Effective methodology for security risk

assessment of computer systems

Daniel F. García, Adrián Fernández

Abstract—Today, computer systems are more and more complex II. RELATED WORK
and support growing security risks. The security managers need to
Many methods have been proposed in the literature to
find effective security risk assessment methodologies that allow
modeling well the increasing complexity of current computer systems evaluate the risks suffered by a computer system and they have
but also maintaining low the complexity of the assessment procedure. been compared, directly [1] and using frameworks [2].
This paper provides a brief analysis of common security risk There are methods that are very generic, in fact they are
assessment methodologies leading to the selection of a proper guidelines for managing information security risks in an
methodology to fulfill these requirements. Then, a detailed analysis organization. A typical example of these guidelines is the
of the most effective methodology is accomplished, presenting
standard ISO/IEC 27005 [3]. Other standards are more
numerical examples to demonstrate how easy it is to use.
specific, providing the typical sequence of activities required
Keywords—Computer security, qualitative and quantitative for risk assessment and risk mitigation, but including also a
methods, risk assessment methodologies, security risk assessment. specific method for determining the risks. An example is the
Risk Management Guide for IT Systems provided by NIST [4]
I. INTRODUCTION that is currently under revision [5].
In the analysis of currently available methods for evaluation
T HE evaluation of security risks in computer systems is
increasingly important because of the steady growth of
security threats. This growth is because the systems are
of security risks, two main categories should be considered:
The many methods proposed by a myriad of researchers that
increasingly interconnected and exchange a greater amount of can be used for specific security problems.
information. Generally, the security risk evaluation methods The few methods developed by national or international
are classified as qualitative and quantitative. institutions that are widely used and they are often supported
The qualitative methods use a scale of qualitative values by computer tools.
(e.g. Low, Medium, High) to represent the value of the assets A. Methods proposed by researchers
and the impacts and risks suffered by them. Many researchers have proposed information security risk
The quantitative methods use a measure of value, e.g. Euros, analysis methodologies. Some methodologies are simple and
to represent the value of the assets of a computer system and very easy to use, like those using matrices to correlate the
also the levels of impact and risk supported by the assets. elements of risk analysis [6]. Other researchers have also used
The main advantage of the quantitative methods is that they very simple models and small tables to manage Information
can provide approximate estimations of the impact provoked Technology security risks [7]. Other methodologies, like
by a threat on an asset in the form of a Single Loss Expectancy ISRAM [8], fill tables with values obtained from multiple
(SLE) and estimations of the risk in the form of Annual Loss interviews and use the values to estimate the risk.
Expectancy (ALE). Other modern methods are even simpler, establishing
There are risk evaluation methodologies that only use a general procedures and using elemental metrics to develop a
qualitative method and others than only use a quantitative security risk assessment [9] [10]. The authors argue that a truly
method. The most interesting methodologies integrate two practical method should be fairly simple.
methods, one qualitative and other quantitative, and therefore, Other approach used to develop security risk assessment
they allow the development of a first preliminary analysis to methods consists in adapting risk management methods from
determine the main risks and a second detailed analysis, other scientific disciplines. Then, some researchers have
probably focused in the most important risks. But, it is highly developed useful methods adapting software risk management
desirable that both methods are based in similar models of the techniques [11]. Other researchers have proposed the
computer system. application of techniques used for accident risk assessment in
In this paper the methods used in common methodologies industrial plants, like Probabilistic Risk Assessment (PRA), to
are briefly analyzed, and later, the methods used in the most the information security risk assessment in computer systems
effective methodology are analyzed deeply. [12]. The similarities are really surprising allowing the
utilization of a methodology in different application domains.
D. F. García is with the University of Oviedo, Department of Informatics, Recently, sophisticated methods for risk assessment based
33204 Gijón (Asturias), Spain (phone: 34-985-182066; fax: 34-985-181986; on neural networks, fuzzy sets and other technologies based on
e-mail: [email protected]).
A. Fernández is with the University of Oviedo. Department of Informatics,
soft computing techniques are appearing [13]-[15].
33204 Gijón (Asturias), Spain. (e-mail: [email protected]).
 B. Methods proposed by institutions & companies much better than the other methodologies analyzed in this
In this category, methods as NIST 800-30, OCTAVE, research work.
Mehari, Microsoft's Security Management Guide and Magerit The rest of this paper presents the essence of the two
can be considered. security risk assessment methods supported by Magerit,
