Dynamic Assessment and VaR-Based Quantification of Information Security Risk

Risk assessment and quantification is crucial to the effectiveness of information security measure deployed in an organization. A dynamic risk assessment process is presented in this paper to cope with the variation and diversity of threats in the information system. To give a clear perspective of the information risk without confusing by the complexity of so many risk factors, an risk quantification model and a VaR-based risk measure are presented, through which, risk can be represented by the prospective maximum daily loss under certain confidence level. We test our risk quantification model and measure in a real network environment.