Information System and Risk Reassessment

Objective: the purpose of the entire work is to help system analysts involved in assessing the quality of information sys tems (IS) operation during their creation, operation, modernization, development, to form the appearance of a comprehensive probabilistic prediction methodology applicable in the interests of ensuring quality and safety, justifying acceptable risks, identifying significant threats and supporting the adoption of scientifically rational system decisions to proactively counter threats in IS life cycle. The purpose of the 3rd part of the work is to complete the detailing of the general methodological provisions on the probabilistic prediction of the quality of IS operation quality (taking into account the enlarged description of the approach in the 1st part of the article [1] and the presentation of the basics of detailing modeling using «black boxes» in the 2nd part of the article [2]) by proposing: • the formalization of complex modeled systems consisting of parallel-sequential structures formed from «black boxes» and combined using logical connections «AND», «OR»; • the methods of system analysis of the IS operation quality; • the main components of the appearance of a comprehensive methodology for the probabilistic predicting IS operation quality, used by system analysts in the interests of ensuring quality and safety, justifying acceptable risks, identifying significant threats and supporting the adoption of scientifically based system decisions to proactively counter threats in the life cycle of specific IS. Research methods include: methods of probability theory, methods of system analysis. The modeled system is formally represented by «black boxes» and complex systems in the form of parallel-sequential structures formed from «black boxes» combined using logical connections «AND», «OR». The obtained results of mathematical modeling are used in the interpretation of the original IS, in the interests of which the corresponding calculations are carried out. The result of the work as a whole is: based on the research results presented in [1, 2], methodological provisions have been created that form the main components of the appearance of a complex methodology for probabilistic prediction of IS operation quality in accordance with GOST R 59341-2021 «System engineering. Protection of information in system information management process». The use of the proposed methodological provisions is intended to help system analysts form the appearance of a versatile complex methodology of probabilistic prediction, applicable in the interests of ensuring quality and safety, justifying acceptable risks, identifying significant threats and supporting the adoption of scientifically sound system decisions to proactively counter threats in the life cycle of specific IS. Scientific novelty of the work: with the widespread introduction of modern information technology tools and systems, the problems associated with a comprehensive study of the IS operation quality remain acutely relevant. Despite the fact that many system engineering standards have appeared that recommend the use of probabilistic system analysis for various types of systems, in practice, the formation of a set of techniques applicable to predicting quality measures, justifying acceptable risks, identifying significant threats and supporting the adoption of scientifically sound system decisions in IS life cycle causes practical difficulties for system analysts. These difficulties and the use of subjective assessments are related not only to the versatility of the very concept of IS operation quality, but also to the complexity of mathematical formalization, taking into account the specifics of each system. As a result, many important aspects are beyond the analyst's field of consideration, specific quality measures turn out to be incommensurable on a single quantitative scale, and the inverse analytical tasks of proactive threat management in IS life cycle and constituent elements are not solved. I.e., in practice, there is a contradiction between the needs for system analysis of IS and the possibilities for solving urgent problems of system analysis. To overcome this contradiction, the proposed methodological provisions formulate the general purpose of IS operation in various areas applications – to ensure the reliability and timeliness of providing the necessary information, completeness, validity and safety of the information used for subsequent intended use. The main proposed components of the complex methodology of probabilistic prediction of IS operation quality have determined the scientific novelty of this work, focused precisely on achieving this general formulated goal of IS operation.

