Management is required to understand all information security risks within an organization, and to make decisions on which information security risks should be treated in what level by allocating how much amount of cost. However, such decision-making is not usually easy, because various measures for risk treatment must be selected with the suitable application levels. In addition, some measures may have objectives conflicting with each other. It also makes the selection difficult. Therefore, this paper provides a model which supports the selection of measures by applying multi-objective analysis to find an optimal solution. Additionally, a list of measures is also provided to make the selection easier and more effective without any leakage of measures. Keywords—Information security risk treatment, Selection of risk measures, Risk acceptance and Multi-objective optimization.
[1]
Masakatsu Nishigaki,et al.
A modeling of security measure selection problem
,
2003
.
[2]
Tadanori Mizuno,et al.
A Practical Approach for Security Measure Selection Problem and Its Availability
,
2004
.
[3]
Carlos E. Otero,et al.
A MULTI -CRITERIA EVALUATION OF INFORMATION SECURITY CONTROLS USING BOOLEAN FEATURES
,
2010
.
[4]
Ryoichi Sasaki,et al.
An Optimal Decision Method for Establishment of Security Objectives
,
2000
.
[5]
Rossouw von Solms,et al.
A Formalized Approach to the Effective Selection and Evaluation of Information Security Control
,
2000,
Comput. Secur..