This study develops an alternative methodology for the risk analysis of information systems security (ISS), an evidential reasoning approach under the Dempster-Shafer theory of belief functions. The approach has the following important dimensions. First, the evidential reasoning approach provides a rigorous, structured manner to incorporate relevant ISS risk factors, related countermeasures, and their interrelationships when estimating ISS risk. Second, the methodology employs the belief function definition of risk--that is, ISS risk is the plausibility of ISS failures. The proposed approach has other appealing features, such as facilitating cost- benefit analyses to help promote efficient ISS risk management. The paper elaborates the theoretical concepts and provides operational guidance for implementing the method. The method is illustrated using a hypothetical example from the perspective of management and a real-world example from the perspective of external assurance providers. Sensitivity analyses are performed to evaluate the impact of important parameters on the model's results.

An Information Systems Security Risk Assessment Model Under the Dempster-Shafer Theory of Belief Functions

In this paper, we propose a geometric approach to the theory of evidence based on convex geometric interpretations of its two key notions of belief function (b.f.) and Dempster's sum. On one side, we analyze the geometry of b.f.'s as points of a polytope in the Cartesian space called belief space, and discuss the intimate relationship between basic probability assignment and convex combination. On the other side, we study the global geometry of Dempster's rule by describing its action on those convex combinations. By proving that Dempster's sum and convex closure commute, we are able to depict the geometric structure of conditional subspaces, i.e., sets of b.f.'s conditioned by a given function b. Natural applications of these geometric methods to classical problems such as probabilistic approximation and canonical decomposition are outlined.

/pdf/a-geometric-approach-to-the-theory-of-evidence-1smdp1v1fc.pdf

A Geometric Approach to the Theory of Evidence

In the analysis of the risk associated to rare events that may lead to catastrophic consequences with large uncertainty, it is questionable that the knowledge and information available for the analysis can be reflected properly by probabilities. Approaches other than purely probabilistic have been suggested, for example, using interval probabilities, possibilistic measures, or qualitative methods. In this article, we look into the problem and identify a number of issues that are foundational for its treatment. The foundational issues addressed reflect on the position that "probability is perfect" and take into open consideration the need for an extended framework for risk assessment that reflects the separation that practically exists between analyst and decisionmaker.

/pdf/concerns-challenges-and-directions-of-development-for-the-1r7in0od5b.pdf

Concerns, challenges, and directions of development for the issue of representing uncertainty in risk assessment.

Performing risk analysis can be a challenging task for complex systems due to lack of data and insufficient understanding of the failure mechanisms. A semi quantitative approach that can utilize imprecise information, uncertain data and domain experts' knowledge can be an effective way to perform risk analysis for complex systems. Though the definition of risk varies considerably across disciplines, it is a well accepted notion to use a composition of likelihood of system failure and the associated consequences (severity of loss). A complex system consists of various components, where these two elements of risk for each component can be linguistically described by the domain experts. The proposed linguistic approach is based on fuzzy set theory and Dempster-Shafer theory of evidence, where the later has been used to combine the risk of components to determine the system risk. The proposed risk analysis approach is demonstrated through a numerical example.

Risk analysis in a linguistic environment: A fuzzy evidential reasoning-based approach

Research highlights? We proposed a method to deal with MCDM problem under the framework of Demspter-Shafer evidence theory. ? A new fuzzy evidential MCDM method under uncertain environments is proposed. ? The linguistic variables can be transformed into basic probability assignments. ? Data from different criteria can be combined based on the Demspter rule. Multiple-criteria decision-making (MCDM) is concerned with the ranking of decision alternatives based on preference judgements made on decision alternatives over a number of criteria. First, taking advantage of data fusion technology to comprehensively consider each criterion data is a reasonable idea to solve the MCDM problem. Second, in order to efficiently handle uncertain information in the process of decision making, some well developed mathematical tools, such as fuzzy sets theory and Dempster Shafer theory of evidence, are used to deal with MCDM. Based on the two main reasons above, a new fuzzy evidential MCDM method under uncertain environments is proposed. The rating of the criteria and the importance weight of the criteria are given by experts' judgments, represented by triangular fuzzy numbers. Then, the weights are transformed into discounting coefficients and the ratings are transformed into basic probability assignments. The final results can be obtained through the Dempster rule of combination in a simple and straight way. A numerical example to select plant location is used to illustrate the efficiency of the proposed method.

A new linguistic MCDM method based on multiple-criterion data fusion

Whereas probability theory has been very successful as a conceptual framework for risk analysis in many areas where a lot of experimental data and expert knowledge are available, it presents certain limitations in applications where only weak information can be obtained. One such application investigated in this paper is water treatment, a domain in which key information such as input water characteristics and failure rates of various chemical processes is often lacking. An approach to handle such problems is proposed, based on the Dempster-Shafer theory of belief functions. Belief functions are used to describe expert knowledge of treatment process efficiency, failure rates, and latency times, as well as statistical data regarding input water quality. Evidential reasoning provides mechanisms to combine this information and assess the plausibility of various noncompliance scenarios. This methodology is shown to boil down to the probabilistic one where data of sufficient quality are available. This case study shows that belief function theory may be considered as a valuable framework for risk analysis studies in ill-structured or poorly informed application domains

Risk assessment based on weak information using belief functions: a case study in water treatment

A methodology is proposed for assessing the risk to produce non-compliant potable water, taking into account the quality of the raw water, as well as characteristics of the treatment unit and different failure modes. Belief functions are used to describe expert knowledge of treatment process efficiency, failure rates, latency times and raw water quality. Evidential reasoning provides mechanisms to combine this information and assess the plausibility of non-compliant water production. This approach may be used by treatment plant designers to choose the optimal architecture, given a user-defined level of residual risk.

S. Demotier

Papers

Risk assessment based on weak information using belief functions: a case study in water treatment

A new approach to assess risk in water treatment using the belief function framework