The methodology proposed by NIST is qualitative using 5 providing numerical examples to illustrate their utilization.
descriptors (very low, low, moderate, high, very high) to The main objective is to show the real power and simplicity of
characterize the impact and also the same 5 descriptors to this little-known methodology and to bring awareness between
characterize the likelihood of the impact. It also provides a security professionals.
table for translating these descriptors in numbers in a scale
from 0 to 10 to carry out a semi-quantitative analysis. This III. QUALITATIVE METHOD
method provides general rules and requirements for system The aim of the qualitative method is to provide a qualitative
characterization, but it does not provide a specific model to comparison of the risks suffered by the assets of a computer
characterize the assets and their interrelations. system in a predefined value scale. Therefore, a scale of
The OCTAVE [16] (Operationally Critical Threat, Asset symbolic value levels is defined by (1).
and Vulnerability Evaluation) methodology was developed by
V = { ..., v0, v1, ..., vi, ... } (1)
the Software Engineering Institute of Carnegie Mellon
University. This methodology is quite generic, like Each asset must receive a value of this scale in each
ISO/IEC 27001/27005 and the analysis method is qualitative, dimension of security: confidentiality, Integrity and
trying to find the most relevant risks to treat them first. In fact, Availability (CIA).
it is mainly used as a prioritization tool for the risks supported
A. Dependencies between the assets
by an organization.
Mehari is a methodology proposed by the Club de la But the assets are not independent entities. Generally, there
Sécurité de l’Information Français (CLUSIF). The risk are dependencies between the assets.
analysis method [17] is qualitative, and the risk (seriousness in This qualitative method only considers the presence of a
Mehari terminology) is represented in a scale from 1 to 4. In dependency and not the level of the dependency. If an asset A
Mehari, the classification of assets [18] is done in three depends on other asset B, (2) express the dependency.
domains linked between them. An Excel book with multiple A→B (2)
spreadsheets provides support for this classification and the
posterior risk analysis process. Nevertheless, there is not a Of course, the dependency can be transitive, when an asset
clear model that represents the interrelations between the A depends on B and B depends on C, which can be expressed
domains. This could be understood because Mehari works as: (A→B) Λ (B→C). In this case, A depends on B directly
mainly with groups or types of assets. and A depends on C indirectly though B.
Microsoft's Security Risk Management Methodology [19] The dependencies can be more complex. A typical example
follows a hybrid approach. Firstly, a qualitative method is used is (3) when A depends on B1 and B2 and Bi depend on C.
to quickly prioritize the entire list of security risks. Then, the (A→B1) Λ (A→B2) Λ (B1→C) Λ (B2→C) (3)
most important risks identified in the first phase are evaluated
in more detail using a quantitative method. These dependencies can be represented by a graph. Fig. 1
Basically, all the methods reviewed consider each asset show two examples of this type of graphs.
independently, evaluating the impact and likelihood of threats
over the asset. Essentially, the model is a list of assets and
there is a lack of a clear definition of the possible interrelations A A
between the assets and how these interrelations affect to the
risk supported by any of the assets of the computer system.
Finally, Magerit [20] is a methodology promoted by the
Spanish Ministry for Public Administrations. It must be used B B1 B2
by Spanish public administrations, but it can also be used by
public and private corporations.
The assessment methods used by this methodology allow
the characterization of dependencies between assets. In the C C
qualitative method, the dependencies are Boolean (exist or not
exist), but in the quantitative method, the dependencies are a Fig. 1 Dependency graphs between assets
real number between 0.0 (no dependency) and 1.0 (total
dependency). The set of assets that depend on B, directly or indirectly, is
This methodology allows the representation of the relations denominated Superior of B, SUP(B). These assets are above B
that always exist between the assets of a computer system in the graph. Equation (4) represent this set.
 SUP(B) = { Ai, Ai →B } (4) There is an element, fn, that represent the "normal
frequency". In an annual risk analysis, the value fn refers to
The concept of dependency allows the definition of the
"once a year".
accumulated value over an asset.
Informally, we say that a threat has "j frequency points" to
B. Accumulated value over an asset indicate that its frequency is fj.
The accumulated value over an asset B is defined as the G. Risks
highest value among B and the assets Ai included in the set
The risks values are represented in the same scale used to
SUP(B). Equation (5) represent this value.
represent the value of the assets. The risk is a function, R, of
Acc_Val(B) = MAX [ Val(B), maxi{ Val(Ai) } ] (5) the impact and the frequency defined by (9).
Risk = R(impact, frequency) (9)
C. Degradation of the value of an asset
When an asset is victim of a threat, it loses part of its value. The function R must verify the following requirements:
A subjective percentage of degradation must be estimated to 1) It must grow with the impact (10).
characterize the loose of value. Then, the degradation will be a ∀ fj R(vi, fj) < R(vi+1, fj) (10)
value between 0.0 (0% degradation) and 1.0 (100%
degradation). 2) It must grow with the frequency (11).

