Dinh Uy Tran

• Tran, Dinh Uy; Selnes, Sigrid Haug; Hagen, Janne Merete & Jøsang, Audun (2024). An Opportunity-Based Approach to Information Security Risk. I Katsikas, Sokratis; Abie, Habtamu; Ranise, Silvio; Verderame, Luca; Cambiaso, Enrico; Ugarelli, Rita; Praça, Isabel; Li, Wenjuan; Meng, Weizhi; Furnell, Steven; Katt, Basel; Pirbhulal, Sandeep; Shukla, Ankur; Ianni, Michele; Preda, Mila Dalla; Choo, Kim-Kwang Raymond; Correia, Miguel Pupo; Abhishta, Abhishta; Sileno, Giovanni; Alishahi, Mina; Kalutarage, Harsha & Yanai, Naoto (Red.), Computer Security. ESORICS 2023 International Workshops CPS4CIP, ADIoT, SecAssure, WASP, TAURIN, PriST-AI, and SECAI, The Hague, The Netherlands, September 25–29, 2023, Revised Selected Papers, Part II. Springer Cham. ISSN 9783031541285. s. 7–25. doi: 10.1007/978-3-031-54129-2_1. Fulltekst i vitenarkiv Vis sammendrag

  The traditional approach to Information Security Risk Management (ISRM) is to assume that risk can only affect businesses negatively. However, it is interesting to notice that the latest edition of the standard ISO/IEC 27005:2022 Guidance on managing information security risks provides a definition of risk that covers both positive and negative consequences. Hence, present and future business leaders can expect information security professionals in their organisations to report on positive aspects of information security risk in addition to negative risk, which is a rather new and radical idea. Since information security risk assessment has traditionally focused on threats, no guidelines currently exist for how to identify, describe or assess positive risk in the context of ISRM. The aim of this study is to describe an opportunity-based approach to information security risk. In addition, this paper discusses some limitations of how ISO/IEC 27005:2022 defines risk, and hence this paper also proposes a definition of positive risk in the context of ISRM. Finally, some strategies to describe and assess positive risk are described.

• Tran, Dinh Uy & Jøsang, Audun (2023). Business Language for Information Security. I Furnell, Steven & Clarke, Nathan (Red.), Human Aspects of Information Security and Assurance: 17th IFIP WG 11.12 International Symposium, HAISA 2023, Kent, UK, July 4–6, 2023, Proceedings. Springer. ISSN 9783031385308. s. 169–180. doi: 10.1007/978-3-031-38530-8_14. Fulltekst i vitenarkiv
• Tran, Dinh Uy & Jøsang, Audun (2022). Information Security Posture to Organize and Communicate the Information Security Governance Program. I Matos, Florinda & Rosa, Alvaro (Red.), Proceedings of the 18th European Conference on Management Leadership and Governance. Academic Conferences & Publishing International (ACPI). ISSN 9781914587580. s. 515–522. doi: 10.34190/ecmlg.18.1.729. Fulltekst i vitenarkiv Vis sammendrag

  Information security practice has evolved greatly from being mostly a technical concern to also becoming a concern of executive management. As a result, there are many different frameworks, guidelines and certification programs for information security governance (ISG) and management. The purpose of these standards and certification programs is to help an organization develop a structured approach for governing and managing information security. However, these standards and guidelines are generic and not tailored for any specific organization. These frameworks usually specify “what” should be implemented but not “how”. Additionally, these frameworks do not specify “how” to communicate the information security posture (ISP) to the executive management in a simplistic manner. This paper first defines and conceptualizes the term information security posture, and then proposes a framework on “how” to communicate and organize the ISP. Our contribution complements ISG programs adopted by organizations to give executive management a better understanding and oversight. We argue that describing the ISP of an organization will support well-informed decision-making while ensuring alignment with business objectives.

Se alle arbeider i NVA

• Tran, Dinh Uy (2023). Informasjonssikkerhetsledelse - En holistisk tilnærming. Cappelen Damm Akademisk. ISBN 9788202754648. 236 s. Fulltekst i vitenarkiv

Se alle arbeider i NVA

• Tran, Dinh Uy (2023). Holistic Understanding of Information Security Posture. Universitetet i Oslo. Fulltekst i vitenarkiv Vis sammendrag

  The main findings indicate that the existing literature on Information Security Governance (ISG) primarily focuses on "what" to implement, rather than providing guidance on "how" to do it. Another finding is the lack of emphasis on methods to gain oversight of the information security posture (ISP). This study highlights the inconsistent interpretation of ISP within the literature. It typically adopts an information security perspective rather than considering a holistic approach. To address this gap, this study proposes a new definition and conceptualisation of ISP that covers holistically and provides ideas on how to organise an ISG program. Additionally, the study introduces strategies for assessing and managing positive risks, which deviate from the conventional emphasis on threats or "what can go wrong," thereby supporting a holistic approach to information security. Furthermore, this study analyses existing research on the communication and reporting of information security activities. The main findings emphasise the significance of effective communication with the business, utilising a business language. However, there is limited discussion on how to learn this language. To bridge this gap, this study presents a theoretical framework for learning Business Language for Information Security (BLIS) and published a textbook as a resource for learning these domains.

Se alle arbeider i NVA