A Probabilistic Estimation Model for Information Systems Security Risk Analysis

In this paper, a probabilistic estimation model for information systems security (ISS) risk analysis based on evidential reasoning approach is presented. The modeling process consists of four phases: specification of the model structure, estimation of evidence strength, computation of beliefs on assertions, and ISS risk monitoring and analysis. Using the changes of strength of evidences obtained in the organization's information systems, the model can continually estimate the probability of risk, and identify the sources of risk. The significance of the work is that the model provides objective and visible support for ISS risk analysis.