Assessment of Security Risk Awareness: A Case Study of Information Systems in Government Agencies

This research aims to study, analyze, and compare security risk assessment and risk awareness evaluation in information systems of government agencies or public sector, along with the business impact on these agencies. The study employs the Common Vulnerability Scoring System (CVSS), an internationally recognized standard for evaluating the severity of cybersecurity vulnerabilities, in conjunction with the Business Impact Factor (BIF) as a factor in determining the overall cybersecurity risk level. The study involves 40 public agencies and utilizes CVSS to evaluate the severity of security vulnerabilities in agency assets, including the intranet, websites and web applications, and database servers. The research findings indicate that the average severity of vulnerabilities across public agencies is high, while the business impact assessment falls within the medium range for nearly all assets. Notably, database servers exhibit a higher impact value compared to other assets.