D. Accumulated impact of a threat on an asset ∀ vi R(vi, fj) < R(vi, fj+1) (11)
The accumulated impact of a threat on an asset is the loose 3) It must generate a negligible risk for a negligible impact
of accumulated value of the asset. If an asset has an and a normal frequency (12).
accumulated value of vx and it is degraded by a proportion d,
(6) provides an estimation of the value of the impact. R(v0, fn) = v0 (12)

Impact i = vROUND(x·d) (6) A very simple function that fulfills these properties is
defined by (13).
When the impact is reduced to v0, it can be considered as
negligible. R(vi, fj) = vi+j-n (13)

E. Deflected impact of a threat on an asset Any risk that takes a value v0 or less will be considered
negligible.
If an asset A depends on other asset B, any threat to B will
Two different types of risk can be calculated as a function of
also affect A. Fig. 2 illustrate this situation.
• The accumulated risk that is calculated with the
the value considered for the assets:

A
• The deflected risk that is calculated with the deflected
accumulated impact over the asset.

impact over the asset.

Threat H. Security controls
B
A set of security controls is deployed against a threat. The
controls have efficiency, e, reducing the degradation of the
Fig. 2 Deflected impact of a threat on an asset
asset provoked by the threat. The efficiency e is a value
between 0.0 (no protection) and 1.0 (full protection).
If B suffers a degradation d, A will suffer the same
Furthermore, the efficiency e can be decomposed in an
degradation loosing value. If the asset A has a value vx the
efficiency against the impact, ei, and an efficiency against the
impact will be calculated by using (7).
frequency, ef.
defected impact di = vROUND(x·d) (7)
I. Residual degradation
F. Frequency of threats The effect of security controls is reducing the degradation
suffered by an asset. If the asset, without protection, could
In this qualitative method the frequency of threats must be
suffer degradation d, thanks to controls, the degradation is
characterized by a scale of symbolic values, as defined by (8).
reduced to a residual value rd, calculated using (14).
F = { ..., f0, f1, ..., fj, …} (8)
rd = d x (1-ei) (14)
The series of frequency values must verify the following i
where e is an estimation of the efficiency of controls to
properties:
reduce the degradation of the asset, that is, limiting the impact
There is a total order: fj < fj+1.
on the asset. The values of ei are in the following range:
There is an element, f0, which represents the "negligible
ei = 0.0, then: rd = d (useless controls)
frequency".
 ei = 1.0, then: rd = 0 (perfect controls) • Estimation of the efficiency of the controls, expressed as
a percentage.
J. Residual impact
When an asset is protected by security controls suffers a IV. QUALITATIVE NUMERICAL EXAMPLE
residual impact, which can be calculated just like the impact,
but using the residual degradation, calculated by (15). This example has two assets, A and B. The value of the
assets, the impacts and risks suffered will be valued in the
residual_impact = VROUND(x·rd) (15) scale V = { v0, v1, ..., vi, ..., v10 }, where v0 represents a
A set of perfect security controls reduces the impact to a negligible value.
negligible value v0. If the controls are not enough, the impact The value of asset A is v8 and the threat TA provokes a
