An Information Systems Security Risk Assessment Model Under the Dempster-Shafer Theory of Belief Functions
Open accessAbstract
This study develops an alternative methodology for the risk analysis of information systems security (ISS), an evidential reasoning approach under the Dempster-Shafer theory of belief functions. The approach has the following important dimensions. First, the evidential reasoning approach provides a rigorous, structured manner to incorporate relevant ISS risk factors, related countermeasures, and their interrelationships when estimating ISS risk. Second, the methodology employs the belief function definition of risk--that is, ISS risk is the plausibility of ISS failures. The proposed approach has other appealing features, such as facilitating cost- benefit analyses to help promote efficient ISS risk management. The paper elaborates the theoretical concepts and provides operational guidance for implementing the method. The method is illustrated using a hypothetical example from the perspective of management and a real-world example from the perspective of external assurance providers. Sensitivity analyses are performed to evaluate the impact of important parameters on the model's results.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Dempster-Shafer Theory of Belief Functions is used to model uncertainties in the risk assessment process.
“Dempster-Shafer Theory of Belief Functions is used to model uncertainties in the risk assessment process [21].”
From IoT cyber risk: A holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process (2020) · cites this paper as [21]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Judgment under Uncertainty: Heuristics and Biases
Tversky, A., & Kahneman, D. (1975) · Utility, Probability, and Human Decision Making · doi:10.1007/978-94-010-1834-0_8 · Cited by 22,650 · see citing works
A Mathematical Theory of Evidence
Shafer, G. R. (2020) · Princeton University Press eBooks · doi:10.2307/j.ctv10vm1qb · Cited by 11,786 · see citing works
A Generalization of Bayesian Inference
Dempster, A. P. (2008) · Springer eBooks · doi:10.1007/978-3-540-44792-4_4 · Cited by 1,715 · see citing works
Rule-Based Expert Systems: The MYCIN Experiments of the Stanford Heuristic Programming Project
(1986) · Telematics and Informatics · doi:10.1016/s0736-5853(86)80073-9 · Cited by 1,701 · see citing works
Encyclopedia of Artificial Intelligence
Dopico, J. R. R., Dorado, J., & Pazos, A. (2009) · IGI Global eBooks · doi:10.4018/978-1-59904-849-9 · Cited by 1,398 · see citing works
Coping With Systems Risk: Security Planning Models for Management Decision Making1
Straub, D. W., & Welke, R. J. (1998) · MIS Quarterly · doi:10.2307/249551 · Cited by 1,120 · see citing works
The combination of evidence in the transferable belief model
Smets, P. (1990) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/34.55104 · Cited by 1,113 · see citing works
Advances in the Dempster-Shafer theory of evidence
Yager, R. R., Kacprzyk, J., & Fedrizzi, M. (1994) · Iris (University of Trento) · Cited by 1,020 · see citing works
CSI/FBI computer crime and security survey
Power, R. (2001) · Medical Entomology and Zoology · Cited by 928 · see citing works
Suh, B., & Han, I. (2003) · International Journal of Electronic Commerce · doi:10.1080/10864415.2003.11044270 · Cited by 882 · see citing works
Cavusoglu, H., Mishra, B. K., & Raghunathan, S. (2004) · International Journal of Electronic Commerce · doi:10.1080/10864415.2004.11044320 · Cited by 777 · see citing works
Information Systems Management Issues for the 1990s
Niederman, F., Brancheau, J. C., & Wetherbe, J. C. (1991) · MIS Quarterly · doi:10.2307/249452 · Cited by 737 · see citing works
Campbell, K., Gordon, L. A., Loeb, M. P., & Zhou, L. (2003) · Journal of Computer Security · doi:10.3233/jcs-2003-11308 · Cited by 736 · see citing works
Axioms for Probability and Belief-Function Propagation
Shenoy, P. P., & Shafer, G. R. (2008) · Springer eBooks · doi:10.1007/978-3-540-44792-4_20 · Cited by 511 · see citing works
Constructing the Pignistic Probability Function in a Context of Uncertainty
