Towards Development of a Security Risk Assessment Model for Saudi Arabian Business Environment Based on the ISO/IEC 27005 ISRM Standard — Oak Academic Publishing
Research ArticleOpen AccessGoogle Scholar indexed
Towards Development of a Security Risk Assessment Model for Saudi Arabian Business Environment Based on the ISO/IEC 27005 ISRM Standard
College of Computer Science and Engineering, Taibah University, Medina, KSA
1 College of Computer Science and Engineering, Taibah University, Medina, KSA
S ecurity risk assessment refers to the process of identifying, analyzing, and evaluating potential security risks for an organization. An organization’s as s ets, personnel, and operations are protected through it as part of a comprehensive security program. Various security assessments models have been publis hed in the literature to protect the Saudi organization’s assets, personnel, an d operations. However, these models are redundant and were developed for specific purposes. Hence, the comprehensive security risk assessment model used to safeguard Saudi organizations’ assets, personnel, and operations is still omitted. Using a design science methodology, the objective of this study is to develop a comprehensive security risk assessment model called CSRAM to assess security risks in Saudi Arabian organizations based on the International Organization for Standardization and the International Electrotechnical Commission/Information security risk management (ISO/IEC 27005 ISRM) standard. CSRAM is made up of six stages: threat identification, vulnerability assessment, risk analysis, risk evaluation, risk treatment, and monitoring and review of the risk. The stages have many activities and tasks that need to be accomplished at each stage. Based on the results of the validation of the completeness of the CSRAM, we can say that the CSRAM covers the whole ISO/IEC 2700 5 ISRM standard, and it is complete .
Fenz, S., Heurix, J., Neubauer, T. and Pechstein, F. (2014) Current Challenges in Information Security Risk Management. Information Management & Computer Security, 22, 410-430. https://doi.org/10.1108/IMCS-07-2013-0053
Murr, P. and Carrera, N. (2022) Institutional Logics and Risk Management Practices in Government Entities: Evidence from Saudi Arabia. Journal of Accounting & Organizational Change, 18, 12-32. https://doi.org/10.1108/JAOC-11-2020-0195
Alshareef, N.M.N. (2022) Information Security Risk Management (ISRM) Model for Saudi Arabian Organisations. Master’s Thesis, Curtin University, Curtin.
Shanthamurthy, D. (2011) Leveraging ISO 27005 Standard’s Risk Assessment Capabilities. https://www.computerweekly.com/tip/Leveraging-ISO-27005-standards-risk-assessment-capabilities
Alturkistani, F.M. and Emam, A.Z. (2014) A Review of Security Risk Assessment Methods in Cloud Computing. In: Rocha, á., Correia, A., Tan, F. and Stroetmann, K., Eds., New Perspectives in Information Systems and Technologies, Springer, Cham, 443-453. https://doi.org/10.1007/978-3-319-05951-8_42
Al-Dhaqm, A., et al. (2017) CDBFIP: Common Database Forensic Investigation Processes for Internet of Things. IEEE Access, 5, 24401-24416. https://doi.org/10.1109/ACCESS.2017.2762693
Al-Dhaqm, A., et al. (2020) Categorization and Organization of Database Forensic Investigation Processes. IEEE Access, 8, 112846-112858. https://doi.org/10.1109/ACCESS.2020.3000747
Al-Dhaqm, A., Razak, S., Othman, S.H., Ngadi, A., Ahmed, M.N. and Ali Mohammed, A. (2017) Development and Validation of a Database Forensic Metamodel (DBFM). PLOS ONE, 12, e0170793. https://doi.org/10.1371/journal.pone.0170793
Ali, A., Abd Razak, S., Othman, S.H., Mohammed, A. and Saeed, F. (2017) A Metamodel for Mobile Forensics Investigation Domain. PLOS ONE, 12, e0176223. https://doi.org/10.1371/journal.pone.0176223
Al-Dhaqm, A., Razak, S., Siddique, K., Ikuesan, R.A. and Kebande, V.R. (2020) Towards the Development of an Integrated Incident Response Model for Database Forensic Investigation Field. IEEE Access, 8, 145018-145032. https://doi.org/10.1109/ACCESS.2020.3008696
Al-Dhaqm, A., et al. (2020) Database Forensic Investigation Process Models: A Review. IEEE Access, 8, 48477-48490. https://doi.org/10.1109/ACCESS.2020.2976885
Al-Dhaqm, A., Ikuesan, R.A., Kebande, V.R., Razak, S. and Ghabban, F.M. (2021) Research Challenges and Opportunities in Drone Forensics Models. Electronics, 10, Article 1519. https://doi.org/10.3390/electronics10131519
Kebande, V.R., Ikuesan, R.A., Karie, N.M., Alawadi, S., Choo, K.K.R. and Al-Dhaqm, A. (2020) Quantifying the Need for Supervised Machine Learning in Conducting Live Forensic Analysis of Emergent Configurations (ECO) in IoT Environments. Forensic Science International: Reports, 2, Article ID: 100122. https://doi.org/10.1016/j.fsir.2020.100122
Moore, D.A. (2013) Security Risk Assessment Methodology for the Petroleum and Petrochemical Industries. Journal of Loss Prevention in the Process, 26, 1685-1689. https://doi.org/10.1016/j.jlp.2013.10.012
Hassan, M., Saeedi, K., Almagwashi, H. and Alarifi, S. (2023) Information Security Risk Awareness Survey of Non-Governmental Organization in Saudi Arabia. In: Visvizi, A., Troisi, O. and Grimaldi, M., Eds., Research and Innovation Forum 2022. RIIFORUM 2022, Springer, Cham, 39-71. https://doi.org/10.1007/978-3-031-19560-0_4
Tuyikeze, T. and Flowerday, S. (2014) Information Security Policy Development and Implementation: A Content Analysis Approach. 8th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Plymouth, July 2014, 11-20.
