Quantitative risk assessment model for software security in the design phase of software development

摘要: Risk analysis is a process for considering possible risks and determining which are the most significant any particular effort. Determining to address optimum strategy mitigating said often an intuitive qualitative process. An objective view of inherent in development effort requires quantitative risk model. Quantitative models used factors focus on tend use traditional approach annualized loss expectancy (ALE) based frequency occurrence exposure factor (EF) percentage asset due potential threat question. This research uses empirical data that reflects security posture each vulnerability calculate Loss Expectancy, impact estimator. Data from open source databases results predicted as input Security take into account innate characteristics incorporated calculation The result this model assessment threats ranking these metric calculation.