Information security risk assessment and management method in computer networks

We suggested a method for quantitative information security risk assessment and management in computer networks. We used questionnaires, expert judgments, fuzzy logic and analytic hierarchy process to evaluate an impact and possibility values for specific threats. We suggested fuzzy extension of Common Vulnerability Scoring System for vulnerability assessment. Fuzzy prediction rules are used to describe expert's knowledge about vulnerabilities.