Alshaikh, M., Maynard, S.B., Ahmad, A. and Chang, S. (2016) Information Security Policy: A Management Practice Perspective. arXiv: 1606.00890.
Ismail, W.B.W., Widyarto, S., Ahmad, R.A.T.R. and Abd Ghani, K. (2017) A Generic Framework for Information Security Policy Development. 2017 4th International Conference on Electrical Engineering, Computer Science and Informatics (EECSI), Yogyakarta, 19-21 September 2017, 1-6. https://doi.org/10.1109/EECSI.2017.8239132
Irfan, S. and Junseok, H. (2014) The Application of AHP to Evaluate Information Security Policy Decision Making. International Journal of Simulation: Systems, Science and Technology, 10, 46-50. https://doi.org/10.4135/9781473914643.n11
Talib, A.M., Alomary, F.O., Alwadi, H.F. and Albusayli, R.R. (2018) Ontology-Based Cyber Security Policy Implementation in Saudi Arabia. Journal of Information Security, 9, 315-333. https://doi.org/10.4236/jis.2018.94021
Aljuryyed, A. (2022) Cybersecurity Issues in the Middle East: Case Study of the Kingdom of Saudi Arabia. In: Dawson, M., Tabona, O. and Maupong, T., Eds., Cybersecurity Capabilities in Developing Nations and Its Impact on Global Security, IGI Global, Hershey, 62-82. https://doi.org/10.4018/978-1-7998-8693-8.ch004
AlGhamdi, S., Win, K.T. and Vlahu-Gjorgievska, E. (2022) Employees’ Intentions toward Complying with Information Security Controls in Saudi Arabia’s Public Organisations. Government Information Quarterly, 39, Article ID: 101721. https://doi.org/10.1016/j.giq.2022.101721
Shanmugam, B. and Azam, S. (2023) Risk Assessment of Heterogeneous IoMT Devices: A Review. Technologies, 11, Article 31. https://doi.org/10.3390/technologies11010031
Ma, Y., et al. (2022) Smart Grid Information Security Assessment Model Based on Correlation Index. Advances in Artificial Intelligence and Security: 8th International Conference on Artificial Intelligence and Security, ICAIS 2022, Qinghai, 15-20 July 2022, 672-681. https://doi.org/10.1007/978-3-031-06764-8_53
Al-Dhaqm, A.M.R., Othman, S.H., Abd Razak, S. and Ngadi, A. (2014) Towards Adapting Metamodelling Technique for Database Forensics Investigation Domain. 2014 International Symposium on Biometrics and Security Technologies (ISBAST), Kuala Lumpur, 26-27 August 2014, 322-327. https://doi.org/10.1109/ISBAST.2014.7013142
Al-Dhaqm, A., Razak, S., Ikuesan, R.A., Kebande, V.R. and Othman, S.H. (2021) Face Validation of Database Forensic Investigation Metamodel. Infrastructures, 6, Article 13. https://doi.org/10.3390/infrastructures6020013
Al-Dhaqm, A., et al. (2021) Digital Forensics Subdomains: The State of the Art and Future Directions. IEEE Access, 9, 152476-152502. https://doi.org/10.1109/ACCESS.2021.3124262
Aldhaqm, A., Abd Razak, S. and Othman, S.H. (2015) Common Investigation Process Model for Database Forensic Investigation Discipline. 1st ICRIL-International Conference on Innovation in Science and Technology (lICIST 2015), Kuala Lumpur, 20 April 2015, 297-300.