will remain noticeably. degradation on A of d(A)=70%.
The value of asset B is vB (irrelevant in this example) and
K. Residual frequency the threat TB provokes a degradation of B of d(B)=35%.
The second effect of a security control is to reduce how The asset A depends on B. Therefore any degradation
often a threat gets to attack an asset successfully exploiting a suffered by B is also directly deflected to A.
vulnerability. Similarly to the case of impact, the frequency of The frequency of the threats is represented in the discrete
the threat to the asset is reduced to a residual value. If the scale F = { f0, f1, ..., fj, ..., f5 }, where f0 represents a negligible
frequency was fj, now with controls, the residual frequency is frequency. The normal frequency, fn, is in this example f3.
defined by (16). The frequency of TA is f2.
The frequency of TB is f4.
residual_frequency = fk where k = ROUND( j·(1-ef) ) (16)
where ef is the efficiency of the security controls reducing With these data, the method allows the estimation of
the frequency of the threat. The value of ef is in the range: impacts (direct and deflected) using (18) and (19).
ef = 0.0, then fk=fj (useless controls)
impact = vROUND(8 x 0.7) = v6 (18)
ef = 1.0, then fk=f0 (perfect controls)
deflected impact = vROUND(8 x 0.35) = v3 (19)
L. Residual risk
Finally, the residual risk is calculated using (17) which Now, the risks (direct and deflected) can be estimated by
combines the residual impact and the residual frequency using (20) and (21) combining the impacts with their frequencies
the function R defined previously. using the function R(vi,fj) = vi+j-n defined previously.

residual risk = R(residual impact, residual frequency) (17) risk = R(v6,f2) = v6+2-3 = v5 (20)

In this qualitative method, a relative value has been assigned deflected risk = R(v3,f4) = v3+4-3 = v4 (21)
to each asset selected from a scale defined previously. A value The results of the method for the risk assessment are
v0 has been chosen as the boundary between the significant presented in Fig. 3 in a graphical manner. The value of the
values and those that are negligible. asset A, v8, is represented with a green bar. When the asset A
On this scale of value has been measured both, the value of suffers the impact of the threat TA loses 6 units of value, v6,
the asset (basic or accumulated), as the impact of a threat when and when the asset A suffers the impact of the threat TB loses 3
it occurs, and the risk suffered by the asset. units of value, v3. Therefore, the yellow bars of fig. 3 represent
While the impact measures the potential loss of value, the the part of the green bar that is lost due to the degradation
risk weights that impact with the estimated frequency of provoked by the threats.
occurrence of the threat. The impact is the measure of the cost
if the threat occurs once while the risk measures the exposure
in a given period of time. 10
The estimates of residual impact and residual risk 9 value
incorporate the efficiency of security controls to counteract the 8
threat, either by limiting the impact, either by reducing the 7 Impact Risk
frequency. 6
This qualitative method, prior to use, requires a valuation or 5

• Valuation of the assets through a discrete scale of values.

estimation of several magnitudes: 4
3
• Estimation of the degradation caused by the threats
Deflected

