A Cause and Effect Approach Towards Risk Analysis
Paper i proceeding, 2011

Risk analysis is critical for IT systems and for organizations and their daily operation. There are various tools and methods to analyse risk. Most approaches take risk assessment as a result of specific factors (such as threats and vulnerabilities) without investigating the impact of various types of system operation. Therefore, we suggest a causal approach toward risk analysis based on an existing security model. We start out from a current risk analysis method and improve it by taking the system operation, causal relation between the impairments, as well as latency effects into account. The approach exhibits the impact of the attack chain of impairments on system risk. We claim that the approach presented in this paper will make it possible to conduct a more refined quantitative assessment of risk.

risk analysis


causal chain of impairments

system operation

security model

security planning


Laleh Pirzadeh Irannezhad

Chalmers, Data- och informationsteknik, Nätverk och system

Erland Jonsson

Chalmers, Data- och informationsteknik, Nätverk och system

International workshop on Security Measurements and Metrics - MetriSec2011, Banff, Alberta, Canada, 2011-09-21



Informations- och kommunikationsteknik


Datavetenskap (datalogi)



Mer information

Senast uppdaterat