Alotaibi, F.M., Al-Dhaqm, A. and Al-Otaibi, Y.D. (2022) A Novel Forensic Readiness Framework Applicable to the Drone Forensics Field. Computational Intelligence and Neuroscience, 2022, Article ID: 8002963. https://doi.org/10.1155/2022/8002963
Ghabban, F.M., Alfadli, I.M., Ameerbakhsh, O., AbuAli, A.N., Al-Dhaqm, A. and Al-Khasawneh, M.A. (2021) Comparative Analysis of Network Forensic Tools and Network Forensics Processes. 2021 2nd International Conference on Smart Computing and Electronic Enterprise (ICSCEE), Cameron Highlands, 15-17 June 2021, 78-83. https://doi.org/10.1109/ICSCEE50312.2021.9498226
Ameerbakhsh, O., Ghabban, F.M., Alfadli, I.M., AbuAli, A.N., Al-Dhaqm, A. and Al-Khasawneh, M.A. (2021) Digital Forensics Domain and Metamodeling Development Approaches. 2021 2nd International Conference on Smart Computing and Electronic Enterprise (ICSCEE), Cameron Highlands, 15-17 June 2021, 67-71. https://doi.org/10.1109/ICSCEE50312.2021.9497935
Alhussan, A.A., Al-Dhaqm, A., Yafooz, W., Emara, A.H.M., Bin Abd Razak, S. and Khafaga, D.S. (2022) A Unified Forensic Model Applicable to the Database Forensics Field. Electronics, 11, Article 1347. https://doi.org/10.3390/electronics11091347
Alotaibi, F.M., Al-Dhaqm, A., Al-Otaibi, Y.D. and Alsewari, A.A. (2022) A Comprehensive Collection and Analysis Model for the Drone Forensics Field. Sensors, 22, Article 6486. https://doi.org/10.3390/s22176486
Yafooz, W.M.S., Al-Dhaqm, A. and Alsaeedi, A. (2023) Detecting Kids Cyberbullying Using Transfer Learning Approach: Transformer Fine-Tuning Models. In: Yafooz, W.M.S., Al-Aqrabi, H., Al-Dhaqm, A. and Emara, A., Eds., Kids Cybersecurity Using Computational Intelligence Techniques. Studies in Computational Intelligence, Springer, Cham. 255-267. https://doi.org/10.1007/978-3-031-21199-7_18
Alhussan, A.A., Al-Dhaqm, A., Yafooz, W.M.S., Razak, S.B.A., Emara, A.H.M. and Khafaga, D.S. (2022) Towards Development of a High Abstract Model for Drone Forensic Domain. Electronics, 11, Article 1168. https://doi.org/10.3390/electronics11081168
Alfadli, I.M., Ghabban, F.M., Ameerbakhsh, O., AbuAli, A.N., Al-Dhaqm, A. and Al-Khasawneh, M.A. (2021) CIPM: Common Identification Process Model for Database Forensics Field. 2021 2nd International Conference on Smart Computing and Electronic Enterprise (ICSCEE), Cameron Highlands, 15-17 June 2021, 72-77. https://doi.org/10.1109/ICSCEE50312.2021.9498014
Razak, S.A., Nazari, N.H.M. and Al-Dhaqm, A. (2020) Data Anonymization Using Pseudonym System to Preserve Data Privacy. IEEE Access, 8, 43256-43264. https://doi.org/10.1109/ACCESS.2020.2977117
Al-Dhaqm, A., Othman, S.H., Yafooz, W.M.S. and Ali, A. (2023) Review of Information Security Management Frameworks. In: Yafooz, W.M.S., Al-Aqrabi, H., Al-Dhaqm, A. and Emara, A., Eds., Kids Cybersecurity Using Computational Intelligence Techniques, Springer, Cham, 69-80. https://doi.org/10.1007/978-3-031-21199-7_5
Salem, M., Othman, S.H., Al-Dhaqm, A. and Ali, A. (2023) Development of Metamodel for Information Security Risk Management. In: Yafooz, W.M.S., Al-Aqrabi, H., Al-Dhaqm, A. and Emara, A., Eds., Kids Cybersecurity Using Computational Intelligence Techniques, Springer, Cham, 243-253. https://doi.org/10.1007/978-3-031-21199-7_17
Al-Dhaqm, A., Yafooz, W.M.S., Othman, S.H. and Ali, A. (2023) Database Forensics Field and Children Crimes. In: Yafooz, W.M.S., Al-Aqrabi, H., Al-Dhaqm, A. and Emara, A., Eds., Kids Cybersecurity Using Computational Intelligence Techniques, Springer, Cham, 81-92. https://doi.org/10.1007/978-3-031-21199-7_6
Saleh, M., et al. (2023) A Metamodeling Approach for IoT Forensic Investigation. Electronics, 12, Article 524. https://doi.org/10.3390/electronics12030524
