Information Security Risk Management of Research Information Systems: A hybrid approach of Fuzzy FMEA, AHP, TOPSIS and Shannon Entropy
M. J. Ershadi, Mehrdad Forouzandeh
Journal of Digital Information Management, Vol. 17, No. 6, 2019.
DOI: https://doi.org/10.6025/jdim/2019/17/6/321-336
Link: http://dline.info/fpaper/jdim/v17i6/jdimv17i6_2.pdf
Abstract:
The purpose of this paper is to implement
information security risk management (ISRM) in research
information systems (RIS). Appropriate identification and
assessment of risks in different aspects such as software,
communications, and human resources for RIS's
besides providing efficient and effective preventive and
corrective actions are other aims of this study. Furthermore,
continual improvement of risk response processes
in information technology environment is another aim of
this study. In this study, potential risks of information
security are identified using failure mode and effects analysis
(FMEA). Also, detected failure modes are evaluated
by multi-criteria decision-making method (MCDM) using
a hybrid method of fuzzy logic, analytic hierarchy process
(AHP), Shannon entropy scoring method, and technique
for order preference by similarity to the ideal solution
(TOPSIS). The result of this paper shows that information
security software potential risks assessment by
the proposed model is more accurate and reliable than
non-fuzzy models. Unauthorized access to view or change
the stored information of the server is the risk with the
most important priority identified by MCDM approach.
Confidentiality of information is more important than other
information security criteria. Furthermore, failure modes
in the category of the main server and internet have more
priority in comparison to others.