The purpose of the study is to adapt the antipattern method to improve the effectiveness of teaching students in the fields of “Applied Informatics”, “Information Systems and Technologies”, “Software Engineering” to the principles and techniques of relational database design within the framework of relevant disciplines and practices. Training in database design is an important component of the formation of a specialist software developer. The totality of decisions taken in the design process should be based on generally accepted rules, principles and recommendations, as well as on the existing experience in creating and operating information systems, which is difficult to reproduce in the conditions of the university audience.Materials and methods. An approach focused on the concept of antipatterns – unsuccessful common design solutions will allow increasing the effectiveness of students’ training in database design. The antipattern concept has become widespread following the wide spread use of the concept of a pattern, that is, a common standard solution inscribed in the context of the problem being solved. Both the concept of a pattern and the concept of an antipattern were initially focused on object-oriented software, but later gained recognition in all areas of information technology. The paper proposes a scheme for describing the antipattern, includ ing the name, a brief description, possible causes of occurrence, a list of disadvantages of application in the construction of relational databases, a conceptual model in the form of an ER-diagram (entity-relationship diagram), an example of the appropriate database structure, ways to avoid antipatterns, as well as possible exceptions when using just such a design decision when creating a database may be justified.Research results. Based on educational, scientific and technical literature and periodicals, as well as on the basis of an analysis of the existing practice of designing information systems, a catalog of common antipatterns for designing relational databases has been compiled and described. Examples of antipatterns: “Jumble of names”, “Duplicate tables”, “False abstraction”, “Non-atomic attributes”, “Duplicate columns”, “Changing data in due course (temporaryfields)”, “Parallel connections”, ““Divine” table”, “Speculative metadata modification”, etc. At the same time, some of the patterns made it possible to illustrate the general principles of relational database design, for example, such as “No sophisticated programming is capable of correcting fatal architectural flaws”. It is shown that the existing unsuccessful solutions are often due to certain prerequisites, for example, the need to perform a hotfix that is, a “temporary” solution, or a premature attempt to improve system performance, or the desire to get some report with one request, avoiding unnecessary connections, etc. In addition to the technical aspects, the relevance of a correct and uniform naming system is shown, the absence of which makes it difficult to maintain and develop the system and leads to unnecessary costs. The proposed approach was tested when teaching students the disciplines “Databases”, “Database design”, “Architecture of information systems”. The students who completed the training improved their understanding of the principles and practices of database structure design. Conclusion. The use of the proposed catalog of antipatterns in the educational process of the university makes it possible to accelerate the training of young specialists in the techniques of designing the structure of relational databases, avoid common mistakes when creating information systems, and improve the overall design culture.

Environmental quality is fundamental for the well being of human life. Environmental risk assessment and analysis have a crucial role for guaranteeing the safety of the population, especially in intensive urbanized and industrialized areas, such as the Campania region (Italy). In Italy, after the Legislative Decree 152/2006, the environmental risk assessment has become mandatory for contaminated lands such as brownfields and dismantled industrial activities. Despite the importance and fragility of the soil, it is rarely taken into account as a resource to be preserved. Moreover, due to the heterogeneity of many variables involved in the process, the environmental and human health risk assessments are used at the scale of a site, while the regional evaluation is very difficult, and keeps the administration sceptical in taking it into account for land planning and decision-making processes. During the last years, some international methodologies for ecological and human health risk assessment have been developed by national environmental agencies in many industrialized countries. An idea recently took place regarding the protection of