Welcome to the InfoSci Platform
Reference Hub4
Quantification, Optimization and Uncertainty Modeling in Information Security Risks: A Matrix-Based Approach

Quantification, Optimization and Uncertainty Modeling in Information Security Risks: A Matrix-Based Approach

Sanjay Goel, Eitel J.M. Lauría
Copyright: © 2010 |Volume: 23 |Issue: 2 |Pages: 20
ISSN: 1040-1628|EISSN: 1533-7979|EISBN13: 9781609603779|DOI: 10.4018/irmj.2010040103
Cite Article Cite Article

MLA

Goel, Sanjay, and Eitel J.M. Lauría. "Quantification, Optimization and Uncertainty Modeling in Information Security Risks: A Matrix-Based Approach." IRMJ vol.23, no.2 2010: pp.33-52. http://doi.org/10.4018/irmj.2010040103

APA

Goel, S. & Lauría, E. J. (2010). Quantification, Optimization and Uncertainty Modeling in Information Security Risks: A Matrix-Based Approach. Information Resources Management Journal (IRMJ), 23(2), 33-52. http://doi.org/10.4018/irmj.2010040103

Chicago

Goel, Sanjay, and Eitel J.M. Lauría. "Quantification, Optimization and Uncertainty Modeling in Information Security Risks: A Matrix-Based Approach," Information Resources Management Journal (IRMJ) 23, no.2: 33-52. http://doi.org/10.4018/irmj.2010040103

Export Reference

Mendeley
Favorite Full-Issue Download

Abstract

In this paper, the authors present a quantitative model for estimating security risk exposure for a firm. The model includes a formulation for the optimization of controls as well as determining sensitivity of the exposure of assets to different threats. The model uses a series of matrices to organize the data as groups of assets, vulnerabilities, threats, and controls. The matrices are then linked such that data is aggregated in each matrix and cascaded across the other matrices. The computations are reversible and transparent allowing analysts to answer what-if questions on the data. The exposure formulation is based on the Annualized Loss Expectancy (ALE) model, and uncertainties in the data are captured via Monte Carlo simulation. A mock case study based on a government agency is used to illustrate this methodology.

Request Access

You do not own this content. Please login to recommend this title to your institution's librarian or purchase it from the IGI Global bookstore.