A Case for Knowledge Acquisition in Risk Analysis
Elizabeth Gurrie, Alan B. Tickle, Alison M. Anderson · 1995
It is generally accepted that organisations must give a high priority to protecting their information assets. However, the foundation exercise to this process, risk analysis, is often avoided. Many IT practitioners consider the effort involved in risk analysis does not always lead to a complete and accurate identification of those information assets which need to be protected. 7he difficulties in modelling security knowledge can be parallelled with problems experienced in knowledge modelling in general. 7he knowledge acquisition community has long recognised these obstacles and seeks to develop knowledge acquisition strategies to solve these problems. This paper considers the problems of risk analysis and argues that the application of knowledge acquisition techniques can be used to address these issues.