soils: the monitoring of soil should be limited only to risk areas, as opposed to monitoring systems covering the entire territory. Focusing monitoring in selected areas would help to define priorities, increase efficiency of monitoring activities and reduce the monitoring costs. This is the reason why many methodologies for preliminary and simplified risk assessment of (potentially) contaminated sites, for the prioritization and planning of soil remediation and protection programmes, were developed. The only lack that these methodologies have is the absence of the spatial analysis. The aim of this research was to implement the human health risk assessment. For the purposes of the study we used 3535 topsoil samples, collected across the whole regional territory. The concentrations of 53 elements have been determined at Bureau Veritas Analytical Lab. Ltd (Vancouver, Canada), by means of an Aqua Regia extraction followed by a combination of ICP-MS and ICP-AES methods. After the statistical and cartographic elaboration of these regional dataset, we integrated one of the model of relative risk assessment for single contaminated sites with spatial analysis procedures. In order to support the spatial assessment of contaminated sites at the regional scale, the most suitable tool is the Geographic Information System (GIS). A new approach was applied, in order to assess/rank environmental risk by using geospatial analysis in a GIS platform to adapt a European-wide accepted methodology for the preliminary assessment of human health risks at single contaminated sites to a regional scale. The developed regional risk assessment methodology can be used by the regional administrations to select at regional level the or priority areas. The identification of the problem areas is necessary for developing an efficient monitoring system and to produce a ranking of the risky areas to be used as a reference in determining the development of intervention plans, for better addressing the resources dedicated to the environmental remediation of widely contaminated regions. The methodology chosen as a reference for the risk assessment procedures is the PRA.MS (Preliminary risk assessment model for the identification of problem areas for soil contamination in Europe, 2005). Following the PRA.MS guidelines, a conceptual model for the human health risk assessment for the Campania region has been based on four different exposure routes: 1) dispersion of contaminants in groundwater, 2) dispersion in surface water, 3) dispersion in air, 4) direct contact with the contaminated media (soils). The source, the pathway and the receptor for each of the exposure route are scored on the base of a quantitative or qualitative analysis of some featuring characteristics (parameters). A total of 14 representative parameters were chosen, basing on the available regional data for Campania. Starting from these parameters values, the information is aggregated to higher levels in several steps, adopting a mixed additive and multiplicative algorithm, up to the overall risk score. The final risk map is classified according four classes of risk. This map was useful to identify the problem areas, characterized by a higher risk, where more detailed analysis had to be carried out. The identified area was located in a wide territory in the center of Campania region, between Avellino and Salerno municipalities, an high populated zone, where intensive agricultural and industrial activities are well developed. A high density survey has been carried out in this priority area; the concentrations of 53 elements have been measured on 102 new topsoil samples, followed by statistic and cartographic elaboration of the 15 potentially toxic elements (Sb, As, Be, Cd, Co, Cr, Cu, Hg, Ni, Pb, Se, Sn, Tl, V, Zn) for which the Italian legislation (D.Lgs. 152/06) established the trigger and action limits, by defining the contamination threshold values (CSC) for the amount of metals in topsoils or waters. The new methodology of GIS-based human health risk assessment has been again applied, in order to select sites of particular significance in terms of danger for the resident population. Some small areas characterized by high risk have been identified. New in situ measurements and classic follow up risk assessment should be here carried out to confirm if remediation actions are needed to guaranteeing the safety of the population. Other works has been contemporaneously elaborated during the PhD. Six months have been spent at the Geological Survey of Finland (GTK), where a work on a humus samples dataset have been carried out, under the supervision of Dr. Timo Tarvainen. Moreover a new Geochemical Atlas will be completed based on inorganic elements and organic compounds concentrations in marine sediments samples, collected in the Gulfs of Naples and Salerno.

