Published: Apr 15, 2020
The following paper has been accepted at the 17th International Conference on Security and Cryptography (SECRYPT 2020):
- Title: Multi-Stakeholder Cybersecurity Risk Assessment for Data Protection
- Author: Majid Mollaeefar, Alberto Siena, Silvio Ranise
- Abstract: To ensure the effectiveness of the adopted security measures and minimize the impact of security issues on the rights and freedom of individuals, the General Data Protection Regulation (GDPR) requires to carry out a Data Processing Impact Assessment (DPIA). Such an assessment differs from traditional risk analyses in which the actor carrying out the evaluation is also the one interested in reducing its risk. Conflicts may thus arise between the need of protecting data subjects rights and organizations that shall provide adequate security measures while struggling with various types of constraints (e.g., budget). To alleviate this problem, we introduce the Multi-Stakeholder Risk Trade-off Analysis Problem, (MSRToAP) and propose an automated technique to solve their instances. We then show how this can help data controllers make more informed decisions about which security mechanisms allow for a better trade-off between their requirements and those of the data subjects. For concreteness, we illustrate the proposed on a simple yet realistic use case scenario.
- DOI: 10.5220/0009822703490356
About the conference
- Name: 17th International Conference on Security and Cryptography (SECRYPT 2020)
- Date: from July 08, 2020 to July 10, 2020
- Location: Virtual Event
- Website: http://www.secrypt.org/?y=2020
