Information risk: research methods and techniques, models and methods of risk identification - Архіпов, Олександр Євгенійович; Скиба, Андрій Володимирович (Ukrainian Information Security Research Journal, 2013)
Legal documents in the field of information security, information risk assessment methods are considered, including economic-cost models to identify the probability parameters and structure of information risks, and applying these models to analyze investment in information security. Of course, for an adequate assessment of information risks and optimizing investments in information security used approaches and procedures, which are based on existing international standards of information security risk management. Unfortunately, these standards are more conceptual and advisory in nature. Based on this situation, many factors aren’t considered into account, which significantly affects the accuracy and objectivity of risk assessment. Economic-cost approach for analysis of risks, including well-known model of Gordon-Loeb, is focused mainly on the study of optimization aspects of risk management, but virtually eliminates the possibility of considering into account the specificity of these studies, the risk of a real object. It’s suggested that models, which use heuristic cost-motivational mechanisms to determine the parameters and structure of risks. These models allow combining methods of analysis and risk assessment methods, which are set out in international standards, with the possibilities of optimization researches of risk, inherent in the Gordon-Loeb model. In order to ensure more adequacy of these models to requirements of practical application, it’s proposed to input into their structure the psycho - social characteristics of the attacker.