The Internet of Medical Things (IoMT) has revolutionized health care services by providing significant benefits in terms of patient well being and relevant costs. Traditional risk assessment methodologies, however, cannot be effectively applied in the IoMT context since IoMT devices form part of a distributed and trustless environment and naturally support functionalities that favor reliability and usability instead of security. In this work we present a survey of risk assessment and mitigation methodologies for IoMT. For conducting the survey, we assess two streams of literature. First, we systematically review and classify the current scientific research in IoMT risk assessment methodologies. Second, we review existing standards/best practices for IoMT security assessment and mitigation in order to i) provide a comparative assessment of these standards/best practices on the basis of predefined criteria (scope and/or coverage, maturity level, and relevant risk methodology applied) and ii) identify common themes for IoMT security controls. Based on the analysis, we provide various IoMT research and implementation gaps along with a road map of fruitful areas for future research. The paper could be of significant value to security assessment researchers and policymakers/stakeholders in the health care industry.

Under the 1996 Amendments to the Safe Drinking Water Act (1), the U.S. Environmental Protection Agency (U.S. EPA) must consider susceptible subpopulations in its health risk assessments. The amendments mention specific groups, including young children, the elderly, pregnant women, and people who are immunocompromised by disease or treatment for diseases. The concept of susceptibility to adverse health outcomes from environmental exposures can be extended to other groups as well. For chemical exposures, a great deal of current research is the analysis of how differences in metabolic phenotypes modify the effects of toxic exposures. For microbial exposures, concepts of susceptibility have generally been limited to the permanent or transient protection from infection afforded by previous exposure. Little consideration has been given to the degree to which individuals may differ in the completeness of protection offered by their immune systems. In addition to genetic factors, nutritional status, systemic diseases, and toxic insult may alter the ability to mount an effective immune response. Social factors, such as access to health care, may also modify the course of infection with microbial pathogens. Risk assessment is an inherently multidisciplinary process, and yet the disciplines needed to address technical issues in microbial risk assessment (e.g., secondary spread, virulence) are not applicable to chemical risk assessment. Addressing this issue in a fresh, scientifically rigorous manner requires the interaction of scientists who have experience in conducting risk assessments with experts in recognizing, studying, and treating infectious diseases. On 30 November and 1 December 1999, the George Washington University's Center for Risk Science and Public Health (Washington, DC) convened a workshop titled Incorporating Susceptibility into Microbial Risk Assessment. The goal of this workshop was to produce a consensus document with multidisciplinary input that defined susceptibility to microbial pathogens for the purposes of risk assessment and which provided a framework for incorporating data on susceptibility into microbial risk assessments. The specific objectives were to a) create a group process that effectively involved multiple disciplines, including those not traditionally involved in risk assessment, such as pathology and immunology; b) clarify the conceptual elements of susceptibility for the purposes of microbial risk assessment; c) identify the data sources for the elements of susceptibility in microbial risk assessment; and d) list the elements of susceptibility that need to be incorporated for different applications of microbial risk assessments.

This chapter summarizes innovations in security risk and capability assessment frameworks and methodologies to directly support dynamic decision making, forge a convergence with S&T, operations, intelligence and policy, and inform investment priorities of the Canadian Safety and Security Program (CSSP). Using a thematic approach, this paper reviews how multiple innovations were adopted as “best practices” into the conceptual design, development and implementation of security risk assessment frameworks and methodologies in the CSSP. These include the: use taxonomies to foster key stakeholder ‘buy in’; leveraging architecture frameworks to drive tools, methods and rating schema; the formulation of scenario based approaches for assessing high consequence all hazards risks; and, the application of an integrated risk and capability gap assessment model to guide investment in public safety and security S&T. In the CSSP, the innovations in security risk assessment identified best practices and common tools that supported numerous strategies and S&T portfolios (e.g., CBRNE, Critical Infrastructure Protection, all hazards safety and security; defence infrastructure/military bases), where risk assessment expertise/capability improvements that were adopted by practitioners, interdisciplinary teams and decision makers. Underpinning these innovations were strong partnerships and community-based approaches that enabled a credible risk-informed decision support environment, with consistent/scalable approaches to analysis and decision making under conditions of uncertainty.KeywordsSecurity risk assessmentVulnerability

The magazine's publications deal with issues related to work safety. Both in the area of occupational health and safety, organization of the workplace (technical aspects) and the environment (environmental factors in working conditions). The publications presented combine legal requirements in the field of work safety with the technical solutions that are designed to meet the minimum requirements. They present and analyze the requirements of technological processes carried out at workplaces. Sociological issues are also carried out in the analyzes, in the scope of training and creating a safety culture within production enterprises. Scope Subject areas, suitable for publication, include the following fields: Health and safety management systems Technological safety The role of the human factor in occupational health and safety management systems Safety of technical facilities operation (safety engineering) Environmental safety management Safety management of products and services Management of occupational risk Economical aspects of occupational health and safety Legal aspects of health and safety at work Safety in material engineering Safety in civil engineering

The subject of considerations is the importance of EU regulations, especially Directive 89/391 EEC as for Polish regulations in the area of occupational health and safety. In the article, the author concentrates on the regulations governing the legal consultation with workers, or their representatives, on OHS matters. According to the Polish Labor Code, the consultations both on the workers’ and employers’ part are universal. This is because they include all workers and all employers. The subject of the legal consultations are all activities related to occupational health and safety. The Polish Labor Code provides guarantees that workers and their representatives will not suffer any negative consequences for performing consultative functions. In the author’s opinion, Polish regulations in the area of occupational health and safety fully implement the provisions of Directive 89/391/EEC.