Smets, P. (1990) · Machine intelligence and pattern recognition · doi:10.1016/b978-0-444-88738-2.50010-5 · Cited by 435 · see citing works
Key Information Systems Issues for the 1980’s
Dickson, G. W., Leitheiser, R. L., Wetherbe, J. C., et al. (1984) · MIS Quarterly · doi:10.2307/248662 · Cited by 433 · see citing works
Perspectives on the theory and practice of belief functions
Shafer, G. R. (1990) · International Journal of Approximate Reasoning · doi:10.1016/0888-613x(90)90012-q · Cited by 430 · see citing works
An overview of the design and analysis of simulation experiments for sensitivity analysis
Kleijnen, J. P. C. (2004) · European Journal of Operational Research · doi:10.1016/j.ejor.2004.02.005 · Cited by 327 · see citing works
American Institute of Certified Public Accountants
Williams, V., & Kollar, R. J. (2018) · The SAGE Encyclopedia of Business Ethics and Society · doi:10.4135/9781483381503.n42 · Cited by 309 · see citing works
Preventive and Deterrent Controls for Software Piracy
Gopal, R. D., & Sanders, G. L. (1997) · Journal of Management Information Systems · doi:10.1080/07421222.1997.11518141 · Cited by 294 · see citing works
Key Information Systems Management Issues for the Public Sector1
Caudle, S. L., Gorr, W. L., & Newcomer, K. E. (1991) · MIS Quarterly · doi:10.2307/249378 · Cited by 262 · see citing works
Linear utility theory for belief functions
Jaffray, J. (1989) · Operations Research Letters · doi:10.1016/0167-6377(89)90010-2 · Cited by 256 · see citing works
Password Security: An Empirical Study
Zviran, M., & Haga, W. J. (1999) · Journal of Management Information Systems · doi:10.1080/07421222.1999.11518226 · Cited by 252 · see citing works
Axioms for Probability and Belief-Function Propagation
Shenoy, P. P., & Shafer, G. R. (1990) · Machine intelligence and pattern recognition · doi:10.1016/b978-0-444-88650-7.50019-6 · Cited by 247 · see citing works
SMIS Members: A Membership Analysis
Ball, L. D., & Harris, R. (1982) · MIS Quarterly · doi:10.2307/248752 · Cited by 211 · see citing works
Auditing organizations through a strategic-systems lens : the KPMG Business Measurement Process
Bell, T. B. (1997) · Medical Entomology and Zoology · Cited by 193 · see citing works
1985 Opinion Survey of MIS Managers: Key Issues
Hartog, C. (1986) · MIS Quarterly · doi:10.2307/249189 · Cited by 189 · see citing works
Risk Analysis for Information Technology
Rainer, R. K., Snyder, C. A., & Carr, H. H. (1991) · Journal of Management Information Systems · doi:10.1080/07421222.1991.11517914 · Cited by 182 · see citing works
Decision analysis using belief functions
Strat, T. M. (1990) · International Journal of Approximate Reasoning · doi:10.1016/0888-613x(90)90014-s · Cited by 163 · see citing works
The Dempster-Shafer theory of evidence
Gordon, J., & Shortliffe, E. H. (1990) · Morgan Kaufmann Publishers Inc. eBooks · Cited by 160 · see citing works
Decision Making Under Dempster–Shafer Uncertainties
Yager, R. R. (2008) · Springer eBooks · doi:10.1007/978-3-540-44792-4_24 · Cited by 159 · see citing works
Integration Of Geophysical And Geological Data Using Evidential Belief Function
Moon, W. M. (1990) · IEEE Transactions on Geoscience and Remote Sensing · doi:10.1109/tgrs.1990.572988 · Cited by 152 · see citing works
Shafer, G. R. (1986) · International Journal of Intelligent Systems · doi:10.1002/int.4550010302 · Cited by 123 · see citing works
A General, But Readily Adaptable Model of Information System Risk
Alter, S., & Sherer, S. A. (2004) · Communications of the Association for Information Systems · doi:10.17705/1cais.01401 · Cited by 122 · see citing works
Belief-Function Formulas for Audit Risk
Srivastava, R. P., & Shafer, G. R. (2008) · Springer eBooks · doi:10.1007/978-3-540-44792-4_23 · Cited by 109 · see citing works
Self-citationRetail Bank Services Strategy: A Model of Traditional, Electronic, and Mixed Distribution Choices
Byers, R. E., & Lederer, P. J. (2001) · Journal of Management Information Systems · doi:10.1080/07421222.2001.11045686 · Cited by 106 · see citing works
The Bayesian and Belief-Function Formalisms: A General Perspective for Auditing.
