Quantifying information security risks using expert judgment elicitation

Julie J.C.H. Ryan, Thomas A. Mazzuchi, Daniel J. Ryan, Juliana Lopez de la Cruz, Roger Cooke

Research output: Contribution to journalArticlepeer-review

44 Citations (Scopus)


In the information security business, 30 years of practical and theoretical research has resulted in a fairly sophisticated appreciation for how to judge the qualitative level of risk faced by an enterprise. Based upon that understanding, there is a practical level of protection that a competent security manager can architect for a given enterprise. It would, of course, be better to use a quantitative approach to risk management, but, unfortunately, sufficient quantitative data that has been scientifically collected and analyzed does not exist. There have been many attempts to develop quantitative data using traditional quantitative methods, such as experiments, surveys, and observations, but there are significant weaknesses apparent in each approach. The research described in this paper was constructed to explore the utility of applying the well-established method of expert judgment elicitation to the field of information security. The instrument for eliciting the expert judgments was developed by two information security specialists and two expert judgment analysis specialists. The resultant instrument was validated using a small set of information security experts. The final instrument was used to elicit answers to both the calibration and judgment questions through structured interviews. The data was compiled and analyzed by a specialist in expert judgment analysis. This research illustrates the development of prior distributions for the parameters of models for cyber attacks and uses expert judgment results to develop the distributions.
Original languageEnglish
Pages (from-to)774-784
Number of pages11
JournalComputers & Operations Research
Issue number4
Publication statusPublished - Apr 2012


  • information security
  • risk management
  • probability distributions
  • expert elicitation
  • poisson processes


Dive into the research topics of 'Quantifying information security risks using expert judgment elicitation'. Together they form a unique fingerprint.

Cite this