A model for asset valuation in security risk analysis regarding assets' dependencies

Organizations leverage security risk analysis methods to detect and prioritize the security risks. One of the main parameters in risk analysis is assets value which is used to calculate the security impact of probable threats. Although, assets are not independent and their values usually depend to other assets, most of the current approaches do not consider the interdependency of assets in the valuation process. In this paper, a model for asset valuation regarding dependencies between assets is presented. The model is based on a meta-model which dependencies between assets and asset types are well-specified. Then, the value propagation graph is defined to represent the effects of different assets to each other value and then an algorithm is presented to calculate assets value. Finally, the effectiveness of the model is verified by a real case study. The presented approach gains a meta-model to address any dependency between assets in different layers of an organization. Also, use of the value propagation graph assures that all types of assets that affect value of an asset are considered for valuating assets.