Risk analysis and assessment methodologies in the work sites: On a review, classification and comparative study of the scientific literature of the period 2000–2009

The processes effectiveness means their ability to achieve the planned aims. While planning the aims, one should currently take into consideration not only the quality parameters but also all of the criteria reflecting the expectations stated by the interested parties. Influence on the processes by the factors disturbing their realization requires such their monitoring and regulation to make the aims achievable. In return, it requires development and application of the processes assessment methods enabling pointing out their pivotal points and the possibilities of their monitoring. The study proposes the following combination: process approach and risk assessment enabling pointing out the “risky” processes as well as their “risky” aspects. The risk of the particular process has been evaluated by taking advantage of two methods considering various risk parameters as well as various individual criteria for assessing the mentioned parameters. Application of the developed methodologies of risk analysis and assessment of its acceptability allowed for formulating the conclusion that while risk assessment the following aspects are important: choice of the risk parameters, application of the individual assessment criteria of these parameters and taking advantage of the risk acceptability scale of the process, depending on the phase of its improvement. Properly prepared method of risk assessment gives the chance for the effective monitoring of the process risk refraining from its particular threats.

Development of a Korean offshore wind power HSE risk assessment module based on systems engineering approach

As our scientific technology grows, risk assessment methods become more complex and, therefore, open to greater scientific debate. Risk assessment has always been a part of the regulatory notification and approval process for foods. However, the methodologies applied to risk assessment and decision-making have become diverse, dependent on a number of features, including the areas of the world in which one operates, the need to use cumulative risk assessment for pesticides and otheringredients or alternative risk assessment considerations for evaluating nontraditional or bioengineered foods. Diverse institutional structures within a single federal regulatory authority may tend to lead to diversity in risk outcomes that creates policy decisions that complicate and confuse the risk management process. On top of this challenge, decisions become more complicated by the need to examine beneficial factors of foods rather than the adverse effects of foods and food additives. Foods are a complex mixture ofingredients. Regulatory groups recognize the need to use new approaches for evaluating the safety and risks associated with foods and food additives, and to do so in a timely manner. The United States Food and Drug Administration (US FDA) in its need to ensure standards of “reasonable certainty of no harm” continues to explore alternative means to be responsive to petitioners as well as continue to examine scientifically validated means, e.g., quantitative structure-activity relationship (QSAR), and computer-assisted programs, within the approval process to assist in the evaluation of risks. Another means to improve the risk management process would include the cumulative risk assessment of pesticides that will, no doubt, be the beginning of more intensive efforts to understand cumulative exposures and the inherent risks from multiple pathways of exposure. The passage of the Food Quality Protection Act (FQPA) resulted in developing additional risk assessment methodologies and approaches to assess the potential for multiple exposures and risks. Addressing the international criteria used in decision-making related to foods safety assessment has resulted in acceptable intake values for foodingredients for carcinogens and noncarcinogens that, in general, tend to be more stringent in the United States compared to Europe. Clearly, the need for harmonization of risk assessment criteria and the impact of the decision process on regulatory approvals and safety assessment is a future need for the continued assurances of food safety. The topics presented in this paper are based on a symposium held in November 2002 at the annual meeting of the American College of Toxicology.

In the rapidly evolving landscape of supply chain (SC) management, the importance of tracking services in overseeing the lifecycle from production to sale cannot be overstated. These services rely on sophisticated systems that monitor vital condition information such as temperature and humidity. However, beyond the technical and mechanical aspects, human factors play a critical role in the operational integrity of these systems. This paper introduces a novel risk assessment methodology for SC tracking, emphasizing human error alongside technological and security risks, and integrates motivation and contribution aspects into the SC risk assessment framework.Our methodology is comprehensive, exploring the strategic business and technical requirements of SC tracking systems. It uniquely extends to assess the frequency, nature, and impact of human errors, alongside considering technological aspects. We investigate how human factors interact with elements such as IoT, cloud services, and standard IT systems, potentially leading to security vulnerabilities and operational inefficiencies. By mapping these human-centric risks to key operational components, we provide a comprehensive view of potential threats in SC tracking.In an environment where standardization efforts in SC risk assessment methodologies are ongoing, our work identifies the necessity for more specialized techniques, particularly those addressing security risks related to tracking and monitoring systems. Given the distributed nature and internet connectivity of these systems, they are inherently susceptible to numerous security challenges, predominantly involving their technological equipment. This underscores the imperative for a targeted risk assessment methodology focusing on the security risks of SC tracking systems, particularly in the context of traceability services and the monitoring of the state of assets in transit.Employing well-known risk assessment standards and threat modeling guides, our methodology scrutinizes targeted IT components used in SC tracking systems, their technical characteristics, and realistic threat agents in the SC ecosystem. We aim to evaluate whether security attacks originating from SC-specific threat agents result in tangible security risks against targeted hardware and software components within SC networks.To validate our methodology, we present a proof of concept application based on a real-case scenario. This demonstration highlights the versatility of our methodology to accommodate various SC scenarios, such as food, pharmaceuticals, and cold supply chains. The primary advantage of our proposed methodology lies in its ability to integrate risk estimation with the technological attributes of typical SC tracking systems and their operational requirements, which may vary based on the type of goods and services involved.In conclusion, this paper addresses the broader challenges in developing and implementing smart SC tracking systems, with a special emphasis on the integration of human error in these technologically advanced environments. We underscore the significant influence of human factors on the reliability and security of SC tracking systems and the cost implications and potential operational disruptions caused by human factors, thereby highlighting their pivotal role in the overall effectiveness and security of SC ecosystems.

