標題: A hybrid information security risk assessment procedure considering interdependences between controls
作者: Lo, Chi-Chun
Chen, Wan-Jia
資訊管理與財務金融系 註:原資管所+財金所
Department of Information Management and Finance
關鍵字: Information security;Risk assessment;Decision Making Trial and Evaluation Laboratory (DEMATEL);Analytic Network Process (ANP);Order Weighted Averaging (OWA) operator;Fuzzy linguistic quantifiers;Maximum entropy method
公開日期: 1-一月-2012
摘要: Risk assessment is the core process of information security risk management. Organizations use risk assessment to determine the risks within an information system and provide sufficient means to reduce these risks. In this paper, a hybrid procedure for evaluating risk levels of information security under various security controls is proposed. First, this procedure applies the Decision Making Trial and Evaluation Laboratory (DEMATEL) approach to construct interrelations among security control areas. Secondly, likelihood ratings are obtained through the Analytic Network Process (ANP) method: as a result, the proposed procedure can detect the interdependences and feedback between security control families and function in real world situations. Lastly, the Fuzzy Linguistic Quantifiers-guided Maximum Entropy Order-Weighted averaging (FLQ-MEOWA) operator is used to aggregate impact values assessed by experts, applied to diminish the influence of extreme evaluations such as personal views and drastic perspectives. A real world application in a branch office of the health insurance institute in Taiwan was examined to verify the proposed procedure. By analyzing the acquired data, we confirm the proposed procedure certainly detects the influential factors among security control areas. This procedure also evaluates risk levels more accurately by coping with the interdependencies among security control families and determines the information systems safeguards required for better security, therefore enabling organizations to accomplish their missions. Crown Copyright (C) 2011 Published by Elsevier Ltd. All rights reserved.
URI: http://dx.doi.org/10.1016/j.eswa.2011.07.015
http://hdl.handle.net/11536/14893
ISSN: 0957-4174
DOI: 10.1016/j.eswa.2011.07.015
期刊: EXPERT SYSTEMS WITH APPLICATIONS
Volume: 39
Issue: 1
起始頁: 247
結束頁: 257
顯示於類別:期刊論文


文件中的檔案:

  1. 000296214900029.pdf