More effective threat, risk and vulnerability analyses – What are the results?

Authors:

  • Jonas Hallberg
  • Johan Bengtsson
  • Teodor Sommestad

Publish date: 2013-12-31

Report number: FOI-R--3785--SE

Pages: 32

Written in: Swedish

Keywords:

  • threat analysis
  • risk analysis
  • vulnerability analysis
  • security analysis
  • information security
  • IT security
  • IT system

Abstract

During 2011 to 2013, the research and technology development project More effective threat, risk and vulnerability analyses has been carried out with the aim to develop methods and software tools to support more effective threat, risk and vulnerability analyses for the IT systems of the Swedish Armed Forces. The following results have emerged from the project. - There is a large set of needs related to support during the execution of the threat, risk and vulnerability analyses, for instance regarding instructions that clearly describe what the analysis results should contain and how these results should be produced. - There are no existing frameworks developed by other actors that can be directly utilized to improve the efficiency of the Armed Forces' analyses. If an existing framework is to be utilized, it needs to be customized. - Existing frameworks lack an explicit theoretical basis, which makes it difficult to decide which one best meets the needs of the Armed Forces. - The Armed Forces has an interest in a software tool that supports a structured execution of the threat, risk and vulnerability analyses. They are also interested in participating in the identification of needs and requirements related to this kind of software tool. - There are many opportunities to implement functions in a software tool supporting and streamlining the execution of the threat, risk and vulnerability analyses. ? There is a need to scientifically test and examine the assumptions and theories that form the basis for the threat, risk and vulnerability analyses.