Risk Assessment of Security Requirements of Banking Information Systems Based on Attack Patterns

摘要: Security risk assessment is an important process for the implementation of any information systems including those in banking sector. When a bank initiates or implements system project, requirements engineers business analysts project conduct initial validation security to check if they comply with regulations before audit takes place. This paper presents method assist team validating system. Text similarity analysis used identify which are missing from bank, and quantitative index model also proposed determine level associated requirements. The based on harm potential attacks can do not implemented. Using case study Thailand, we apply assess Thai commercial banks against IT Best Practices Bank Thailand. We evaluate performance compliance checking terms F-measure accuracy, validity correlation expert judgment.