{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T05:29:35Z","timestamp":1772342975796,"version":"3.50.1"},"reference-count":46,"publisher":"Springer Science and Business Media LLC","issue":"6","license":[{"start":{"date-parts":[[2023,7,14]],"date-time":"2023-07-14T00:00:00Z","timestamp":1689292800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2023,7,14]],"date-time":"2023-07-14T00:00:00Z","timestamp":1689292800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100004270","name":"Royal Institute of Technology","doi-asserted-by":"crossref","id":[{"id":"10.13039\/501100004270","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Inf. Secur."],"published-print":{"date-parts":[[2023,12]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>IT systems pervade our society more and more, and we become heavily dependent on them. At the same time, these systems are increasingly targeted in cyberattacks, making us vulnerable. Enterprise and cybersecurity responsibles face the problem of defining techniques that raise the level of security. They need to decide which mechanism provides the most efficient defense with limited resources. Basically, the risks need to be assessed to determine the best cost-to-benefit ratio. One way to achieve this is through threat modeling; however, threat modeling is not commonly used in the enterprise IT risk domain. Furthermore, the existing threat modeling methods have shortcomings. This paper introduces a metamodel-based approach named Yet Another Cybersecurity Risk Assessment Framework (Yacraf). Yacraf aims to enable comprehensive risk assessment for organizations with more decision support. The paper includes a risk calculation formalization and also an example showing how an organization can use and benefit from Yacraf.<\/jats:p>","DOI":"10.1007\/s10207-023-00713-y","type":"journal-article","created":{"date-parts":[[2023,7,14]],"date-time":"2023-07-14T03:25:52Z","timestamp":1689305152000},"page":"1713-1729","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":17,"title":["Yet another cybersecurity risk assessment framework"],"prefix":"10.1007","volume":"22","author":[{"given":"Mathias","family":"Ekstedt","sequence":"first","affiliation":[]},{"given":"Zeeshan","family":"Afzal","sequence":"additional","affiliation":[]},{"given":"Preetam","family":"Mukherjee","sequence":"additional","affiliation":[]},{"given":"Simon","family":"Hacks","sequence":"additional","affiliation":[]},{"given":"Robert","family":"Lagerstr\u00f6m","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2023,7,14]]},"reference":[{"issue":"1","key":"713_CR1","doi-asserted-by":"publisher","first-page":"47","DOI":"10.4304\/jsw.2.1.47-59","volume":"2","author":"M Alam","year":"2007","unstructured":"Alam, M., Breu, R., Hafner, M.: Model-driven security engineering for trust management in secret. J. Softw. 2(1), 47\u201359 (2007)","journal-title":"J. Softw."},{"key":"713_CR2","doi-asserted-by":"crossref","unstructured":"Almorsy, M., Grundy, J.: Secdsvl: A domain-specific visual language to support enterprise security modelling. In: 23rd Australian Software Engineering Conference (ASWEC), pp. 152\u2013161 (2014)","DOI":"10.1109\/ASWEC.2014.18"},{"issue":"1","key":"713_CR3","doi-asserted-by":"publisher","first-page":"39","DOI":"10.1145\/1125808.1125810","volume":"15","author":"D Basin","year":"2006","unstructured":"Basin, D., Doser, J., Lodderstedt, T.: Model driven security: from uml models to access control infrastructures. ACM Trans. Softw. Eng. Methodol. (TOSEM) 15(1), 39\u201391 (2006)","journal-title":"ACM Trans. Softw. Eng. Methodol. (TOSEM)"},{"key":"713_CR4","doi-asserted-by":"crossref","unstructured":"Basin, D., Clavel, M., Egea, M.: A decade of model-driven security. In: Proceedings of the 16th ACM Symposium on Access Control Models and Technologies, pp. 1\u201310 (2011)","DOI":"10.1145\/1998441.1998443"},{"key":"713_CR5","doi-asserted-by":"crossref","unstructured":"Beckers, K., Heisel, M., Solhaug, B., St\u00f8len, K.: ISMS-CORAS: A structured method for establishing an ISO 27001 compliant information security management system. In: Heisel, M., Joosen, W., L\u00f3pez, J., Martinelli, F. (eds) Engineering Secure