Information security and risk management

Some measures that consider various aspects of information security risk and propose a methodology that allows decision makers to combine them into a single composite metric, the perceived composite risk (PCR) are discussed. The Analytic Hierarchy Process (AHP) is recommended to determine the weighting factors needed to combine risk measures into the PCR. One of the measures, the expected loss, is calculated by adding together the product of each loss with its respective probability and is conceptually equivalent to the Annual Loss Expectancy (ALE) measure. Another measure, the expected severe loss, focuses on the breaches that would put the survivability of the organization at risks and is calculated by adding together the product of each loss that is greater or equal to the specified threshold loss with its respective probability. Another measure, the standard deviation of loss, represents the dispersion around the expected loss.