Deflected

2
d f
Direct

Direct

1
• Estimation of the frequency of occurrence of each threat
expressed as a percentage.
0

• Selection of a set of security controls.

expressed in a discrete scale of frequencies.
Fig. 3 Visualization of risk assessment results
 Then, the frequency f of the threats is used to transform the To calculate the degree of dependency of an asset A from
impact values in risks values. Due to the frequency of the other asset C, the expression (30) is used.
degree(A→C) = ∑i {degree(A→Bi) x degree(Bi→C)} (30)
thread TA is one unit lower than the normal frequency, the
impact value is reduced in one unit to generate the risk. On the
contrary, as the frequency of the threat TB is one unit higher where the sums are carried out as defined by (31).
than the normal frequency, the deflected impact is increased in
p + q = 1- (1-p) x (1-q) (31)
one unit to generate the deflected risk. Both risks are
represented by red bars in Fig. 3. The set of assets that depend on B, directly or indirectly, is
In order to reduce the risks, a set of security controls are denominated Superior of B, SUP(B).
selected to reduce the impact and the frequency of threats.
The control for TA has an efficiency against the impact of
ei=0.5 and against the frequency of ef=0.6. A A
The control for TB has an efficiency against the impact of
ei=0.4 and against the frequency of ef=0.8. 60% 100% 80%

Firstly, the direct residual risk suffered by the asset A as a B B1 B2

consequence of the threat TA is calculated by (22)−(25).
30% 40% 30%
residual deg(A) = d(A) x (1-ei) = 0.7 x (1-0.5) = 0.35 (22)
residual impact = vROUND(8 x 0.35) = v3 (23) C C
residual frequency = fROUND(2 x (1-0.6)) = f1 (24)
Fig. 4 Dependency graphs between assets
residual risk = R(res_i, res_f) = R(v3, f1) = v3+1-3 = v1 (25)
B. Accumulated value over an asset
Secondly, the residual deflected risk suffered by the asset A
as a consequence of the threat TB is calculated by (26)−(29). The accumulated value over an asset B is defined by (32) as
the addition of the own value of the asset plus the sum of the
residual deg(B) = d(B) x (1-ei) = 0.35 x (1-0.4) = 0.21 (26) values of the superior assets, weighted by the degree of
residual deflected impact = vROUND(8 x 0.21) = v2 (27) dependency.

residual deflected frequency = fROUND(4 x (1-0.8)) = f1 (28) Acc_Val(B) = Val(B) + ∑i {Val(Ai) x degree(Ai→B)} (32)

residual deflected risk = R(res_di, res_df) C. Degradation of the value of an asset

= R(v2, f1) = v2+1-3 = v0 (29) When an asset is victim of a threat, it suffers a degradation
that is characterized by a value between 0.0 (0% degradation)
V. QUANTITATIVE METHOD and 1.0 (100% degradation).
The aim of the quantitative method is to provide an D. Accumulated impact of a threat on an asset
estimation of the risks suffered by the assets expressing the The accumulated impact of a threat on an asset is the loose
risks in real numeric values (euro, dollar). of accumulated value of the asset. If an asset has an
The value of any asset in a specific dimension of security accumulated value v and it is degraded by a proportion d, the
(CIA) is a real value higher than zero. A specific value, v0, is value of the impact is defined by (33).
defined as the limit between negligible and relevant values.
impact i = v x d (33)
A. Dependencies between the assets
The concepts of dependency between assets defined for the When the impact is less than v0 is considered negligible.
qualitative method are also applied here. But as the E. Deflected impact of a threat on an asset
quantitative method should be more precise, the concept of If an asset A depends on other asset B, any threat to B will
dependency is refined. In the qualitative method the also affect A. Fig. 2 illustrated this situation.
dependency between two assets is a binary property. In the If B suffer a degradation d, A will suffer the degradation in
quantitative method the dependency is characterized by a the proportion of its dependence on B. If the asset A has a
coefficient between 0.0 (independent assets) and 1.0 (totally basic value v, the deflected impact is calculated by (34).
dependent assets). The coefficient is called "degree of
dependency". deflected impact di = v x d x degree(A→B) (34)
These dependencies can be represented by a graph. The
degree of direct dependency between two assets is represented F. Frequency of threats
by a percentage on the arrow that connects the two assets. In this quantitative method the frequency of threats is a real
Fig. 4 represents two examples of this type of graphs. value greater than zero. A value, f0, is established as the
"negligible frequency", below which the threat is irrelevant. In this quantitative method, a numerical value has been
assigned to each asset and a value v0 has been chosen as the
G. Risks
boundary between the significant and negligible values.
The risks is a real value greater than zero that is calculated The method provide estimations of the impact and risk
directly by (35). suffered by the assets. While the impact measures the potential
Risk = impact x frequency (35) loss of value, the risk weights that impact with the estimated
frequency of occurrence of the threat. The impact is the
Any risk that takes a value v0 or less will be considered measure of the cost if the threat occurs once while the risk
negligible. measures the exposure in a given period of time.
Two different types of risk can be calculated as a function of The method also calculates estimations of residual impact

