An information systems security risk assessment model under the Dempster-Shafer theory of belief functions

• 成果类型: Article
• 署名作者: Sun, LL; Srivastava, RP; Mock, TJ
• 署名单位: Rutgers University System; Rutgers University New Brunswick; University of Kansas; University of Southern California; Maastricht University
• 刊物名称: JOURNAL OF MANAGEMENT INFORMATION SYSTEMS
• ISSN/ISSBN: 0742-1222
• DOI: 10.2753/MIS0742-1222220405
• 发表日期: 2006
• 页码: 109-142
• 关键词: ISSUES; PERSPECTIVE; services

摘要

This study develops an alternative methodology for the risk analysis of information systems security (ISS), an evidential reasoning approach under the Dempster-Shafer theory of belief functions. The approach has the following important dimensions. First, the evidential reasoning approach provides a rigorous, structured manner to incorporate relevant ISS risk factors, related countermeasures, and their interrelationships when estimating ISS risk. Second, the methodology employs the belief function definition of risk-that is, ISS risk is the plausibility of ISS failures. The proposed approach has other appealing features, such as facilitating cost-benefit analyses to help promote efficient ISS risk management. The paper elaborates the theoretical concepts and provides operational guidance for implementing the method. The method is illustrated using a hypothetical example from the perspective of management and a real-world example from the perspective of external assurance providers. Sensitivity analyses are performed to evaluate the impact of important parameters on the model's results.