Risk Analysis in Information Systems. A Fuzzy Approach.

Assets are interrelated in risk analysis methodologies for information systems promoted by international standards. This means that an attack on one asset can be propagated through the network and threaten an organization's valuable assets. It is necessary to valuate all assets, the direct indirect asset dependencies, as well as the probability of threats and the resulting asset degradation. However, the experts charge to assign such values often provide only vague uncertain information. Fuzzy logic can be very helpful in situation, but it is not free of some difficulties, such as the need a proper arithmetic to the model under consideration establishment of appropriate similarity measures. Throughout this paper we propose a fuzzy treatment for risk analysis promoted by international methodologies through the establishment of such elements.