An Information Systems Security Risk Assessment Model Under the Dempster-Shafer Theory of Belief Functions

Abstract

This study develops an alternative methodology for the risk analysis of information systems security (ISS), an evidential reasoning approach under the Dempster-Shafer theory of belief functions. The approach has the following important dimensions. First, the evidential reasoning approach provides a rigorous, structured manner to incorporate relevant ISS risk factors, related counter measures and their interrelationships when estimating ISS risk. Secondly, the methodology employs the belief function definition of risk, that is, ISS risk is the plausibility of information system security failures. The proposed approach has other appealing features, such as facilitating cost-benefit analyses to help promote efficient ISS risk management. The paper both elaborates the theoretical concepts and provides operational guidance for implementing the method. The method is illustrated using a hypothetical example from the perspective of management and a real-world example from the perspective of external assurance providers. Sensitivity analyses are performed to evaluate the impact of important parameters on the model's results.

Evaluation of Cyber Security and Modelling of Risk Propagation with Petri Nets

“…There are multiple articles on methods of risk assessment, and they are widely described e.g., by Sun et al [4], Ting et al [5], and Vrabel et al [6]. The methods are focused mostly on risk estimation for particular problems (e.g., disease [7,8], cancer [9], earthquakes [10], floods [11]) or calculation of risk with the use of various techniques, e.g., Bayesian networks [12,13], attack trees [14], or the Dempster-Shafer theory of belief functions [4].…”

Alternative form of Dempster's rule for binary variables

“…The renormalization constant K for the above case is given by 7 7 7 Plausibility that the assertion "Customer information is protected from unauthorized internal access and is used in ways associated with the entity's business" is not true represents the risk related to this assertion. Sun et al (2004) discuss information security risk in great detail.…”

“…Numerical Example: Information Systems Security Risk Sun et al (2004) have recently developed an evidential reasoning approach to assessing information systems security risk. They use the Dempster-Shafer theory of belief functions to model the uncertainties involved in the evidence.…”

A new lightweight method for security risk assessment based on fuzzy cognitive maps

“…Baudrit et al (2006) proposed a risk assessment method of node transmission and possibility exposure. Sun et al (2006) introduced a risk assessment model based on DS evidence reasoning. The disadvantages of all those methods are related to the strong subjectivity of premises.…”