research-article

A review of research on risk analysis methods for IT systems

Authors:

Sardar Muhammad Sulaman,

Martin HöstAuthors Info & Claims

EASE '13: Proceedings of the 17th International Conference on Evaluation and Assessment in Software Engineering

Pages 86 - 96

https://doi.org/10.1145/2460999.2461013

Published: 14 April 2013 Publication History

Abstract

Context: At the same time as our dependence on IT systems increases, the number of reports of problems caused by failures of critical IT systems has also increased. This means that there is a need for risk analysis in the development of this kind of systems. Risk analysis of technical systems has a long history in mechanical and electrical engineering. Objective: Even if a number of methods for risk analysis of technical systems exist, the failure behavior of information systems is typically very different from mechanical systems. Therefore, risk analysis of IT systems requires different risk analysis techniques, or at least adaptations of traditional approaches. This means that there is a need to understand what types of methods are available for IT systems and what research that has been conducted on these methods. Method: In this paper we present a systematic mapping study on risk analysis for IT systems. 1086 unique papers were identified in a database search and 57 papers were identified as relevant for this study. These papers were classified based on 5 different criteria. Results: This classification, for example, shows that most of the discussed risk analysis methods are qualitative and not quantitative and that most of the risk analysis methods that are presented in these papers are developed for IT systems in general and not for specific types of IT system. Conclusions: The results show that many new risk analysis methods have been proposed in the last decade but even more that there is a need for more empirical evaluations of the different risk analysis methods. Many papers were identified that propose new risk analysis methods, but few papers discuss a systematic evaluation of these methods or a comparison of different methods based on empirical data.

References

[1]

C. Alberts and A. Dorofee. Managing Information Security Risks: The Octave Approach. SEI Series in Software Engineering. Addison-Wesley, 2003.

Digital Library

[2]

E. Engström and P. Runeson. Software Product Line Testing - A Systematic Mapping Study. Information and Software Technology, 53:2--13, 2011.

Digital Library

[3]

ENISA ad hoc working group on risk assessment and risk management. Inventory of risk assessment and risk management methods, 2006.

[4]

C. A. Ericson. Fault Tree Analysis -- A History. In Proceedings of The 17th International System Safety Conference, 1999.

[5]

Great Britain. Treasury. Central Computer and Telecommunications Agency. Prince User's Guide to CRAMM. Programme and Project Management Library. H. M. Stationery Office, 1993.

[6]

International Organization for Standardization. ISO/IEC 27002:2005 -- Information technology -- Security techniques -- Code of practice for information security management, 2005.

[7]

International Organization for Standardization. ISO/IEC 27005:2011 -- Information technology -- Security techniques -- Information security risk management, 2011.

[8]

M. Jørgensen. A Review of Studies on Expert Estimation of Software Development Effort. Journal of Systems and Software, 70(1--2):37--60, 2004.

Digital Library

[9]

M. Khan, S. Khan, and M. Sadiq. Systematic review of software risk assessment and estimation models. International Journal of Engineering and Advanced Technology, 1:298.

[10]

B. Kitchenham, O. P. Brereton, D. Budgen, M. Turner, J. Bailey, and S. Linkman. Systematic Literature Reviews in Software Engineering -- A Systematic Literature Review. Information and Software Technology, 51(1):7--15, 2009.

Digital Library

[11]

B. Kitchenham, D. Budgen, and O. P. Brereton. Using Mapping Studies as the Basis for Further Research -- A Participant-Observer Case Study. Information and Software Technology, 53:638--651, June 2011.

Digital Library

[12]

B. Kitchenham and S. Charters. Guidelines for performing systematic literature reviews in software engineering. Technical Report Keele University and University of Durham, 2.3, 2007.

[13]

B. Li, M. Li, K. Chen, and C. Smidts. Integrating Software into PRA: A Software-Related Failure Mode Taxonomy. Risk Analysis, 26(4):997--1012, 2006.

[14]

D. Liu, Q. Wang, and J. Xiao. The role of software process simulation modeling in software risk management: A systematic review. In 3rd International Symposium on Empirical Software Engineering and Measurement (ESEM), pages 302--311. IEEE, 2009.

