Security Risk Evaluation for IT Systems Based on the Markov Chain
HE De-quan · Journal of the China Railway Society · 2007
Risk assessment is the key and core technologies ensuring IT system security.In this paper,the existing risk assessment methods and technologies including the conventional FTA、FMECA and HazOp and the modern technologies represented by CORAS are analyzed.A Markov-chain based security risk evaluation model is introduced to improve the model-based security risk evaluation method(CORAS).Firstly,a model based on the Markov-chain is constructed to describe IT system security behaviors.Secondly,a Markov transition matrix is founded to quantitatively assess security risk factors.Finally,the risk assessment methodology is applied in the case of the internet-banking system to compute the risk values for online transactions of the system.The model enriched the state-of-the-art risk analysis methodology CORAS.High-risk activities and sub-systems of the IT system can be identified by means of this methodology.The results provide basis for the IT system security throughout lifecycle.