An information security risk-driven investment model for analysing human factors

Modern organisational structure and risk management model are characterised by a wide
range of forces including the role of human factors which combine to create an
unprecedented level of uncertainty and exposure to information security risk, investment and
decision making process. Developing a risk-driven investment model for information security
systems with consideration of subjective nature of critical human factors, is a challenging
task. The overall success of an information security system depends on analysis of the risks
and threats so that appropriate protection mechanism can be in place to protect them.
However, lack of appropriate analysis of such dependencies and understanding potentially
results in information security systems to fail or to fully achieve their that depend on them.
Existing literature does not provide adequate guidelines for a systematic process or an
appropriate modelling language to support such analysis. This paper fills this gap by
introducing a process that allows information security managers to capture possible riskinvestment
relationships and to reason about them. The process is supported by a modelling
language based on a set of concepts relating to trust and control and secure tropos and
requirements engineering. In order to demonstrate the applicability and usefulness of the
approach a descriptive example from an UK organisation is used.
Keywords: Information Security (IS), Information Security Risk-Driven Investment Model (RIDIM),
Risk, Social Engineering Attacks (SEAs), Security Investment (SI), Return On Investment in
Information Security (ROISI).