Information systems require awareness of risks and a good understanding of vulnerabilities and their exploitations. In this paper, we propose a novel approach for the systematic assessment and analysis of confidentiality risks caused by disclosure of operational and functional information. The approach is based on a model integrating information assets and the IT infrastructure that they rely on for distributed systems. IT infrastructures enable one to analyse risk propagation possibilities and calculate the impact of confidentiality incidents. Furthermore, our approach is a mean to bridge the technical and business- oriented views of information systems, since the importance of information assets, which is leading the technical decisions, is set by the business.
|Title of host publication||Proceedings 3rd IEEE/IFIP International Workshop on Business-driven IT Management (BDIM 2008, Salvador, Brazil, April 7, 2008)|
|Editors||C. Bartolini, A. Sahai, J.P. Sauvé|
|Publisher||Institute of Electrical and Electronics Engineers|
|Publication status||Published - 2008|
Morali, A., Zambon, E., Etalle, S., & Overbeek, P. L. (2008). IT confidentiality risk assessment for an architecture-based approach. In C. Bartolini, A. Sahai, & J. P. Sauvé (Eds.), Proceedings 3rd IEEE/IFIP International Workshop on Business-driven IT Management (BDIM 2008, Salvador, Brazil, April 7, 2008) (pp. 31-40). Institute of Electrical and Electronics Engineers. https://doi.org/10.1109/BDIM.2008.4540072