A New Approach to Improve Accuracy in Information Security Risk Management
Víctor Leonel Orozco López, Raul Ceretta Nunes · International Conference on the Digital Society · 2014
Risk management constitutes a basis for decision making in a business continuity plan, since it creates a view that allows to identify and control risks that can compromise the assets of a given organization. Despite the existence of several methodologies to estimate the severity of these threats, preview evidence has demonstrated that the presence of human data sources for risk analysis can produce biased results, thus compromising the business continuity as a result of wrong-guided investments. In this work, we present an approach that reduces human biases by weighting risk evaluations using a reliability level of the sources, based on risk treatment performance. The experiments showed that the usage of reliability scores can effectively increase the accuracy of risk estimation, becoming a tool to minimize and/or eliminate those data sources that provoke the deviation of risk assessment results. Keywords–Business continuity; security; risk assessment; accuracy; decision making