A Cost / Benefit / Risk ( CBR ) Analysis Methodology and its Application in a Computing System

This paper describes a compound cost/benefit/risk (CBR) analysis methodology and its application in a Computing System for assessing the security threats, vulnerabilities and suggests corrective actions. These factors are analyzed, evaluated and presented in a practical meaningful perspective. The Decision Making Factor which justifies the selection of corrective action with respect to related risk is also calculated. The priority ranking of risk is defined in terms of the likely Consequences of the threat, the Frequency of Exposure of threat and the Probability of threat sequence completion and the Correction Value is defined on the effectiveness and cost of applied counter measures. The methodology employs a mathematical technique that combines both objective and subjective approaches to classical risk analysis.