Multi-attribute risk assessment
Multi-attribute risk assessment
复制标题
DOI：
--
复制
发表时间：
2002-10
期刊：
影响因子：
--
通讯作者：
S. Butler;P. Fischbeck
中科院分区：
文献类型：
--
作者：
S. Butler;P. Fischbeck
最佳实践规定安全要求基于风险评估；然而，在面临资源限制（例如时间、金钱）时，导致风险清单或场景集的简单化风险评估无法提供足够的信息来确定需求的优先顺序。多属性风险评估为系统地开发定量风险评估提供了一个方便的框架，安全经理可以使用该框架来确定安全需求的优先级。本文介绍了一个多属性风险评估流程以及两个行业案例研究的结果，这两个行业案例研究使用该流程来识别风险并确定风险的优先级。
Best practice dictates that security requirements be based on risk assessments; however, simplistic risk assessments that result in lists of risks or sets of scenarios do not provide sufficient information to prioritize requirements when faced with resource constraints (e.g., time, money). Multi-attribute risk assessments provide a convenient framework for systematically developing quantitative risk assessments that the security manager can use to prioritize security requirements. This paper presents a multi-attribute risk assessment process and results from two industry case studies that used the process to identify and prioritize their risks.