Risk assessment presentation of information security by the risks map

Abstract

The risk assessment presentation features of information security by the risk maps are considered. In practice, such map is displayed on the coordinate plane. Its axes denote information security risk parameters. This is the risks and the losses magnitude. This determines the acceptability of separate or group information security risks. It is established by choosing the scale of assessment (qualitative, quantitative, or qualitative-quantitative); risk map dimensionality (equal in size, different in size). When used risks maps of information security equally in size and different in size, linguistic rating scales mainly apply (for example, "very low", "low", "medium", "high", "very high"). This approach is limited by the complexity of comparing possible parameters estimates of risk possibility and the losses magnitude. This leads to the difficulty of determining the information security risk assessments acceptability and, as a result, the decision to process them. This limitation is overcome by a combination of linguistic and ordinal scales. The combination of scales allows overcoming the comparing information security risk assessments limitations and establishing clear boundaries on the map. The use of discrete maps with clear (discrete) limits is complemented by color symbols. Acceptable assessments highlight in green, unacceptable in red. The level of acceptability is established by the expert and depends on his knowledge, skills, preparedness, and experience. The adequacy of using discrete information security risk maps is determined by its dimensionality. Therefore, if necessary, it can be increased. On the one hand, it is possible to take into account the intermediate values of the information security risk. On the other hand, it will lead to the enumeration of a large number of pairs (risks, the losses magnitude), difficulties of their perception and the increase in time for deciding whether or not to handle unacceptable information security risks. Thus, the use of discrete maps is limited by the difficulties, firstly, the assessment, comparison and accounting of pairs (the probability of the risks, the losses magnitude). Accounting for these difficulties is possible through the presentation risk assessment of information security by the continuous map.