Abstract:As organizations grapple with an ever-evolving threat landscape, the need for effective security risk quantification methodologies becomes paramount. This research paper introduces and explores a novel approach to security risk quantification through the application of a hexagram model. Drawing inspiration from the I Ching, an ancient Chinese divination text, this hexagram model encompasses six key elements: Threat Landscape, Vulnerability Analysis, Asset Criticality, Control Effectiveness, Incident Response Capability, and Business Impact. By dividing these elements into two trigrams, a comprehensive view of external and internal factors influencing security risk emerges. The literature review examines existing security risk quantification methods, highlighting their strengths and limitations. The hexagram model's uniqueness lies in its holistic representation, integrating technical and organizational facets. The paper details the methodology, providing a clear framework for application. A practical case study demonstrates the model's implementation, showcasing its efficacy in real-world security assessments. Results and analysis reveal valuable insights into the security risk landscape, with comparisons to traditional quantification methods illustrating the hexagram model's added depth. The discussion interprets findings in the context of the security domain, addressing implications and areas for improvement. The paper concludes by summarizing key contributions, emphasizing the significance of the hexagram model in providing a nuanced understanding of security risk. Recommendations for future research underscore the potential for further refinement and broader adoption of this innovative approach.

Poster: Using Quantified Risk And Benefit To Strengthen The Security Of Information Sharing

The research for spatial role-based access control model

Dynamic Combination of Authentication Factors Based on Quantified Risk and Benefit

Semantic-Aware Access Control for Grid Application

Specify and Enforce the Policies of Quantified Risk Adaptive Access Control

A Quantitative Security Architecture Design Method for Power Information System

A Quantitative Risk Assessment Approach for Host System Security

QBER: Quantifying Cyber Risks for Strategic Decisions

Security screening metrics for information‐sharing partnerships

Power Information Systems Security: Modeling and Quantitative Evaluation

QR-SACP: Quantitative Risk-based Situational Awareness Calculation and Projection through Threat Information Sharing

Fuzzy Multi-Level Security: An Experiment on Quantified Risk-Adaptive Access Control

A System for Risk Assessment of Privacy Disclosure

Quantitatively Measure Access Control Mechanisms across Different Operating Systems

Using Private and Public Assessments in Security Information Sharing Agreements

Securely Sharing Data in Encrypted Databases

An approach based on hexagram model for quantifying security risks with Performance Key Indicators (PKI)

Quantitative Evaluation Technology of Computer System Security Based on Probability and Statistics

QUANTITATIVE RISK ASSESSMENT BASED ON ENTROPY WEIGHT AND TRIANGULAR FUZZY NUMBER

A Fuzzy Set-Based Approach for Model-Based Internet-banking System Security Risk Assessment

A Guanxi Shibboleth Based Security Infrastructure