Towards Validating Risk Indicators Based on Measurement Theory (Extended version)

Due to the lack of quantitative information and for cost-efficiency, most risk assessment methods use partially ordered values (e.g. high, medium, low) as risk indicators. In practice it is common to validate risk indicators by asking stakeholders whether they make sense. This way of validation is subjective, thus error prone. If the metrics are wrong (not meaningful), then they may lead system owners to distribute security investments inefficiently. For instance, in an extended enterprise this may mean over investing in service level agreements or obtaining a contract that provides a lower security level than the system requires. Therefore, when validating risk assessment methods it is important to validate the meaningfulness of the risk indicators that they use. In this paper we investigate how to validate the meaningfulness of risk indicators based on measurement theory. Furthermore, to analyze the applicability of the measurement theory to risk indicators, we analyze the indicators used by a risk assessment method specially developed for assessing confidentiality risks in networks of organizations

Towards Validating Risk Indicators Based on Measurement Theory

Due to the lack of quantitative information and for cost-efficiency purpose, most risk assessment methods use partially ordered values (e.g. high, medium, low) as risk indicators.\ud In practice it is common to validate risk scales by asking stakeholders whether they make sense. This way of validation is subjective, thus error prone. If the metrics are wrong (not meaningful), then they may lead system owners to distribute security investments inefficiently. Therefore, when validating risk assessment methods it is important to validate the meaningfulness of the risk scales that they use. In this paper we investigate how to validate the meaningfulness of risk indicators based on measurement theory. Furthermore, to analyze the applicability of measurement theory to risk indicators, we analyze the indicators used by a particular risk assessment method specially developed for assessing confidentiality risks in networks of organizations

How to score alternatives when criteria are scored on an ordinal scale

We address in this paper the problem of scoring alternatives when they are evaluated with respect to several criteria on a finite ordinal scale $E$. We show that in general, the ordinal scale $E$ has to be refined or shrunk in order to be able to represent the preference of the decision maker by an aggregation operator belonging to the family of mean operators. The paper recalls previous theoretical results of the author giving necessary and sufficient conditions for a representation of preferences, and then focusses on describing practical algorithms and examples.ordinal scale, aggregation of scores, mean operator, refinement of scale

Representation of preferences over a finite scale by a mean operator

Suppose that a decision maker provides a weak order on a given set of alternatives, each alternative being described by a vector of scores, which are given on a finite ordinal scale $E$. The paper addresses the question of the representation of this weak order by some mean operator, and gives necessary and sufficient conditions for such a representation, with possible shrinking and/or refinement of the scale $E$.preference representation, finite scale, meanoperator, aggregation of scores, refinement of scale

Transitive matrices, strict preference and intensity operators

Let X be a set of alternatives and a_{ij} a positive number expressing how much the alternative x_{i} is preferred to the alternative x_{j}. Under suitable hypothesis of no indifference and transitivity over the pairwise comparison matrix A= (a_{ij}), the alternatives can be ordered as a chain . Then a coherent priority vector is a vector giving a weighted ranking agreeing with the obtained chain and an intensity vector is a coherent priority vector encoding information about the intensities of the preferences. In the paper we look for operators F that, acting on the row vectors translate the matrix A in an intensity vector

A decade of application of the Choquet and Sugeno integrals in multi-criteria decision aid

The main advances regarding the use of the Choquet and Sugeno integrals in multi-criteria decision aid over the last decade are reviewed. They concern mainly a bipolar extension of both the Choquet integral and the Sugeno integral, interesting particular submodels, new learning techniques, a better interpretation of the models and a better use of the Choquet integral in multi-criteria decision aid. Parallel to these theoretical works, the Choquet integral has been applied to many new fields, and several softwares and libraries dedicated to this model have been developed.Choquet integral, Sugeno integral, capacity, bipolarity, preferences

A new approach for evaluation of risk priorities of failure modes in FMEA

This paper presents a method for carrying out the calculus of the risk priority of failures in Failure Mode and Effect Analysis (FMEA). The novelty of the method consists of new management of data provided by the design team, normally given on qualitative scales, without necessitating an arbitrary and artificial numerical conversion. The practical effects of these issues are shown in an application example