Security Risk Analysis of Information System in Academic Institution based on Business Perspective: A Case Study - Deshanta Ibnugraha, Prajna; Edi Nugroho, Lukito; Insap Santosa, Paulus (International Journal of Engineering and Technology, 2019)
Information system of academic institution is used to manage data from students, staffs and lecturers that consists a lot of critical information like student grades, accounts and other private information. However, some of information system have SQL injection vulnerability which occurs data security breach. It has possibility to make reputation damage and other business impact in academic institution. Therefore, objective of this study is to analyze risk based on business perspective as basic process to select suitable mitigation. OWASP is exisiting method that considered as proper method for risk analysis in this study because it has explicit metrics related business approach. Based on experiment result, business impact of vulnerability can be measured. However, some metrics still need to be developed to get more precision result that describe real impact for business of institution.Â Â
Keywords: Risk analysis; OWASP; information system; SQL injection.