The qualitative and quantitative method of information security risk assessment - Корченко, Александр Григорьевич; Казмирчук, Светлана Владимировна (Ukrainian Information Security Research Journal, 2016)
The basis of information security management system (ISMS) is the processes of analysis and risk assessment. The known methods of analysis and risk assessment based on expert assessments are applied for their imple-mentation. Often in the process of assessment there are situations when the expert cannot always clearly deter-mine a particular vulnerability of Information Systems Resources (ISR). Therefore, it is advisable to use the cor-responding database vulnerabilities. The existing ap-proaches do not solve the task effectively. For this pur-pose, the qualitative and quantitative method of risk as-sessment is offered. It, in contrast to the known methods, through the use of assessments that are available in exist-ing databases, automates the process of risk assessment not involving the experts for this related subject area.