• The accumulated risk that is calculated with the

the value considered for the assets: and residual risk, which incorporate the efficiency of security
controls to counteract the threat, either by limiting the impact,

• The deflected risk that is calculated with the deflected

accumulated impact over the asset. either by reducing the frequency.
If the valuation of the asset is economic (the monetary cost
impact over the asset. derived of its complete loss) the estimated risk is the amount
H. Security controls which has to be planned as annual losses. Therefore, the
quantitative method allows a direct comparison between the
A set of security controls is deployed against a threat. The
cost of controls and the reduction of losses.
controls have an efficiency, e, reducing the degradation of the
This quantitative method, prior to use, requires a valuation
asset provoked by the threat. The efficiency e is a value

• Valuation of the assets by numerical quantities.

or estimation of several magnitudes:
between 0.0 (no protection) and 1.0 (full protection).

• Defining dependencies between assets using percentages.

Furthermore, the efficiency e can be decomposed in an

• Estimation of the degradation caused by the threats

efficiency against the impact, ei, and an efficiency against the
frequency, ef. The decomposition verifies (36).
(1 − e) = (1 − ei) x (1− ef) • Estimation of the frequency of occurrence of each threat
expressed as a percentage.
(36)

• Selection of a set of security controls.

expressed as numerical values.
I. Residual degradation
The security controls reduce the degradation d suffered by • Estimation of the efficiency of the controls, expressed as
an asset to a residual value rd calculated by (37). a percentage.
rd = d x (1-ei) (37)
VI. QUANTITATIVE NUMERICAL EXAMPLE
i
where e is an estimation of the efficiency of controls to
This example uses the same assets, A and B, of the previous
reduce the degradation of the asset.
example. The only differences are: the value of the asset A is
J. Residual impact 10000. The frequency of the threat TA is 0.5 and the frequency
When an asset is protected by security controls suffers a of the threat TB is 2. The degree of dependency of A from B is
residual impact, which can be calculated by (38), just like the of 30%. With these data, the quantitative method estimates the
impact, but using the residual degradation. impacts (direct and deflected) using (41) and (42).

residual_impact = v x rd = v x d x (1-ei) (38) Impact i = vA x d(A) = 10000 x 0.7 = 7000 (41)

A set of perfect security controls reduces the impact to a Deflected impact di = vA x d(B) x degree(A→B) =
negligible value v0. 1000 x 0.35 x 0.3 = 1050 (42)

