Scoring matrix framework for threat factor profiling model

• Main Authors: Daud, Maslina, Ahmad, Sabariah, Abdullah, Syafiqa Anneisa, Zainuddin, Naqliyah, Sidi, Fatimah, A. Jabar, Marzanah, Affendey, Lilly Suriani, Mohd Sharef, Nurfadhlina, Ishak, Iskandar, Zolkepli, Maslina, Nordin, Fatin Nur Majdina, Md Noor, Nur Zahirah, Yusof, Norazlin, Amat Sejani, Hashimah, Hairani, Saiful Ramadzan, Sabron, Azizi
• Format: Article
• Language: English
• Published: Science Publishing Corporation 2018
• Online Access: http://psasir.upm.edu.my/id/eprint/73833/1/Scoring%20matrix%20framework%20for%20threat%20factor%20profiling%20model.pdf; http://psasir.upm.edu.my/id/eprint/73833/; https://www.sciencepubco.com/index.php/ijet/article/view/25471

One of the important requirements in preparing for an information security risk management system is to construct a threat profiling model that can be used to identify and classify threats. The threat profiling model provides an organization with a complete set of information including pattern of threat scenarios and analysis on the threat they encounter. However, an organization must set objectives and results of a threat profiling, as well as metrics in order to measure, appreciate and counter the potential threats. The main contribution of this paper is the framework of the threat scoring which extends our previous findings on combinations of components found in referred threat models. Furthermore, to the best of our knowledge, threat scoring framework has not been investigated by any previous approaches. In fact, the computed threat score enables the quantification of the degree of threat severity which is an important benchmark for an organization to plan their countermeasure actions. Therefore, a scoring matrix framework for Threat Factor Profiling (TFP) model that includes identification and classification of threat is proposed. The purpose of this framework is to identify threats based on activity within an information system of an organization. The Threat Profile Report presents the collected data of threat based on the predetermined matrix.