HI-Risk: a socio-technical method for the identification and monitoring of healthcare information security risks in the information society

van Deursen Hazelhoff Roelfze, Nicole

Abstract

This thesis describes the development of the HI-risk method to assess socio-technical information security risks. The method is based on the concept that related organisations experience similar risks and could benefit from sharing knowledge in order to take effective security measures. The aim of the method is to predict future risks by combining knowledge of past information security incidents with forecasts made by experts. HI-risks articulates the view that information security risk analysis should include human, environmental, and societal factors, and that collaboration amongst disciplines, organisations and experts is essential to improve security risk intelligence in today’s information society. The HI-risk method provides the opportunity for participating organisations to register their incidents centrally. From this register, an analysis of the incident scenarios leads to the visualisation of the most frequent scenario trees. These scenarios are presented to experts in the field. The experts express their opinions about the expected frequency of occurrence for the future. Their expectation is based on their experience, their knowledge of existing countermeasures, and their insight into new potential threats. The combination of incident and expert knowledge forms a risk map. The map is the main deliverable of the HI-risk method, and organisations could use it to monitor their information security risks. The HI-risk method was designed by following the rigorous process of design science research. The empirical methods used included qualitative and quantitative techniques, such as an analysis of historical security incident data from healthcare organisations, expert elicitation through a Delphi study, and a successful test of the risk forecast in a case organisation. The research focused on healthcare, but has potential to be further developed as a knowledge-based system or expert system, applicable to any industry. That system could be used as a tool for management to benchmark themselves against other organisations, to make security investment decisions, to learn from past incidents and to provide input for policy makers.

Citation

van Deursen Hazelhoff Roelfze, N. (2014). HI-Risk: a socio-technical method for the identification and monitoring of healthcare information security risks in the information society. (Thesis). Edinburgh Napier University. Retrieved from http://researchrepository.napier.ac.uk/id/eprint/6921

• Thesis Type: Thesis
• Deposit Date: Jul 29, 2014
• Publicly Available Date: Dec 31, 2014
• Peer Reviewed: Not Peer Reviewed
• Keywords: Information security; socio-technical risks; risk forecasting; Hi-risk method
• Public URL: http://researchrepository.napier.ac.uk/id/eprint/6921
• Award Date: 2014