Centro de Documentação da PJ
Analítico de Periódico
CD 346
Lost in the middle [Recurso eletrónico] : a pragmatic approach for ERP managers to prioritize known vulnerabilities by applying classification and regression trees (CART) / Richard G. Mathieu, Alan E. Turovlin
Information and Computer Security, Bingley, Vol. 31, n. 5 (2023), p. 655-674
Ficheiro de 834 KB em formato PDF.
SEGURANÇA INFORMÁTICA, BASE DE DADOS, COMUNICAÇÃO DE DADOS, INFORMÁTICA
Purpose – Cyber risk has significantly increased over the past twenty years. In many organizations, data and operations are managed through a complex technology stack underpinned by an Enterprise Resource Planning (ERP) system such as system analyse programmentwicklung (SAP). The ERP environment by itself can be overwhelming for a typical ERP Manager, coupled with increasing cybersecurity issues that arise creating periods of intense time pressure, stress and workload, increasing risk to the organization. This paper aims to identify a pragmatic approach to prioritize vulnerabilities for the ERP Manager. Design/methodology/approach – Applying attention-based theory, a pragmatic approach is developed to prioritize an organization’s response to the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) vulnerabilities using a Classification and Regression Tree (CART). Findings – The application of classification and regression tree (CART) to the National Institute of Standards and Technology’s National Vulnerability Database identifies prioritization unavailable within the NIST’s categorization. Practical implications – The ERP Manager is a role between technology, functionality, centralized control and organization data. Without CART, vulnerabilities are left to a reactive approach, subject to overwhelming situations due to intense time pressure, stress and workload. Originality/value – To the best of the authors’ knowledge, this work is original and has not been published elsewhere, nor is it currently under consideration for publication elsewhere. CART has previously not been applied to the prioritizing cybersecurity vulnerabilities.