Digital Library

[15]

R. McDermott, R. Mikulak, and M. Beauregard. The Basics of FMEA, 2nd Edition. Taylor & Francis, 1996.

[16]

Methods working group, Club de la Sécurité de l'Information Françcais. Mehari 2010 -- evaluation guide for security services, 2010.

[17]

L. Mixia, Y. Dongmei, Z. Qiuyu, and Z. Honglei. Network Security Risk Assessment and Situation Analysis. In Proceedings of the 2007 IEEE International Workshop on Anti-counterfeiting, Security, Identification, pages 448--452, april 2007.

[18]

P. G. Neumann. Risks of Untrustworthiness. In Proceedings of the 22:nd Annual Computer Security Applications Conference, pages 321--328. IEEE Computer Society, 2006.

Digital Library

[19]

F. Redmill, M. Chudleigh, and J. Catmur. System Safety: HAZOP and Software HAZOP. John Wiley & Sons, 1999.

[20]

K.-J. Stol and M. A. Babar. Reporting Empirical Research in Open Source Software: The State of Practice. In Proceedings of the International Conference on Open Source Systems, OSS 2009, pages 156--169, 2009.

[21]

G. Stoneburner, A. Goguen, and A. Feringa. Risk Management Guide for Information Technology Systems. National Institute of Standards and Technology, Special Publication 800-30. U.S. Government Printing Office, 2002.

Digital Library

[22]

A. Syalim, Y. Hori, and K. Sakurai. Comparison of Risk Analysis Methods: Mehari, Magerit, NIST800-30 and Microsoft's Security Management Guide. In ARES, pages 726--731. IEEE Computer Society, 2009.

[23]

C. Wohlin, P. Runeson, M. Höst, M. C. Ohlsson, B. Regnell, and A. Wesslén. Experimentation in software engineering: an introduction. Kluwer Academic Publishers, Norwell, MA, USA, 2000.

Digital Library

Cited By

Budiraharjo RSarno RWijaya DPrasetyo HWaspada I(2023)IMARA: A New Approach to Multi-Attribute Risk Assessment based on Event Data Weighting (Case Study in a Container Terminal)IEEE Access10.1109/ACCESS.2023.3287781(1-1)Online publication date: 2023
https://doi.org/10.1109/ACCESS.2023.3287781
Lin YRuan MCai KLi DZeng ZLi FYang B(2022)Identifying and managing risks of AI-driven operations: A case study of automatic speech recognition for improving air traffic safetyChinese Journal of Aeronautics10.1016/j.cja.2022.08.020Online publication date: Aug-2022
https://doi.org/10.1016/j.cja.2022.08.020
Dreyling RJackson EPappel I(2021)Cyber Security Risk Analysis for a Virtual Assistant G2C Digital Service Using FAIR Model2021 Eighth International Conference on eDemocracy & eGovernment (ICEDEG)10.1109/ICEDEG52154.2021.9530938(33-40)Online publication date: 28-Jul-2021
https://doi.org/10.1109/ICEDEG52154.2021.9530938
Show More Cited By

Index Terms

A review of research on risk analysis methods for IT systems

Recommendations

A comparative framework for risk analysis methods

The past decade has shown the importance of information security, with special emphasis on network security, disaster recovery and risk management. A number of automated approaches for the facilitation of a risk analysis study have appeared on the ...
A Comprehensive Literature Review on Construction Project Risk Analysis

The purpose of this paper is to present the chronological development of risk assessment techniques and models undertaken in construction project for the past two decades. This research used a systematic review and meta-analysis on risk assessment of ...
Risk Acceptance and Rejection for Threat and Opportunity Risks in Conflicting Incentives Risk Analysis
TrustBus 2013: Proceedings of the 10th International Conference on Trust, Privacy, and Security in Digital Business - Volume 8058

Classical methods for risk analysis usually rely on probability estimates that are sometimes difficult to verify. In particular, this is the case when the system in question is non-stationary or does not have a history for which reliable statistics is ...

