The Significance of Information Security Risk Assessments - Exploring the Consensus of Raters' Perceptions of Probability and Severity

摘要

Identifying and assessing risks is vital in striving for adequate information security. The basis for the assessments is the probability and the severity of possible incidents affecting the confidentiality, integrity, and availability of information assets. However, assessing the probability and the severity of possible events is not straightforward. The objective of this paper is to explore the consensus of raters assessing the probability and the severity of information security incidents. Data collected through questionnaires are used to evaluate the consensus of 20 raters when assessing 105 information security incidents. The results indicate that the consensus of the raters is too low for the assessment results to provide a sound basis for decisions. In conclusion, better support is needed for assessing information security risks in order to reach the necessary consensus levels.