Аnalysis of information security risk assessment representation methods

Abstract

Methods of resenting information security risk assessments are considered. The method are divided into a tree of risks, a rose (star) and a helix of risks, a risk map and an acceptability risk corridor. The classic tree construction method is used to represent tree risk assessments. Its elements show individual risks or group of risks. The rose (star) and a spiral constructing a use as basis for the circular diagrams. These diagrams reflect the sequence of consideration of information security risks. Due to this, their ranking is carried out in a comparative analysis. Rose (star) displays only one of the parameters of the information security risk among the selected set with the ability to overlay maps with one with different parameters. Therefore, the use of such a presentation method is to build a family of roses (stars) of information security risk assessments. At the same time, the most widespread use of information security risk maps among known methods of their presentation is defined. The risk map represents estimates based on the probability of the threat realization and the amount of losses. Due to the versatility of such a way of representation, it is possible to combine, compare, overlay and integrate information security risk maps. Therefore, common and applied risk maps are segregate among them. A characteristic feature of risk maps of the general type is the presence or absence of a scale of evaluation. In the presence of a scale, the risk value is evaluated qualitatively or quantitatively. While in its absence, the assessment is reduced to the selection of areas of information security risk assessment. For each of the identified areas, the interval values of the probability of the threat realization and the size of the risk are established. Corridor of acceptability of information security risks is set individually for each organization with the most probable estimations. These estimates determine the areas of acceptability of information security risks. Thus, process of analyzing of methods for presenting information security risk assessments by tree, rosy (star), spiral, map and corridor of acceptability allowed to define their advantages and disadvantages. In addition, it allowed to choose the direction of further researches to present information security risk assessments with a risk map.