title: The CORAS approach for model-based risk management applied to a telemedicine service.
abstract: The CORAS risk management process is based on the Australian standard for risk management and aims at improved methodology for precise, unambiguous, and efficient risk assessment of security critical systems. CORAS addresses security critical systems in general, but places particular emphasis on IT security. For CORAS, a system is not just technology, but also the humans interacting with the technology and all relevant aspects of the surrounding organisation and society. The use of graphical models in CORAS furthers communication between the different stakeholders of a risk assessment, and makes it easier for non-technicians to take part. Telemedicine services and electronic applications used in the health sector have a high demand for security. The medical developers, providers and users of such services and systems are important contributors in the risk assessment of these services and systems. CORAS has successfully been used to involve medical professionals in the model-based risk assessment of a telemedicine system called Tele-cardiology in Crete. This paper presents the use of the CORAS framework to assess this telemedicine system giving some conclusions on the experience gained.
authors.affiliation: Computer Technology Institute (CTI), Patras, Greece. stamatiu@cti.gr
authors.forename: Yannis
authors.initials: Y
authors.lastname: Stamatiou
authors.forename: Eva
authors.initials: E
authors.lastname: Skipenes
authors.forename: Eva
authors.initials: E
authors.lastname: Henriksen
authors.forename: Nikos
authors.initials: N
authors.lastname: Stathiakis
authors.forename: Adamantios
authors.initials: A
authors.lastname: Sikianakis
authors.forename: Eliana
authors.initials: E
authors.lastname: Charalambous
authors.forename: Nikos
authors.initials: N
authors.lastname: Antonakis
authors.forename: Ketil
authors.initials: K
authors.lastname: Stølen
authors.forename: Folker
authors.initials: F
authors.lastname: den Braber
authors.forename: Mass Soldal
authors.initials: MS
authors.lastname: Lund
authors.forename: Katerina
authors.initials: K
authors.lastname: Papadaki
authors.forename: George
authors.initials: G
authors.lastname: Valvis
mesh_terms: D016494:Computer Security; D006115:Greece; D017146:Models, Organizational; D019114:Remote Consultation / Q000458:organization & administration*; D012308:Risk Management / Q000458:organization & administration*