Modeling Security Risk

摘要

The tragedy of September 11 has heightened awareness of the need to consider security risk as part of an overall system analysis. Many governmental and commercial organizations are now taking steps to explicitly model their security risks. Historically, most of these organizations had avoided the explicit modeling of security risks because of the unique challenges inherent in this effort. This paper discusses some of these challenges and approaches for addressing them. These challenges include identifying relevant targets and threats; modeling threat, vulnerability, and consequence for a scenario; and presenting this information for decision making.