Future Internet Services and Systems-Current Research. Lecture Notes in Computer Science, vol. 8431, pp. 315\u2013344. Springer (2014)","DOI":"10.1007\/978-3-319-07452-8_13"},{"key":"713_CR6","doi-asserted-by":"crossref","unstructured":"Caralli, R.A., Stevens, J.F., Young, L.R., Wilson, W.R.: Introducing octave allegro: improving the information security risk assessment process. Carnegie-Mellon Univ Pittsburgh PA Software Engineering Inst, Technical report (2007)","DOI":"10.21236\/ADA470450"},{"key":"713_CR7","unstructured":"Committee of Sponsoring Organizations of the Treadway Commission, et\u00a0al (2004) Enterprise risk management-integrated framework: executive summary and framework. American Institute of Certified Public Accountants (AICPA)"},{"issue":"1","key":"713_CR8","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1007\/s00766-010-0115-7","volume":"16","author":"M Deng","year":"2011","unstructured":"Deng, M., Wuyts, K., Scandariato, R., Preneel, B., Joosen, W.: A privacy threat analysis framework: supporting the elicitation and fulfillment of privacy requirements. Requir. Eng. 16(1), 3\u201332 (2011)","journal-title":"Requir. Eng."},{"key":"713_CR9","unstructured":"ENISA: Compendium of risk management frameworks with potential interoperability. Technical report, European Union Agency for Cybersecurity (2022)"},{"key":"713_CR10","doi-asserted-by":"publisher","DOI":"10.1016\/C2013-0-09966-5","volume-title":"Measuring and Managing Information Risk","author":"J Freund","year":"2015","unstructured":"Freund, J., Jones, J.: Measuring and Managing Information Risk. Butterworth-Heinemann, Waltham (2015). https:\/\/doi.org\/10.1016\/C2013-0-09966-5"},{"key":"713_CR11","unstructured":"Friman, N.: Security analysis of smart buildings. Bachelor thesis, School of Electrical Engineering and Computer Science (EECS), KTH Royal Institute of Technology (2020)"},{"issue":"5","key":"713_CR12","doi-asserted-by":"publisher","first-page":"491","DOI":"10.1108\/10662240610710978","volume":"16","author":"M Hafner","year":"2006","unstructured":"Hafner, M., Breu, R., Agreiter, B., Nowak, A.: Sectet: an extensible framework for the realization of secure inter-organizational workflows. Internet Res. 16(5), 491\u2013506 (2006)","journal-title":"Internet Res."},{"key":"713_CR13","unstructured":"ISO: ISO 31000:2018 Risk management-Guidelines. Standard, International Organization for Standardization (2018)"},{"key":"713_CR14","unstructured":"ISO, IEC,: ISO\/IEC 27001:2005 Information technology-Security techniques-Information security management systems-Requirements. Standard, International Organization for Standardization\/International Electrotechnical Commission (2005)"},{"key":"713_CR15","unstructured":"ISO, IEC,: ISO\/IEC 27000:2018 Information technology-Security techniques-Information security management systems-Overview and vocabulary. Standard, International Organization for Standardization\/International Electrotechnical Commission (2018)"},{"key":"713_CR16","unstructured":"ISO, IEC,: ISO\/IEC 27005:2018 Information technology-Security techniques-Information security risk management. Standard, International Organization for Standardization\/International Electrotechnical Commission (2018)"},{"key":"713_CR17","doi-asserted-by":"crossref","unstructured":"Johnson, P., Lagerstr\u00f6m, R., Ekstedt, M.: A meta language for threat modeling and attack simulations. In: Proceedings of the 13th International Conference on Availability, Reliability and Security, pp 1\u20138 (2018)","DOI":"10.1145\/3230833.3232799"},{"key":"713_CR18","doi-asserted-by":"crossref","unstructured":"J\u00fcrjens, J.: UMLsec: Extending UML for secure systems development. In: J\u00e9z\u00e9quel J, Hu\u00dfmann H, Cook S (eds) UML 2002\u2014The Unified Modeling Language, 5th International Conference, Dresden, Germany, 2002, Proceedings, Springer, Lecture Notes in Computer Science, vol. 2460, pp. 412\u2013425 (2002)","DOI":"10.1007\/3-540-45800-X_32"},{"key":"713_CR19","volume-title":"Secure Systems Development with UML","author":"J J\u00fcrjens","year":"2005","unstructured":"J\u00fcrjens, J.: Secure Systems Development with UML. Springer, Berlin, Heidelberg (2005)"},{"key":"713_CR20","doi-asserted-by":"crossref","unstructured":"Kordy, B., Mauw, S., Radomirovi\u0107, S., Schweitzer, P.: Foundations of attack\u2013defense trees. In: International Workshop on Formal Aspects in Security and Trust, pp. 80\u201395 (2010)","DOI":"10.1007\/978-3-642-19751-2_6"},{"key":"713_CR21","volume-title":"Model-Driven Risk Analysis: The CORAS Approach","author":"MS Lund","year":"2010","unstructured":"Lund, M.S., Solhaug, B., St\u00f8len, K.: Model-Driven Risk Analysis: The CORAS Approach. Springer, Berlin, Heidelberg (2010)"},{"key":"713_CR22","unstructured":"Mathey, F., Bonhomme, C., Rocha, J., Lombardi, J., Joly, B.: Risk assessment optimisation with MONARC. https:\/\/www.monarc.lu\/assets\/files\/publications\/2018-HACK.LU-CASES.pdf (2018)"},{"key":"713_CR23","doi-asserted-by":"crossref","unstructured":"Mauw, S., Oostdijk, M.: Foundations of attack trees. In: International Conference on Information Security and Cryptology, pp. 186\u2013198 (2005)","DOI":"10.1007\/11734727_17"},{"key":"713_CR24","doi-asserted-by":"crossref","unstructured":"McDermott, J.P., Fox, C.: Using abuse case models for security requirements analysis. In: 15th Annual Computer Security Applications Conference (ACSAC 1999), 6\u201310 December 1999, pp. 55\u201364. AZ, USA, IEEE Computer Society, Scottsdale (1999)","DOI":"10.1109\/CSAC.1999.816013"},{"key":"713_CR25","volume-title":"Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis","author":"MM Morana","year":"2015","unstructured":"Morana, M.M., Uceda V\u00e9lez, T.: Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis. Wiley, Hoboken, New Jersey (2015)"},{"key":"713_CR26","unstructured":"Mouratidis, H., Giorgini, P., Manson, G., Philp, I., et\u00a0al.: A natural extension of tropos methodology for modelling security. In: Proceedings Agent Oriented Methodologies Workshop, Annual ACM Conference on Object Oriented Programming, Systems, Languages (OOPSLA), Seattle (2002)"},{"key":"713_CR27","doi-asserted-by":"publisher","unstructured":"Noel, S., Elder, M., Jajodia, S., Kalapa, P., O\u2019Hare, S., Prole, K.: Advances in topological vulnerability analysis. In: Cybersecurity Applications Technology Conference For Homeland Security, pp. 124\u2013129, (2009) https:\/\/doi.org\/10.1109\/CATCH.2009.19","DOI":"10.1109\/CATCH.2009.19"},{"key":"713_CR28","doi-asserted-by":"publisher","first-page":"123","DOI":"10.1016\/j.datak.2015.07.007","volume":"98","author":"E Paja","year":"2015","unstructured":"Paja, E., Dalpiaz, F., Giorgini, P.: Modelling and reasoning about security requirements in socio-technical systems. Data Knowl. Eng. 98, 123\u2013143 (2015)","journal-title":"Data Knowl. Eng."},{"key":"713_CR29","doi-asserted-by":"publisher","DOI":"10.1201\/EBK1439839560","volume-title":"Information Security Risk Analysis","author":"T Peltier","year":"2010","unstructured":"Peltier, T.: Information Security Risk Analysis. Auerbach Publications, Boca Raton (2010)"},{"key":"713_CR30","doi-asserted-by":"crossref","unstructured":"Potteiger, B., Martins, G., Koutsoukos, XD.: Software and attack centric integrated threat modeling for quantitative risk assessment. In: Scherlis WL, Brumley D (eds) Proceedings of the Symposium and Bootcamp on the Science of Security, Pittsburgh, April 19\u201321, 2016, pp 99\u2013108. ACM (2016)","DOI":"10.1145\/2898375.2898390"},{"key":"713_CR31","unstructured":"Ross, R.: Guide for conducting risk assessments. NIST Special Publication 800-30 Revision 1, National Institute of Standard and Technology (2012)"},{"key":"713_CR32","unstructured":"Saitta, P., Larcom, B., Eddington M.:Trike v1 methodology document (2005)"},{"issue":"12","key":"713_CR33","first-page":"21","volume":"24","author":"B Schneier","year":"1999","unstructured":"Schneier, B.: Attack trees. Dr Dobb\u2019s J 24(12), 21\u201329 (1999)","journal-title":"Dr Dobb\u2019s J"},{"key":"713_CR34","first-page":"318","volume-title":"Lies Digital Security in a Networked World","author":"B Schneier","year":"2000","unstructured":"Schneier, B.: Lies Digital Security in a Networked World, vol. 21, pp. 318\u2013333. Wiley, New York (2000)"},{"key":"713_CR35","unstructured":"Shevchenko, N., Chick, T.A., O\u2019Riordan, P., Scanlon, T.P., Woody, C.: Threat modeling: a summary of available methods. Carnegie Mellon University Software Engineering Institute, Technical report (2018)"},{"key":"713_CR36","unstructured":"Shevchenko, N., Frye, B.R., Woody, C.: Threat modeling for cyber-physical system-of-systems: methods evaluation. Carnegie Mellon University Software Engineering Institute, Technical report (2018)"},{"key":"713_CR37","unstructured":"Shostack, A.: Experiences threat modeling at microsoft. Technical report, Microsoft (2008)"},{"key":"713_CR38","volume-title":"Threat Modeling: Designing for Security","author":"A Shostack","year":"2014","unstructured":"Shostack, A.: Threat Modeling: Designing for Security. Wiley, Indianapolis (2014)"},{"key":"713_CR39","doi-asserted-by":"crossref","unstructured":"Tuma, K., Calikli, G., Scandariato, R.: Threat analysis of software systems: a systematic literature review. J. Syst. Softw. 144, 275\u2013294 (2018)","DOI":"10.1016\/j.jss.2018.06.073"},{"key":"713_CR40","unstructured":"UK Government Central Computer and Telecommunications Agency (CCTA): CCTA risk analysis and management method (CRAMM). Technical report, CCTA (2003)"},{"key":"713_CR41","doi-asserted-by":"crossref","unstructured":"Wang, J., Neil, M., Fenton, NE.: A Bayesian network approach for cybersecurity risk assessment implementing and extending the FAIR model. Comput Secur 89 (2020)","DOI":"10.1016\/j.cose.2019.101659"},{"key":"713_CR42","doi-asserted-by":"crossref","unstructured":"Wangen, G., Hallstensen, C., Snekkenes, E.: A framework for estimating information security risk assessment method completeness. Int. J. Inf. Secur. 17(6), 681\u2013699 (2018)","DOI":"10.1007\/s10207-017-0382-0"},{"key":"713_CR43","unstructured":"Weigelt, C.: af\u00a0Rantzien DFH A process for threat modeling of large-scale computer systems: A case study. Bachelor thesis, School of Electrical Engineering and Computer Science (EECS), KTH Royal Institute of Technology (2020)"},{"key":"713_CR44","unstructured":"Wessman, L., Wessman, N.: Threat modeling of large-scale computer systems: implementing and evaluating threat modeling at company x. Bachelor thesis, School of Electrical Engineering and Computer Science (EECS), KTH Royal Institute of Technology (2020)"},{"key":"713_CR45","doi-asserted-by":"publisher","first-page":"53","DOI":"10.1016\/j.cose.2019.03.010","volume":"84","author":"W Xiong","year":"2019","unstructured":"Xiong, W., Lagerstr\u00f6m, R.: Threat modeling\u2014a systematic literature review. Comput. Secur. 84, 53\u201369 (2019)","journal-title":"Comput. Secur."},{"key":"713_CR46","first-page":"55","volume":"26","author":"W Xiong","year":"2021","unstructured":"Xiong, W., Hacks, S., Lagerstr\u00f6m, R.: A method for assigning probability distributions in attack simulation languages. Complex Syst. Inf. Model Q 26, 55\u201377 (2021)","journal-title":"Complex Syst. Inf. Model Q"}],"container-title":["International Journal of Information Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-023-00713-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10207-023-00713-y\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-023-00713-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,10,24]],"date-time":"2024-10-24T03:42:09Z","timestamp":1729741329000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10207-023-00713-y"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,7,14]]},"references-count":46,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2023,12]]}},"alternative-id":["713"],"URL":"https:\/\/doi.org\/10.1007\/s10207-023-00713-y","relation":{},"ISSN":["1615-5262","1615-5270"],"issn-type":[{"value":"1615-5262","type":"print"},{"value":"1615-5270","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,7,14]]},"assertion":[{"value":"14 July 2023","order":1,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors have no competing interests to declare that are relevant to the content of this article.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"This article does not contain any studies with human participants or animals performed by any of the authors.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical Standards"}}]}}