Modeling Fraud Prevention of Online Services Using Incident Response Trees and Value at Risk
2015 (English)In: the Proceedings of the International Conference on Availability, Reliability and Security, IEEE , 2015Conference paper (Refereed)
Authorities like the Federal Financial Institutions Examination Council in the US and the European Central Bank in Europe have stepped up their expected minimum security requirements for financial institutions, including the requirements for risk analysis. In a previous article, we introduced a visual tool and a systematic way to estimate the probability of a successful incident response process, which we called an incident response tree (IRT). In this article, we present several scenarios using the IRT which could be used in a risk analysis of online financial services concerning fraud prevention. By minimizing the problem of underreporting, we are able to calculate the conditional probabilities of prevention, detection, and response in the incident response process of a financial institution. We also introduce a quantitative model for estimating expected loss from fraud, and conditional fraud value at risk, which enables a direct comparison of risk among online banking channels in a multi-channel environment.
Place, publisher, year, edition, pages
IEEE , 2015.
Economics and Business
IdentifiersURN: urn:nbn:se:kth:diva-176308DOI: 10.1109/ARES.2015.17ISI: 000380572600016ScopusID: 2-s2.0-84961671375OAI: oai:DiVA.org:kth-176308DiVA: diva2:866554
10th International Conference on Availability, Reliability and Security (ARES), Toulouse, France, 2015
QC 201511032015-11-032015-11-032016-09-20Bibliographically approved