engleski

Development and implementation of metrics for information security risk assessment

Risk assessment is an unavoidable method for information security improvement. Despite that in the assessment process we can find some hesitations. One of them deals with connections among individual metrics for risk assessment with different areas of IT infrastructure into an integral system and its modelling. The problem can be dissolved combining different forms of metrics values, establishing the kind of transforming input data about security state into information about risk value and coordinating risk function with security goal and information resource features. How to develop such a system which will handle differences among IT resources and generate information about risk value in a form which is suitable for decision making is a goal of this paper.

Risk assessment; security metrics

nije evidentirano