Ali, A., Razak, S.A., Othman, S.H., Marie, R.R., Al-Dhaqm, A. and Nasser, M. (2022) Validating Mobile Forensic Metamodel Using Tracing Method. In: Saeed, F., Mohammed, F. and Ghaleb, F., Eds., Advances on Intelligent Informatics and Computing. IRICT 2021, Springer, Cham, 473-482. https://doi.org/10.1007/978-3-030-98741-1_39
Baras, D.S.A., Othman, S.H., Al-Dhaqm, A. and Radzi, R.Z.R.M. (2021) Information Security Management Metamodel (ISMM) Validation and Verification through Frequency-Based Selection Technique. 2021 International Conference on Data Science and Its Applications (ICoDSA), Bandung, 6-7 October 2021, 292-297. https://doi.org/10.1109/ICoDSA53588.2021.9617527
Al-Dhaqm, A.M.R. (2019) Simplified Database Forensic Invetigation Using Metamodeling Approach. Master’s Thesis, Universiti Teknologi Malaysia, Iskandar Puteri.
Al-Dhaqm, A., Razak, S. and Othman, S.H. (2019) Model Derivation System to Manage Database Forensic Investigation Domain Knowledge. 2018 IEEE Conference on Application, Information and Network Security (AINS), Langkawi, 21-22 November 2018, 75-80. https://doi.org/10.1109/AINS.2018.8631468
Aldhaqm, A., Abd Razak, S., Othman, S.H., Ali, A. and Ngadi, A. (2016) Conceptual Investigation Process Model for Managing Database Forensic Investigation Knowledge. Research Journal of Applied Sciences, Engineering and Technology, 4, 386-394. https://doi.org/10.19026/rjaset.12.2377
Ngadi, M., Al-Dhaqm, R. and Mohammed, A. (2012) Detection and Prevention of Malicious Activities on RDBMS Relational Database Management Systems. International Journal of Scientific & Engineering Research, 3, 1-10.
Ali, A., Abd Razak, S., Othman, S.H. and Mohammed, A. (2017) Extraction of Common Concepts for the Mobile Forensics Domain. In: Saeed, F., Gazem, N., Patnaik, S., Saed Balaid, A. and Mohammed, F., Eds., Recent Trends in Information and Communication Technology. IRICT 2017, Springer, Cham, 141-154. https://doi.org/10.1007/978-3-319-59427-9_16
Ali, A., Razak, S.A., Othman, S.H. and Mohammed, A. (2015) Towards Adapting Metamodeling Approach for the Mobile Forensics Investigation Domain. 1st ICRIL International Conference on Innovation in Science and Technology (lICIST 2015), Kuala Lumpur, 20 April 2015, 364-367.
Saleh, M.A., Othman, S.H., Al-Dhaqm, A. and Al-Khasawneh, M.A. (2021) Common Investigation Process Model for Internet of Things Forensics. 2021 2nd International Conference on Smart Computing and Electronic Enterprise (ICSCEE), Cameron Highlandsc, 15-17 June 2021, 84-89. https://doi.org/10.1109/ICSCEE50312.2021.9498045
Zawali, B., Ikuesan, R.A., Kebande, V.R. and Furnell, S. (2021) Realising a Push Button Modality for Video-Based Forensics. Infrastructures, 6, Article 54. https://doi.org/10.3390/infrastructures6040054
March, S.T. and Smith, G.F. (1995) Design and Natural Science Research on Information Technology. Decision Support Systems, 15, 251-266. https://doi.org/10.1016/0167-9236(94)00041-2
Alaqsam, A. and Ghabban, F.M. (2021) Online Programming Language Learning Using Massive Open Online Courses in Saudi Universities. International Journal of Emerging Trends in Engineering Research, 9, 116-131. https://doi.org/10.30534/ijeter/2021/16922021
Allam, A.A., et al. (2022) The Use of M-Government and M-Health Applications during the COVID-19 Pandemic in Saudi Arabia. Journal of Software Engineering and Applications, 15, 406-416. https://doi.org/10.4236/jsea.2022.1511023
Nilashi, M., Fallahpour, A., Wong, K.Y. and Ghabban, F. (2022) Customer Satisfaction Analysis and Preference Prediction in Historic Sites through Electronic Word of Mouth. Neural Computing and Applications, 34, 13867-13881. https://doi.org/10.1007/s00521-022-07186-5
