An Information Systems Security Risk Assessment Model Under the Dempster-Shafer Theory of Belief Functions.

Author List: Sun, Lili; Srivastava, Rajendra P.; Mock, Theodore J.;
Journal of Management Information Systems, 2006, Volume 22, Issue 4, Page 109-142.
This study develops an alternative methodology for the risk analysis of information systems security (ISS), an evidential reasoning approach under the Dempster-Shafer theory of belief functions. The approach has the following important dimensions. First, the evidential reasoning approach provides a rigorous, structured manner to incorporate relevant ISS risk factors, related countermeasures, and their interrelationships when estimating ISS risk. Second, the methodology employs the belief function definition of risk—that is, ISS risk is the plausibility of ISS failures. The proposed approach has other appealing features, such as facilitating cost-benefit analyses to help promote efficient ISS risk management. The paper elaborates the theoretical concepts and provides operational guidance for implementing the method. The method is illustrated using a hypothetical example from the perspective of management and a real-world example from the perspective of external assurance providers. Sensitivity analyses are performed to evaluate the impact of important parameters on the model's results.
Keywords: belief function theory; cost-benefit analysis; evidential reasoning; information systems security; risk analysis; sensitivity analysis
Algorithm:

List of Topics

#44 0.307 approach analysis application approaches new used paper methodology simulation traditional techniques systems process based using proposed method present provides various
#264 0.136 risk risks management associated managing financial appropriate losses expected future literature reduce loss approach alternative mitigate failures failure cause mitigation
#240 0.114 systems information management development presented function article discussed model personnel general organization described presents finally computer-based role examined functional components
#110 0.100 theory theories theoretical paper new understanding work practical explain empirical contribution phenomenon literature second implications different building based insights need
#191 0.083 model models process analysis paper management support used environment decision provides based develop use using help literature mathematical presented formulation
#186 0.069 security information compliance policy organizations breach disclosure policies deterrence breaches incidents results study abuse managed isp violations based comply protection
#213 0.066 assimilation beliefs belief confirmation aggregation initial investigate observed robust particular comparative circumstances aggregated tendency factors examine stages uncertainty instead confidence
#81 0.061 applications application reasoning approach cases support hypertext case-based prototype problems consistency developed benchmarking described efficient practical address activity demonstrate effective