Algorithms for Automating the Information Security Risk Management Process

Abstract

The digitization of business processes has increased the complexity of information security management and underlines the urgency of effective solutions to security risks. Traditional information security risk management processes remain highly manual and depend strongly on the experience of cybersecurity professionals. This limits their accuracy, frequency, and scalability, which are required for effective risk management in modern dynamic environments. Solving these issues requires more efficient and automated approaches to risk management. This paper addresses these challenges and presents a novel approach that automates the identification, categorization, and evaluation of IT assets within organizational infrastructures. The proposed approach integrates automated asset discovery and hierarchical categorization of primary and secondary IT assets with automated topological mapping of inter-asset communication relations. Such an approach reduces manual intervention and supports continuous asset monitoring and risk assessment. In general, it improves the accuracy and efficiency of the risk assessment process and increases the organization’s ability to respond to potential threats. The proposed framework, designed as a lightweight scanning tool, was tested in emulated environments and in a physical laboratory topology. Compared with our previous partial studies, this paper integrates automated asset discovery, hierarchical asset categorization, topology-based relationship modeling, and validation into one coherent ISRM-support framework. Results demonstrate reduced manual intervention and improved support for asset-related risk assessment activities. This research proposes a simple, scalable, and efficient system for automating selected asset-related information security processes aligned with the ISO/IEC 27005 standard.