K. Residual frequency Now, the risks (direct and deflected) can be estimated with
A security control can also reduce the frequency with which (43) and (44) multiplying the impacts by the frequencies.
a threat can exploit a vulnerability to attack an asset with risk r = i x f(TA) = 7000 x 0.5 = 3500 (43)
success. Then, the frequency of the threat to the asset is
deflected risk dr = di x f(TB) = 1050 x 2 = 2100 (44)
reduced to a residual value calculated by (39).
In order to reduce the risks, the same set of security controls
residual_frequency = frequency x (1-ef) (39)
used in the previous example is selected to reduce the impact
L. Residual risk and the frequency of threats.
The control for TA has an efficiency against the impact of
Finally, the residual risk is calculated by (40) multiplying
e =0.5 and against the frequency of ef=0.6.
i
the residual impact by the residual frequency.
The control for TB has an efficiency against the impact of
residual risk = residual impact x residual frequency (40) ei=0.4 and against the frequency of ef=0.8.
 Firstly, the direct residual risk suffered by the asset A as a [7] D. Gilliam “Managing Information Technology Security Risk,” in Proc.
Int. Symposium on Software Security, Tokyo, Japan, 2003, LNCS-2004
consequence of the threat TA is calculated by (45)−(48). vol. 3233, pp. 296-317.
[8] B. Karabacaka, and I. Sogukpinar “ISRAM: Information Security Risk
residual degradation rd(A) = d(A) x (1-ei) Analysis Method,” Computers & Security, vol. 24, pp. 147-159, 2005.
= 0.7 x (1-0.5) = 0.35 (45) [9] A. Asosheh, B. Dehmoubed, and A. Khani “A new quantitative
approach for information security risk assessment,” in Proc. IEEE
residual impact ri = vA x rd(A) Intelligence and Security Informatics Conference, Richardson (Dallas),
= 10000 x 0.35 = 3500 (46) TX, USA, 2009.
[10] D. V. Bernardo, B. B. Chua, and D. Hoang “Quantitative Security Risk
f
residual frequency rf = f(TA) x (1-e ) Assessment (SRA) Method: An empirical case study,” in Proc. World
= 0.5 x (1-0.6) = 0.2 (47) Congress on Nature & Biologically Inspired Computing, Coimbatore,
India, 2009, pp. 972-977.
residual risk rr = ri x rf = 3500 x 0.2 = 700 (48) [11] H. P. In, Y-G. Kim, T. Lee, C.-J. Moon, Y. Jung, and I. Kim “A Security
Risk Analysis Model for Information Systems,” in Proc. 3rd Asian
Secondly, the deflected residual risk suffered by the asset A Simulation Conference on Systems Modeling and Simulation: theory
and applications, LNAI vol. 3398, pp. 505-513, 2005.
as a consequence of the threat TB is calculated by (49)−(52). [12] N. Satoh, and H. Kumamoto “Analysis of Information Security Problem
i by Probabilistic Risk Assessment,” NAUN International Journal of
residual degradation rd(B) = d(B) x (1-e )
Computers, no. 3, vol. 3, 2009.
= 0.35 x (1-0.4) = 0.21 (49) [13] X. Long, Q. Yong, L. Qianmu “Information Security Risk Assessment
Based On Analytic Hierarchy Process and Fuzzy Comprehensive,” in
res deflected impact rdi = vA x rd(B) x degree(A→B) Proc. Int. Conf. on Risk Management & Engineering Management,
= 10000 x 0.21 x 0.3 = 630 (50) Beijing, China, 2008, pp. 404-409.
[14] D.-L. Liu, and S.-S. Yang “An Information System Security Risk
residual frequency rf = f(TB) x (1-ef) Assessment Model Based on Fuzzy Analytic Hierarchy Process,” in
= 2 x (1-0.8) = 0.4 (51) Proc. Int. Conf. on E-Business and Information System Security,
Wuhan, China, 2009.
res deflected risk rdr = rdi x rf = 630 x 0.4 = 252 (52) [15] Z. Wang, and H. Zeng “Study on the Risk Assessment Quantitative
Method of Information Security,” in Proc. 3rd Int. Conf. on Advanced
Computer Theory and Engineering, Chengdu, China, 2010, vol. 6,
pp. 529-533.
VII. CONCLUSION
