A geometric approach to the acceptable risk probabilities estimation of information security - Мохор, Владимир Владимирович; Бакалинский, Александр Олегович; Цуркан, Василий Васильевич (Ukrainian Information Security Research Journal, 2016)
Construction and usage of the information security management system based on a risk-oriented approach is considered. At the same time nonconstructivity of project requirements for the construction of such sys-tems by «ensuring the level of risk no higher than acceptable» is defined. In order to overcome this limit proposed to review the functioning of an information security management system as a queuing system with processing the flow of risk events with levels of risk that higher than acceptable and a defined probability of such events occurrence. The solution to this problem is realized by the use of concepts and methods of geometrical probability. With this approach the subjective indicator of risk owner risk-appetite, displayed in the form of acceptable level of risk is transformed into a formalized probabilistic criterion, on which is possible to formulate verifiable requirements for the establishment of information security management systems