Running the risk IT – more perception and less probabilities in uncertain systems. (10th July 2017)

• Record Type: Journal Article
• Authors: Munteanu, Adrian
• Is Part Of: Information and computer security. Volume 25:Number 3(2017)
• Page Start: 345
• Page End: 354
• Publication Date: 2017-07-10
• Subjects: Risk analysis -- Probability -- Risk -- Risk management; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-07-2016-0055
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: This study aims to argue that in the case of quantitative security risk assessment, individuals do not estimate probabilities as a likelihood measure of event occurrence. Design/methodology/approach: The study uses the most commonly used quantitative assessment approach, the annualized loss expectancy (ALE), to support the three research hypotheses. Findings: The estimated probabilities used in quantitative models are subjective. Research limitations/implications: The ALE model used in security risk assessment, although it is presented in the literature as quantitative, is, in fact, qualitative being influenced by bias. Practical implications: The study provides a factual basis showing that quantitative assessment is neither realistic nor practical to the real world. Originality/value: A model that cannot be tested experimentally is not a scientific model. In fact, the probability used in ISRM is an empirical probability or estimator of a probability because it estimates probabilities from experience and observation.