Shafer, G., & Srivastava, R. P. (1990) · Auditing A Journal of Practice & Theory · doi:10.2308/ajpt-15116617 · Cited by 96 · see citing works
Self-citationBelief Functions in Business Decisions
(2002) · Studies in fuzziness and soft computing · doi:10.1007/978-3-7908-1798-0 · Cited by 93 · see citing works
Dynamic Decision Making with Belief FunctionsPreprint
Jaffray, J. (1992) · RePEc: Research Papers in Economics · Cited by 65 · see citing works
Pulcinella: A General Tool for Propagating Uncertainty in Valuation NetworksPreprint
Saffiotti, A., & Umkehrer, E. (2013) · arXiv (Cornell University) · doi:10.48550/arxiv.1303.5745 · Cited by 62 · see citing works
Evidential Reasoning for WebTrust Assurance Services
Srivastava, R. P., & Mock, T. J. (1999) · Journal of Management Information Systems · doi:10.1080/07421222.1999.11518254 · Cited by 61 · see citing works
Self-citationOn decision making using belief functions
Nguyen, H. T., & Walker, E. A. (1994) · John Wiley & Sons, Inc. eBooks · Cited by 54 · see citing works
Applications of Belief Functions in Business Decisions: A Review
Srivastava, R. P., & Liu, L. (2003) · Information Systems Frontiers · doi:10.1023/b:isfi.0000005651.93751.4b · Cited by 52 · see citing works
Self-citationA Stochastic Dominance Approach to Risk Analysis of Computer Systems
Post, G. V., & Dlltz, J. D. (1986) · MIS Quarterly · doi:10.2307/249191 · Cited by 51 · see citing works
Risk assessment based on weak information using belief functions: a case study in water treatment
Démotier, S., Schön, W., & Denœux, T. (2006) · IEEE Transactions on Systems Man and Cybernetics Part C (Applications and Reviews) · doi:10.1109/tsmcc.2004.840057 · Cited by 48 · see citing works
Principles and procedures of the LRAM approach to information systems risk analysis and management
Guarro, S. B. (1987) · Computers & Security · doi:10.1016/0167-4048(87)90030-7 · Cited by 43 · see citing works
Evidential reasoning using DELIEF
Zarley, D., & Hsia, Y. (1990) · National Conference on Artificial Intelligence · Cited by 41 · see citing works
Analysis of convergent evidence in an evidential reasoning knowledge-based classification
Cohen, Y., & Shoshany, M. (2005) · Remote Sensing of Environment · doi:10.1016/j.rse.2005.04.009 · Cited by 28 · see citing works
Decision Making Under Ambiguity: A Belief-function Perspective
Srivastava, R. P. (1997) · KU ScholarWorks (University of Kansas) · Cited by 27 · see citing works
Self-citationComputer security—an end state?
Bellovin, S. M. (2001) · Communications of the ACM · doi:10.1145/365181.365241 · Cited by 24 · see citing works
Modeling Financial Portfolios Using Belief Functions
Shenoy, C., & Shenoy, P. P. (2002) · Studies in fuzziness and soft computing · doi:10.1007/978-3-7908-1798-0_11 · Cited by 21 · see citing works
A Belief-Function Based Decision Support System
Xu, H. B., Hsia, Y., & Smets, P. (1993) · Uncertainty in Artificial Intelligence · doi:10.1016/b978-1-4832-1451-1.50070-6 · Cited by 11 · see citing works
Using Belief Functions to Forecast Demand for Mobile Satellite Services
McBurney, P., & Parsons, S. (2002) · Studies in fuzziness and soft computing · doi:10.1007/978-3-7908-1798-0_10 · Cited by 10 · see citing works
Spatial reasoning based on multivariate belief functions
Chen, S.-Y., Lin, W.-C., & Chen, C.-T. (2003) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.1992.223125 · Cited by 9 · see citing works
The Security Hole in WAP: An Analysis of the Network and Business Rationales Underlying a Failure
Juul, N. C., & Jørgensen, N. (2003) · International Journal of Electronic Commerce · doi:10.1080/10864415.2003.11044279 · Cited by 9 · see citing works
Belief Functions and the Possible Worlds Paradigm
Wilkins, E. (2002) · Journal of Logic and Computation · doi:10.1093/logcom/12.3.475 · Cited by 4 · see citing works
Flagged first, then by citations
Research works printed but not linked: 16
- Srivastava, Rajendra. (2006) An Information Systems Security Risk Assessment Model under Dempster-Shafer Theory of Belief Functions. Journal of Management Information Systems, 22 (4), 109-142. Publisher's Official Version: <http://www.jmis-web.org/>. Open Access Version: <http://kuscholarworks.ku.edu/dspace/>.
- Cutter Consortium. Exactly what is risk management? Cutter Consortium Press Room. June 6, 2002. Accessed on November 3, 2005 at http://www.cutter.com/press/020606.html
- Srivastava, Rajendra. (2006) An Information Systems Security Risk Assessment Model under Dempster-Shafer Theory of Belief Functions. Journal of Management Information Systems, 22 (4), 109-142. Publisher's Official Version: <http://www.jmis-web.org/>. Open Access Version: <http://kuscholarworks.ku.edu/dspace/>.
- Hammond, R. Improving productivity through risk management. In, Umbaugh, R.F., (ed.), Handbook of MIS Management, 2 nd ed. Boston: Auerbach, 1988, 655-665.
