Abstract:Today, information is rapidly increasing. For most of this information, data security and protection from unauthorized access are of great importance. Maybe information is created by an individual or a few people, but creating security for the information should be done by all assets of hardware, software and people. This entails organizing all elements of the system, and training and monitoring the performance of the people. One of the standards provided for the creation of security is ISMS. This standard is intended to provide a model for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a system in terms of security. ISMS receives several parameters from users, assesses the risks and offers some controls (guidelines) to improve them. Collecting primary parameters is also very important in ISMS. Usually these parameters are collected personally, which result in getting inaccurate outcomes. The most important parameters include confidentiality, integrity, availability, threat and vulnerability. This paper tries to provide a method based on checklists so that by assessing the users’ responses to these checklists, one can more accurately insert the vulnerability parameter value as a standard input of ISMS, in order to gain better outcomes, and more accurately perform choice of controls. In the assessment, the standard deviation method is calculated, and comparison between the common mode of ISMS and the proposed method shows that the latter works 30% better than the conventional method. People may refuse to respond sincerely due to different reasons, and the percentage of the results may differ, since the results are obtained as cross-sectional at a certain time.

A Real Time Information Security Risk Assessment Method

Real-Time Risk Management Based on Time Series Analysis

Study on information system risk assessment method

Assessment of Information Security Impacts on Mobile Social Media

A Business Process-based Method on Security Requirement Analysis of Information Systems

Using Hidden Markov Models to Evaluate the Real-Time Risks of Network

Transient Security Risk Assessment of Power System Based on Risk Theory and Fuzzy Reasoning

Business Process Status-Based Risk Analysis

Estimating Security Risk for Web Applications Using Security Vectors

The Research on Real-time Security Situation Assessment Technology Based on the Threat Propagation Model.

A checklist based evaluation framework to measure risk of information security management systems

RISK-BASED VULNERABILITY ASSESSMENT IN COMPLEX POWER SYSTEMS

A markov game theory-based risk assessment model for network information system

Computer Network System Security Assessment Method.

Risk assessment for industrial control systems based on asymmetric connection cloud and Choquet integral

An risk measurement model for assessing information systems

Analysis on the Risk Factors of Information Systems Development Projects Based on the Socio-technical Model

Integrated Safety and Security Risk Assessment Methods: A Survey of Key Characteristics and Applications

Intrusion Alerts Correlation Based Assessment of Network Security

Business Activities Status-Based Risk Assessment Research

A Hierarchical Framework of Security Situation Assessment for Information System