Moving beyond probabilities – Strength of knowledge characterisations applied to security. (March 2017)

• Record Type: Journal Article
• Authors: Askeland, Tore; Flage, Roger; Aven, Terje
• Is Part Of: Reliability engineering & system safety. Volume 159(2017)
• Page Start: 196
• Page End: 205
• Publication Date: 2017-03
• Subjects: Risk assessment -- Security -- Probability -- Strength of knowledge; Reliability (Engineering) -- Periodicals; System safety -- Periodicals; Industrial safety -- Periodicals; Fiabilité -- Périodiques; Sécurité des systèmes -- Périodiques; Sécurité du travail -- Périodiques; 620.00452
• DOI: 10.1016/j.ress.2016.10.035
• Languages: English
• ISSNs: 0951-8320

Abstract

Abstract: Many security experts avoid the concept of probability when assessing risk and vulnerabilities. Their main argument is that meaningful probabilities cannot be determined and they are consequently not useful for decision-making and security management. However, to give priority to some measures and not others, the likelihood dimension needs to be addressed in some way; the question is how. One approach receiving attention recently is to add strength of knowledge judgements to the probabilities and probability intervals generated. The judgements provide a qualitative labelling of how strong the knowledge supporting the probability assignments is. Criteria for such labelling have been developed, but not for a security setting. The purpose of this paper is to develop such criteria specific to security applications and, using some examples, to demonstrate their suitability. Highlights: The concept of probability is often avoided in security risk assessments. We argue that the likelihood/probability dimension needs to be somehow addressed. Probabilities should be supplemented by qualitative strength-of-knowledge scores. Such criteria specific to security applications are developed. Two examples are used to demonstrate the suitability of the suggested criteria.