptable risk probability of dams in China, a method is put forward to evaluate and forecast the dam service life. Finally, the proposed theory and method are used to analyze one concrete dam. The dynamic variability and mutation feature of the dam risk probability are analyzed. The remaining service life of this dam is forecasted. The obtained results can provide technology support for the project management department to make treatment measures of engineering and reasonably arrange reinforce cost. The principles in this paper have wide applicability and can be used in risk analysis for slope instability and other fields.