- Srivastava, Rajendra. (2006) An Information Systems Security Risk Assessment Model under Dempster-Shafer Theory of Belief Functions. Journal of Management Information Systems, 22 (4), 109-142. Publisher's Official Version: <http://www.jmis-web.org/>. Open Access Version: <http://kuscholarworks.ku.edu/dspace/>.
- Krishnamoorthy, G. Discussion of aggregation of evidence in auditing: a likelihood perspective. Auditing: A Journal of Practice and Theory, 12 (supplement 1993), 161-164.
- Pacelle, M. MasterCard reports security breach. The Wall Street Journal, (June 2005).
- Palacharla, P.; and Nelson, P. C. Evidential Reasoning in Uncertainty for Data Fusion Pro- ceedings of the Fifth International Conference on Information Processing and Management of Uncertainty in Knowledge-Based Systems. Paris, France, July 1994, 715-720.
- Perschke, G. A.; Karabin, S. J., and Brock, T. L. Four steps to information security. Journal of Accountancy (1986), 104-111.
- Srivastava, Rajendra. (2006) An Information Systems Security Risk Assessment Model under Dempster-Shafer Theory of Belief Functions. Journal of Management Information Systems, 22 (4), 109-142. Publisher's Official Version: <http://www.jmis-web.org/>. Open Access Version: <http://kuscholarworks.ku.edu/dspace/>.
- _______, Shenoy, P. P., and Srivastava, R. P. AUDITOR'S ASSISTANT: A knowledge engineering tool for audit decisions. In, Proceedings of the 1988 Touche Ross/University of Kansas Symposium on Auditing Problems, May 1988, 61-79.
- _______, and Mock, T. Why we should consider belief functions in auditing research and practice. The Auditor's Report, 28, 2 (2005), 58-65.
- Srivastava, Rajendra. (2006) An Information Systems Security Risk Assessment Model under Dempster-Shafer Theory of Belief Functions. Journal of Management Information Systems, 22 (4), 109-142. Publisher's Official Version: <http://www.jmis-web.org/>. Open Access Version: <http://kuscholarworks.ku.edu/dspace/>.
- Strat, T. M. Decision analysis using belief functions. In, Yager, R. R.; Fedrizzi, M.; and Kacprzyk, J, (eds.), Advances in the Dempster-Shafer Theory of Evidence, New York, NY: John Wiley and Sons, 1994.
- Yuan, L. Companies face system attacks from inside, too. The Wall Street Journal Online, June 2005.
- Srivastava, Rajendra. (2006) An Information Systems Security Risk Assessment Model under Dempster-Shafer Theory of Belief Functions. Journal of Management Information Systems, 22 (4), 109-142. Publisher's Official Version: <http://www.jmis-web.org/>. Open Access Version: <http://kuscholarworks.ku.edu/dspace/>.
Cited by
Sorted by citations
Kandasamy, K., Srinivas, S., Achuthan, K., & Rangan, V. P. (2020) · EURASIP Journal on Information Security · doi:10.1186/s13635-020-00111-0 · Cited by 160 · see citing works
- Authors
- SUN, L., SRIVASTAVA, R. P., & MOCK, T. J.
- Affiliations
- Rutgers, The State University of New Jersey (US)
- University of Kansas (US)
- University of Southern California (US)
- Venue
- Journal of Management Information Systems
- Publisher
- Informa UK Limited
- Published
- 2006-04
- Volume
- 22
- Issue
- 4
- Pages
- 109-142
- ISSN
- 0742-1222 (ISSN-L)
- 1557-928X
- OpenAlex
- W2144958981
- Cited by
- 220
- References
- 56
- Citations by year
- 2026: 3 · 2025: 1 · 2024: 8 · 2023: 4 · 2022: 8 · 2021: 9 · 2020: 13 · 2019: 11 · 2018: 12 · 2017: 11 · 2016: 12 · 2015: 15 · 2014: 23 · 2013: 20 · 2012: 16
- FWCI
- 30.70
- Type
- journal article
- Language
- en
- Open access
- green
- hdl.handle.net
- Licence
- other-oa
- Locations
- Journal of Management Information Systems (publishedVersion)
- Research Publications (Maastricht University) (publishedVersion)
- KU ScholarWorks (The University of Kansas) (submittedVersion, other-oa)
- Research Publications (Maastricht University) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Social Sciences › Decision Sciences › Management Science and Operations Research › Multi-Criteria Decision Making
- Physical Sciences › Computer Science › Information Systems › Advanced Decision-Making Techniques
- Keywords
- information systems security, risk assessment, Dempster-Shafer theory, belief functions, evidential reasoning, risk management, security countermeasures, cost-benefit analysis, external assurance, sensitivity analysis
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