[16] C. Alberts, and A. Dorofee, Managing Information Security Risks: The
This paper shows an analysis of most common OCTAVE Approach. Boston, USA: Addison Wesley, 2002.
methodologies used to assess the information security risks [17] CLUSIF, MEHARI - Risk Analysis and Treatment Guide, Paris, France:
Club de la Sécurité de l'Information Français, 2010.
supported by computer systems. The results of the analysis [18] CLUSIF, MEHARI - Stakes Analysis and Classification Guide, Paris,
show that most of methodologies are too simple and do not France: Club de la Sécurité de l'Information Français, 2010.
consider interrelations between assets explicitly. However, [19] MICROSOFT, The Security Risk Management Guide, Microsoft
Solutions for Security and Compliance and Microsoft Security Center of
these interrelations always exists in the real computer systems. Excellence, 2006.
The Magerit methodology, illustrated in detail in this paper, [20] F. Lopez, M. A. Amutio, J. Candau, and J.A. Mañas, MAGERIT V2
represents these interrelations using graphs and provides Book I - The Method. Madrid, Spain: Ministerio de Administraciones
Publicas, 2006.
support for a simple but effective qualitative and quantitative
risk analysis considering the interrelations. This paper shows Daniel F. Garcia became a Member of IEEE in 1994. he was born in Gijón
that the Magerit methodology has a great capability to (Spain) in 1959. He obtained the degree of Industrial Engineering (specialized
in electronics) by the University of Zaragoza, Spain, in 1983. Later, he
represent complex computer systems and it is very easy to use.
obtained the PhD by the University of Oviedo, Spain, in 1988. He joined the
University of Oviedo in 1983, where he has developed all his work until
REFERENCES today. Since 1994 he leads the area of computer engineering at the University
of Oviedo. During the last 20 years, he has developed many projects of basic
[1] A. Syalim, Y. Hori, and K. Sakurai “Comparison of Risk Analysis
and applied research, funded by European, national and regional institutions.
Methods: Mehari, Magerit, NIST800-30 and Microsoft’s Security
As result of this research work, he has coauthored 50 articles in journals and
Management Guide,” in Proc. Int. Conf. on Availability, Reliability and
more than 130 papers in conferences and workshops.
Security, Fukuoka, Japan, 2009, pp. 726–731.
[2] A. Vorster, and L. Labuschagne “A Framework for Comparing Different
Adrián Fernández was born in Gijón (Spain) in 1985. He obtained the
Information Security Risk Analysis Methodologies,” in Proc. Annual
degree of Computer Engineering by the University of Oviedo, Spain, in 2011.
Research Conf. of the South African Institute of Computer Scientists
In 2013 he is doing a MSc in Computer Engineering at the University of
and Information Technologists on IT Research in Developing
Oviedo and a MSc in Security of Information Technology and
Countries, Johannesburg, South Africa, 2005, pp. 95–103.
Communications at the Autonomous University of Barcelona. He has also
[3] ISO/IEC, International Standard 27005 on Information Security Risk
worked from 2011 to today as a software engineer in Talento Corporativo,
Management. Geneva, Switzerland: ISO, 2008.
Spain.
[4] G. Stoneburner, A. Goguen, and A. Feringa, Risk Management Guide
for Information Technology Systems. NIST Special Publication 800-30,
US Dep. of Commerce, 2002.
[5] NIST, Guide for Conducting Risk Assessments. NIST Special
Publication 800-30 Revision 1, US Dep. of Commerce, 2011.
[6] S. Goel, and V. Chen “Information Security Risk Analysis – A Matrix-
Based Approach,” in Proc. Information Resource Management
Association (IRMA) Int. Conf., San Diego, CA, USA, 2005.