To main content

Experiences from using indicators to validate expert judgments in security risk analysis

Abstract

Expert judgments are often used to estimate likelihood values in a security risk analysis. These judgments are subjective and their correctness rely on the competence, training, and experience of the experts. Thus, there is a need to validate the correctness of the values obtained from expert judgments. In this paper we investigate to what extent indicators based on historical data may be used to validate likelihood values obtained from expert judgments. We report on experiences from a security risk analysis where indicators were used to validate likelihood values obtained from expert judgments. The experiences build on data collected during the analysis and on semi-structured interviews with the client experts that participated in the analysis.

Category

Academic chapter/article/Conference paper

Language

English

Author(s)

Affiliation

  • University of Oslo
  • SINTEF Digital / Software and Service Innovation

Year

2012

Publisher

IEEE

Book

Proceedings 2011 Third International Workshop on Security Measurements and Metrics Metrisec 2011

ISBN

978-0-7695-4680-3

Page(s)

88 - 95

View this publication at Cristin