Comments

Information & Contributors

Information

Published In

cover image ACM Other conferences

EASE '13: Proceedings of the 17th International Conference on Evaluation and Assessment in Software Engineering

April 2013

268 pages

ISBN:9781450318488

DOI:10.1145/2460999

General Chair:
Fabio Q. B. da Silva
Universidade Federal de Pernambuco, Brazil
,
Program Chairs:
Natalia Juristo
Universidad Politécnica de Madrid, Spain
,
Guilherme Horta Travassos
Universidade Federal do Rio de Janeiro, Brazil

Copyright © 2013 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Centro de Informatica - UFPE: Centro de Informatica - UFPE
SBC: Brazilian Computer Society
CNPq: Conselho Nacional de Desenvolvimento Cientifico e Tecn
CAPES: Brazilian Higher Education Funding Council

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 14 April 2013

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

Swedish Civil Contingencies Agency

Conference

EASE '13

Sponsor:

Centro de Informatica - UFPE
SBC
CNPq
CAPES

EASE '13: 17th International Conference on Evaluation and Assessment in Software Engineering

April 14 - 16, 2013

Porto de Galinhas, Brazil

Acceptance Rates

EASE '13 Paper Acceptance Rate 31 of 94 submissions, 33%;

Overall Acceptance Rate 71 of 232 submissions, 31%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

17
Total Citations
View Citations
806
Total Downloads

Downloads (Last 12 months)16
Downloads (Last 6 weeks)0

Reflects downloads up to 08 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

Budiraharjo RSarno RWijaya DPrasetyo HWaspada I(2023)IMARA: A New Approach to Multi-Attribute Risk Assessment based on Event Data Weighting (Case Study in a Container Terminal)IEEE Access10.1109/ACCESS.2023.3287781(1-1)Online publication date: 2023
https://doi.org/10.1109/ACCESS.2023.3287781
Lin YRuan MCai KLi DZeng ZLi FYang B(2022)Identifying and managing risks of AI-driven operations: A case study of automatic speech recognition for improving air traffic safetyChinese Journal of Aeronautics10.1016/j.cja.2022.08.020Online publication date: Aug-2022
https://doi.org/10.1016/j.cja.2022.08.020
Dreyling RJackson EPappel I(2021)Cyber Security Risk Analysis for a Virtual Assistant G2C Digital Service Using FAIR Model2021 Eighth International Conference on eDemocracy & eGovernment (ICEDEG)10.1109/ICEDEG52154.2021.9530938(33-40)Online publication date: 28-Jul-2021
https://doi.org/10.1109/ICEDEG52154.2021.9530938
Schmitz CPape S(2020)LiSRAComputers and Security10.1016/j.cose.2019.10165690:COnline publication date: 1-Mar-2020
https://dl.acm.org/doi/10.1016/j.cose.2019.101656
Agusman Aris AMaupa HMuis MIdrus Tabba M(2019)Effects of government policy, quality of human resources and professional institutions on workforce competitiveness using welding technology as mediating variableJournal of Science and Technology Policy Management10.1108/JSTPM-12-2017-006810:5(1121-1151)Online publication date: 20-Nov-2019
https://doi.org/10.1108/JSTPM-12-2017-0068
Tøndel IJaatun MCruzes DWilliams L(2019)Collaborative security risk estimation in agile software developmentInformation and Computer Security10.1108/ICS-12-2018-0138Online publication date: 17-Jun-2019
https://doi.org/10.1108/ICS-12-2018-0138
Sulaman SBeer AFelderer MHöst M(2019)Comparison of the FMEA and STPA safety analysis methods---a case studySoftware Quality Journal10.1007/s11219-017-9396-027:1(349-387)Online publication date: 15-May-2019
https://dl.acm.org/doi/10.1007/s11219-017-9396-0
Chamarthi RReddy A(2018)Empirical Methodology of Testing Using FMEA and Quality Metrics2018 International Conference on Inventive Research in Computing Applications (ICIRCA)10.1109/ICIRCA.2018.8597290(85-90)Online publication date: Jul-2018
https://doi.org/10.1109/ICIRCA.2018.8597290
Erdogan GLi YRunde RSeehusen FStØlen K(2018)Approaches for the combined use of risk analysis and testingInternational Journal on Software Tools for Technology Transfer (STTT)10.1007/s10009-014-0330-516:5(627-642)Online publication date: 28-Dec-2018
https://dl.acm.org/doi/10.1007/s10009-014-0330-5
Galin D(2018)SQA Plan and Project PlanSoftware Quality: Concepts and Practice10.1002/9781119134527.ch7(111-29)Online publication date: 6-Apr-2018
https://doi.org/10.1002/9781119134527.ch7
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten