Security Risk Assessment: Towards a Justification for the Security Risk Factor Table Model

One of the widely used methods to gauge risk is the Security Risk Factor Table (SRFT) model. While this model has been empirically successful, its use is limited by the fact that its formulas do not have a theoretical explanation – and thus, there is no guarantee that these formulas will work in other situations as well. In this paper, we provide a theoretical explanation for the SFRT formulas. 1 Formulation of the Problem Security Risk Factor Table (SRFT) model: a brief description. Many systems face security risks. To properly protect these systems, it is important to gauge relative security risk of different systems, so that more resources will be used to protect systems with higher risk. One of the widely used techniques for gauging risk is the Security Risk Factor Table (SRFT) model; see, e.g., [1, 2, 3, 4]. In this model, important factors affecting risk are listed, such as location, visibility, inventory, etc. For each factor, experts estimate the risk corresponding to this factor by selecting a number from 0 to 5, 0 meaning lowest risk and 5 meaning highest risk. Numbers corresponding to different factors are then added into a single risk score. Based on the value of the risk score, the system’s risk is then classified into low, moderate, high, and extreme. For example, for 15 factors: • scores below 15 indicate low risk; • scores from 16 to 30 indicate moderate risk; • scores from 31 to 45 indicate high risk, and