TIM-7040

Crandall, K. S. (2020). Risk assessments: A weighted score approach to improving risk management decisions. 2020 Intermountain Engineering, Technology and Computing (IETC), Intermountain Engineering, Technology and Computing (IETC), 2020, 1–5.
Increased security breaches have made it more important than ever for businesses to detect, minimize, and remove potential risks. This paper will suggest a new approach for improving risk management models that are currently in use.

Hong, T., & Kolios, A. (2020). A framework for risk management of large-scale organization supply chains. 2020 International Conference on Decision Aid Sciences and Application (DASA), Decision Aid Sciences and Application (DASA), 948–953.
This paper proposes a novel approach to supply chain risk management (SCRM), based on the creation of a risk assessment system that addresses the value of SCRM and supply chain visibility (SCV). The paper also addresses the particular risks within the manufacturing sector using quantitative analysis and empirical evidence.

Humayun, M., Niazi, M., Jhanjhi, N., Alshayeb, M., & Mahmood, S. (2020). Cyber security threats and vulnerabilities: A systematic mapping study. Arabian Journal for Science & Engineering (Springer Science & Business Media BV), 45(4), 3171–3189.
This paper focuses on identifying key cybersecurity vulnerabilities, targeted/victimized applications, mitigation strategies, and infrastructures so that researchers and practitioners can gain a deeper understanding of the issue.

Ganin, A. A., Quach, P., Panwar, M., Collier, Z. A., Keisler, J. M., Marchese, D., & Linkov, I. (2020). Multicriteria decision framework for cybersecurity risk assessment and management. Risk Analysis: An International Journal, 40(1), 183–199.
In this article, the proposed framework bridges the gap between risk evaluation and risk management, allowing analysts to choose risk management alternatives in a standardized and transparent manner. This approach is demonstrated in a conceptual, yet practical case study that demonstrates assessing and rating five cybersecurity enhancement strategies.

MITRE Corporation. (n.d.). Getting started. MITRE ATT&CK®.
MITRE ATT&CK® is a globally-accessible knowledge base of mitigation tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.

Harris, R. (2021). You want me to write a policy/procedure!!! Supervision, 82(4), 8–10.

Wiedemann, P., Boerner, F. U., & Freudenstein, F. (2021). Effects of communicating uncertainty descriptions in hazard identification, risk characterization, and risk protection. PLoS ONE, 16(7), 1–18.
This journal article emphasizes the importance of communication in risk assessment. Performative goals for uncertainty communication and explaining uncertainty about the adequacy of risk protection are explored.

Alberts, C., Behrens, S., Pethia, R., & Wilson, W. (1999). Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Framework, Version 1.0 (CMU/SEI-99-TR-017). http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=13473
The Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) is a framework for identifying and managing information security risks. It defines a comprehensive evaluation method that allows an organization to identify the information assets that are important to the mission of the organization, the threats to those assets, and the vulnerabilities that may expose those assets to the threats.