A Fuzzy Based Classification and Labelling Framework for Effective Information Assets Security Risk Assessment

Abstract

Abstract This study explores the pressing problem of security risk classification of information assets, which is a significant concern for businesses due to the lack of an efficient system aligning with information security standards and accounting for users’ preferences. Current strategies such as manual methods and machine learning techniques have shown limitations in effectiveness. The research introduces a Fuzzy-based Information Asset Classification and Labeling (FIACL) framework, implemented according to the ISO/IEC 27001 security standard. The FIACL framework consists of six key phases, namely, information asset classification, fuzzy inference system, information asset labelling, information security risk assessment, information asset handling, and storage. Data from various institutions were collected and utilised in assessing the FIACL's performance. The framework classified and labelled the information assets according to their security levels, followed by a risk assessment phase. Usability tests were performed using real datasets from the case studies and the Technology Acceptance Model. FIACL's performance was compared with an Expert based information classification system (ICS), demonstrating superior precision, recall, f-measure, and accuracy values (1.00, 0.89, 0.94, 0.89 respectively), indicating its improved efficiency in classifying information assets and mitigating security risks.