A FUZZY EXTENSION OF MAGERIT METHODOLOGY FOR RISK ANALYSIS IN INFORMATION SYSTEMS

摘要

We propose a fuzzy approach to deal with risk analysis for information systems. We extend MAGERIT methodology that valuates the asset dependencies to a fuzzy framework adding fuzzy linguistic terms to valuate the different elements (terminal asset values, asset dependencies as well as the probability of threats and the resulting asset degradation) in risk analysis. Computations are based on the trapezoidal fuzzy numbers associated with these linguistic terms and, finally, the results of these operations are translated into a linguistic term by means of a similarity function.