An Information Systems Security Risk Assessment Model under the Dempster-Shafer Theory of Belief Functions

T.J. Mock, L. Sun*, R. Srivastava

*Corresponding author for this work

Research output: Contribution to journalArticleAcademicpeer-review

82 Citations (Web of Science)


This study develops an alternative methodology for the risk analysis of information systems security (iss), an evidential reasoning approach under the dempster-shafer theory of belief functions. The approach has the following important dimensions. First, the evidential reasoning approach provides a rigorous, structured manner to incorporate relevant iss risk factors, related countermeasures, and their interrelationships when estimating iss risk. Second, the methodology employs the belief function definition of risk--that is, iss risk is the plausibility of iss failures. The proposed approach has other appealing features, such as facilitating cost- benefit analyses to help promote efficient iss risk management. The paper elaborates the theoretical concepts and provides operational guidance for implementing the method. The method is illustrated using a hypothetical example from the perspective of management and a real-world example from the perspective of external assurance providers. Sensitivity analyses are performed to evaluate the impact of important parameters on the model's results.
Original languageEnglish
Pages (from-to)109-142
Number of pages34
JournalJournal of Management Information Systems
Issue number4
Publication statusPublished - 1 Jan 2006

Cite this