Title: “Managing Subjectivity in Qualitative Risk Assessment of Communication Networks

Security assessments for communication networks play an important risk management role because they allow risks to be prioritized for mitigation or risk acceptance. Qualitative risk assessments that involve intangible elements require the subjective judgment of the security analyst completing the risk assessment and this may lead to low confidence in the results due to a perception that evaluations will vary, depending upon the analyst or security group completing the assessment. One approach to handling the variability of subjective evaluation is to seek consensus from a group of knowledgeable stakeholders or experts. One formal approach to developing consensus of expert opinion or expert evaluations is the Delphi method. Delphi studies are more common in economic forecasting or health care studies, but are applicable to many fields where intangible elements must be considered in forming expert opinion. A modified Delphi method involving two Delphi exercises is integrated with the ETSI's TIPHON risk assessment methodology to provide a formalized qualitative assessment procedure that should reduce variability and improve confidence in the risk assessment of telecommunications networks. A brief case implementing the proposed methodology is described and implications are considered. The paper concludes with opportunities for further study in this area.