Sommestad, T., Hallberg, J., Lundholm, K. and Bengtsson, J. (2014) Variables Influencing Information Security Policy Compliance: A Systematic Review of Quantitative Studies. Information Management & Computer Security, 22, 42-75. https://doi.org/10.1108/IMCS-08-2012-0045
Alsaif, M., Aljaafari, N. and Khan, A.R. (2015) Information Security Management in Saudi Arabian Organizations. Procedia Computer Science, 56, 213-216. https://doi.org/10.1016/j.procs.2015.07.201
Thakur, K., Ali, M.L., Gai, K. and Qiu, M. (2016) Information Security Policy for E-Commerce in Saudi Arabia. 2016 IEEE 2nd International Conference on Big Data Security on Cloud (BigDataSecurity), IEEE International Conference on High Performance and Smart Computing (HPSC), and IEEE International Conference on Intelligent Data and Security (IDS), New York, 9-10 April 2016, 187-190. https://doi.org/10.1109/BigDataSecurity-HPSC-IDS.2016.14
Safa, N.S., Von Solms, R. and Furnell, S. (2016) Information Security Policy Compliance Model in Organizations. Computers & Security, 56, 70-82. https://doi.org/10.1016/j.cose.2015.10.006
Alqahtani, F.H. (2017) Developing an Information Security Policy: A Case Study Approach. Procedia Computer Science, 124, 691-697. https://doi.org/10.1016/j.procs.2017.12.206
Almubayedh, D., Alazman, G., Alabdali, M., Al-Refai, R. and Nagy, N. (2018) Security Related Issues in Saudi Arabia Small Organizations: A Saudi Case Study. 2018 21st Saudi Computer Society National Computer Conference (NCC), Riyadh, 25-26 April 2018, 1-6. https://doi.org/10.1109/NCG.2018.8593058
Almeida, F., Carvalho, I. and Cruz, F. (2018) Structure and Challenges of a Security Policy on Small and Medium Enterprises. KSII Transactions on Internet and Information Systems, 12, 747-763. https://doi.org/10.3837/tiis.2018.02.012
Moody, G.D., Siponen, M. and Pahnila, S. (2018) Toward a Unified Model of Information Security Policy Compliance. MIS Quarterly, 42, 285-311. https://doi.org/10.25300/MISQ/2018/13853
Park, M. and Chai, S. (2018) Internalization of Information Security Policy and Information Security Practice: A Comparison with Compliance. Proceedings of the 51st Hawaii International Conference on System Sciences, Hawaii, 3-6 January 2018, 4723-4731. https://doi.org/10.24251/HICSS.2018.595
Amankwa, E., Loock, M. and Kritzinger, E. (2018) Establishing Information Security Policy Compliance Culture in Organizations. Information and Computer Security, 26, 420-436. https://doi.org/10.1108/ICS-09-2017-0063
Kaušpadienė, L., Ramanauskaitė, S. and Čenys, A. (2019) Information Security Management Framework Suitability Estimation for Small and Medium Enterprise. Technological and Economic Development of Economy, 25, 1-19. https://doi.org/10.20334/2019-027-M
Hengstler, S., Nickerson, R.C. and Trang, S. (2022) Towards a Taxonomy of Information Security Policy Non-Compliance Behavior. Proceedings of the 55th Hawaii International Conference on System Sciences, Hawaii, 4-7 January 2022, 4826-4835. https://doi.org/10.24251/HICSS.2022.588
Kabanda, S. and Mogoane, S.N. (2022) A Conceptual Framework for Exploring the Factors Influencing Information Security Policy Compliance in Emerging Economies. In: Sheikh, Y.H., Rai, I.A. and Bakar, A.D., Eds., E-Infrastructure and E-Services for Developing Countries. AFRICOMM 2021, Springer, Cham, 203-218. https://doi.org/10.1007/978-3-031-06374-9_13
Bhardwaj, A., Kaushik, K., Alshehri, M., Mohamed, A.A.B. and Keshta, I. (2023) ISF: Security Analysis and Assessment of Smart Home IoT-based Firmware. ACM Transactions on Sensor Networks. https://doi.org/10.1145/3578363
Mollaiee, A., Ameli, M.T., Azad, S., Nazari-Heris, M. and Asadi, S. (2023) Data-Driven Security Assessment Using High Content Database during the COVID-19 Pandemic. International Journal of Electrical Power & Energy Systems, 150, Article ID: 109077. https://doi.org/10.1016/j.ijepes.2023.109077