CCE Theses and Dissertations
Applying Decision Theory to Quantify the Cost of Network Security Risk
Date of Award
2006
Document Type
Dissertation
Degree Name
Doctor of Philosophy in Information Systems (DISS)
Department
Graduate School of Computer and Information Sciences
Advisor
James D. Cannady
Committee Member
Easwar Nyshadham
Committee Member
Sumitra Mukherjee
Abstract
This research quantifies the maximum potential loss due to a breach of security to help decision makers understand and justify the expenses necessary to properly protect information systems and identify the optimally priced security features that will provide the maximum cost benefit ratio. The purpose is to help assess and reduce the value of risk such that it is as close to zero as possible, where companies are not spending too little or too much on security prevention. The research uses decision analysis, specifically a "decision tree" and "influence diagram" to model the problem, quantify the losses, and gauge the risk associated with network intrusions and security technologies applied to an organization. The model is designed to help decision makers balance the costs of security procedures against the potential costs of internal and external information systems misuse and computer crime whether the attack is intentional or unintentional. The methodology can be used to better plan for the prevention of attacks. The model incorporates sufficient flexibility to accommodate the different risks and associated costs faced by different organizations. The model will help managers understand and justify the expenses necessary to protect information systems properly.
NSUWorks Citation
Cathrine Linnes. 2006. Applying Decision Theory to Quantify the Cost of Network Security Risk. Doctoral dissertation. Nova Southeastern University. Retrieved from NSUWorks, Graduate School of Computer and Information Sciences. (673)
https://nsuworks.nova.edu/gscis_etd/673.