A socio-technical security risk mitigation methodology for information systems access

Abstract

This research developed a methodology for the assessment of socio-technical information systems access security risks, which could cause insider threat events in organisations. The methodology consists of a meta-network model of information systems access, thirteen metrics to assess different types of access security risks and a risk assessment method for information security professionals. Research also presents network and other visualisations that can be used to communicate the risks effectively to the decision makers.