Group Decision-Making Information Security Risk Assessment Based on AHP and Information Entropy

The phenomenon of over-reliance on subjective assignment is a challenging task in the information security risk assessment process. This study deals with this problem. We have presented a group decisionmaking information security risk assessment method by combining Analytic Hierarchy Process (AHP) with Information entropy. When AHP is used to assess the security risk of information systems, the elements of the Criteria level are the risk probability, impact and uncontrollability. The priorities of the Alternatives as risk factors with respect to the Criteria level are determined by applying the group decision-making approach. And the experts’ weights are obtained through information entropy. The experts’ judgments are aggregated into a consensus matrix. The consensus matrix reduces the subjectivity of judgments due to the experts’ preferences.