MAIA: Methodology for Assessing the Impacts of Threats to Information Systems

Context: Cyberattacks have increased in the last decades. The lack of security results in scenarios full of vulnerabilities in information systems. A pentest can be defined as a proactive attempt to assess the security of an information system. It is mandatory in specific organizational scenarios and must be performed by third-party companies, which can imply high costs for the organization. Problem: Some organizations are often unfamiliar with a pentest or cannot pay for it. Other solutions must be proposed for them. Solution: An Information System Threat Impact Assessment Methodology (MAIA) easy to follow was this work’s objective. The goals were the methodology itself and the index that could quantify the vulnerabilities’ impacts. IS Theory: This work followed the General Systems Theory, in particular with regard to systems security. Method: The research is prescriptive in nature, and its evaluation was carried out through a case study in a big company. The results are both quantitative and qualitative. Summary of Results: The practical results in a real organization show the vulnerabilities identified, and the final vulnerability index indicated a high risk to the company. It shows the MAIA applicability. Contributions and Impact on the IS area: The main contribution is a methodology that is an alternative approach to traditional pentests. The methodology may be conducted by multidisciplinary teams. Decisions regarding the correction of vulnerabilities can be taken based on the results of MAIA.