Cut off values of bone mineral density defining postmenopausal women with bone fractures.

The effective mitigation of landslide risk requires analytical approaches. In qualitative risk assessment, the components of risk, which are hazard, elements at risk and vulnerability, are expressed verbally and the final result is in terms of ranked or verbal risk levels (IUGS 1997). Qualitative risk assessment is subjective in nature. Quantitative risk assessment involves quantification of risk components and computation of risk. The purpose of quantitative risk assessment (QRA) is to calculate a value for the risk to enable improved risk communication and decision-making (Lee & Jones 2004). For landslides, the use of quantitative risk assessment procedures is recommended. Several frameworks for QRA have been proposed by many experts and organizations (e.g. Varnes 1984, Whitman 1984, Einstein 1988, Fell 1994, Wu et al. 1996, Morgenstern 1997, Fell & Hartford 1997, Einstein 1997, Aleotti & Chowdhury 1999, Ho et al. 2000, Roberds 2001, Dai et al. 2002, Nadim & Lacasse 2003, Lee & Jones 2004, IUGS 1997, AGS 2000, NRC Transportation Research Board 1996, GEO 1998). The QRA frameworks have common intention to find answers to the following questions (Ho et al. 2000, Lee & Jones 2004):1 What are the probable dangers/problems? [Danger Identification]2 What would be the magnitude of dangers/problems? [Hazard Assessment]3 What are the possible consequences and/or elements at risk? [Consequence/Elements at Risk Identification]4 What might be the degree of damage in elements at risk [Vulnerability Assessment]5 What is the probability of damage? [Risk Quantification/Estimation]6 What is the significance of estimated risk? [Risk Evaluation]7 What should be done? [Risk Management]Depending on the characteristics of a landslide, available data, scale of investigation and nature of consequences, the QRA frameworks may differ. Hazard assessment for a specific slope usually involves probabilistic analysis of the given slope, while hazard assessment for a region generally requires the computation of frequency of the landslides in the region. The probabilistic models used for a specific slope depend on the failure mechanism (flows, falls or slides) and slope material (soil or rock). Furthermore, the characteristics of a landslide and scale of investigation influence the consequence/elements at risk, vulnerability, risk quantification/assessment, risk evaluation and risk management. Two important aspects of QRA for landslides are the lack of wellestablished acceptable risk criteria and methods forABSTRACT: Two important aspects of quantitative landslide risk assessment, vulnerability and acceptable risk, are studied as part of a new Integrated Risk Assessment Framework (IRAF). IRAF consists of four steps: data collection, hazard assessment, vulnerability assessment, and risk assessment. Data collection involves obtaining the appropriate data for the hazard, vulnerability and risk assessments. The hazard component integrates the numerical and probabilistic analyses to exploit the added knowledge from the two approaches. A new 3-dimensional framework for quantification of vulnerability is proposed. The fourth component of IRAF is risk assessment, with the computation and evaluation of the risk based on some acceptability criteria. IRAF is implemented for rock slopes. To define an acceptability criterion, published data were collected. Various terminology relating to acceptable risk used in the literature, such as acceptable vs. tolerable, specific vs. total, voluntary vs. involuntary and individual vs. societal, are discussed.