Combining Disparate Information Sources when Quantifying Security Risks

摘要: Managing risk involves making decision on which risks to treat, what treatment use and how finance the treatment. Decision-makers need quantitative values be able optimize their investment effectively distribute resources available. Since security attacks are future events we have limited amount of information sources for estimation. In order quantify frequency occurrence, impact incident effect alternative options combine empirical subjective data obtain a reasonable data. this paper present an approach quantifying using data, such as experience from similar incidents, knowledge domain experts. We look at four different approaches by discussing result experiment conducted with undergraduate students NTNU, Norway. The overall focus is providing support cost-benefit analysis trade-off between cost maximizing available resources. However, main studying input into expert judgments.