Identifying and evaluating risks related to enterprise dependencies: A practical goal-driven risk analysis framework

International Journal of Risk Assessment and Management

Volumn 7, Issue 8, 2007, Pages 1120-1137

  Donzelli, Paolo ^a,c,d   Setola, Roberto ^b,e,f,g  

^a Office of the Prime Minister   (Italy)

^b UNIVERSITY CAMPUS BIO MEDICO   (Italy)

^c Italian Prime Minister's Office   (Italy)

^d UNIVERSITY OF MARYLAND   (United States)

^e University CAMPUS Bio Medico of Rome ^*  (Italy)

^f Italian Government Working Group on Critical Infrastructure Protection   (Italy)

^g G8 Senior Experts Group for Critical Information Infrastructure Protection   (Italy)

Author keywords

Critical infrastructures; Goal based risk analysis; Qualitative and quantitative risk assessment; Risk identification and mitigation

Indexed keywords

EID: 35948934273     PISSN: 14668297     EISSN: 17415241     Source Type: Journal    
DOI: 10.1504/IJRAM.2007.015297     Document Type: Article

References (24)

1. Bologna, S. and Setola, R. (2005) 'The need to improve local self-awareness in CIP/CIIP', Proc. of First IEEE International Workshop on Critical Infrastructure Protection (IWCIP 2005), Darmstadt, Germany.
2. Brown, T., Beyeler, W. and Barton, D. (2004) 'Assessing infrastructure inter-dependencies: the challenge of risk analysis for complex adaptive systems', Int. J. Critical Infrastructures, Vol. 1, No. 1, pp. 108-117.
3. Chung, L.K., Nixon, B.A., Yu, E. and Mylopoulos, J. (2000) Non-Functional Requirements in Software Engineering, Kluwer Publishing.
4. Donzelli, P. (2004) 'A goal-driven and agent-based requirements engineering framework', Requirements Engineering, Springer-Verlag, Vol. 9, No. 1.
5. Donzelli, P. and Bresciani, P. (2004) 'Domain visualization for dealing with complex IT systems', Proc. IEEE International Conference on Engineering Complex Computer Systems (ICECCS 2004), Florence, Italy.
6. Donzelli, P., Gandini, E., Setola, R., Rodriquez, F. and Tucci, S. (2002) 'The document management system of the Italian cabinet office', Proc. of the Italian Automatic Computation Association (AICA) 2002 Conference, Bari, Italy.
7. Fickas, S and Helm, B.R. (1992) 'Knowledge representation and reasoning in the design of composite systems', IEEE Transactions on Software Engineering, Vol. 18, No. 6.
8. Haimes, Y.Y. (2004) Risk Modelling, Assessment, and Management, 2nd edn, New York: John Wiley & Sons.
9. Hammer, R.W. (1972) Handbook of System and Product Safety, Englewood Cliffs, NJ: Prentice-Hall.
10. Hey, D. (1999) 'Comparing theories: what are we looking for?', Discussion Papers in Economics, Vol. 19, University of York.
11. Koubatis, A. and Schönberger, J. Y. 'Risk management of complex critical systems', Int. Journal of Critical Infrastructures, Vol. 1, Nos. 2/3, pp. 195-215.
12. Leopoulos, V., Kirytopoulos, K. and Malandrakis, C. (2003) 'An applicable methodology for strategic risk management during the bidding process', Int. Journal of Risk Assessment and Management, Vol. 4, No. 1, pp.67-80.
13. Mili, L., Krimgold, F., Alwang, J. and Bigger, J.E. (2004) 'Integrating engineering, economic, and social modelling in risks of cascading failures across interdependent complex network', Proc. 8th Conf on Probabilistic Methods Applied to Power Systems, Iowa, USA, pp.657-662.
14. Mylopolous, J. and Castro, J. (2000) 'Tropos: a framework for requirements-driven software development', Information System Engineering: State of the Art and Research Themes, in J. Brinkkemper and A. Solvberg (eds) Lecture Notes in Computer Science, Springer Verlag.
15. Newman, D.E., Bertrand, N., Carreras, B.A., Dobson, I.,. Lynch, V.E. and Gradney, P. (2005) 'Risk assessment in complex interacting infrastructure systems', Proc. 38th Hawaii Int. Conf. On System Science (HICSS'05).
16. Panzieri, S., Setola, R. and Ulivi, G. (2005) 'An approach to model complex interdependent infrastructures', Proc. 16th IFAC World-Congress, Prague, Czech Republic.
17. Porter, M. (1985) Competitive Advantage, New York: The Free Press.
18. Reason, J. (1990) Human Error, Cambridge: Cambridge University Press.
19. Rinaldi, S., Peerenboom, J. and Kelly, T. (2001) 'Identifying, understanding and analysing critical infrastructure inter-dependencies', IEEE Control Systems Magazine, pp.11-25.
20. Stamatis, D. (1995) Failure Mode and Effect Analysis, Milwaukee, USA: ASQC Quality Press.
21. Santos, J.R. and Haimes, Y.Y. (2004) 'Modelling the demand reduction input-output inoperability due to terrorism of interconnect infrastructures', Risk Analysis, Vol. 24, No. 6, pp.1437-1451.
22. US (2003a) The National Strategy for The Physical Protection of Critical Infrastructures and Key Assets, http://www.whitehouse.gov/pcipb/ physical.html.
23. US (2003b) The National Strategy to Secure Cyberspace, http://www.whitehouse.gov/pcipb.
24. Yu, (1993) 'Modelling organizations for information systems requirements engineering', Proc. of the 1st IEEE International Symposium on Requirements Engineering, January 1993, San Diego, California, USA.