A Qualitative Methodology for the Assessment of Cyberspace-Related Risks

Richard Hundley, Robert H. Anderson

Expert InsightsPublished 1996

The problem addressed here is assessing the risks to which some organization or activity is exposed as a result of some combination of cyberspace-related vulnerabilities and threats. It is an attempt to assess risk without resorting to quantitative methods, which can appear to offer more accuracy and precision than is in fact warranted. The methodology proposed, although a work in progress, has three favorable points: (1) it is transparent, in that the nature and substance of the judgments and combinatorial steps are apparent; (2) it does not pretend to greater accuracy than can be justified; and (3) it is believed to capture the key elements and interactions involved in assessing cyberspace risk. The methodology does, however, require the user to make a large number of qualitative judgments and to combine them in a subjective fashion. The paper is presented as an annotated briefing.

Document Details

  • Copyright: RAND Corporation
  • Availability: Web Only
  • Year: 1996
  • Pages: 40
  • Document Number: P-7988

Citation

Chicago Manual of Style

Hundley, Richard and Robert H. Anderson, A Qualitative Methodology for the Assessment of Cyberspace-Related Risks. Santa Monica, CA: RAND Corporation, 1996. https://www.rand.org/pubs/papers/P7988.html.
BibTeX RIS

Research conducted by

This publication is part of the RAND paper series. The paper series was a product of RAND from 1948 to 2003 that captured speeches, memorials, and derivative research, usually prepared on authors' own time and meant to be the scholarly or scientific contribution of individual authors to their professional fields. Papers were less formal than reports and did not require rigorous peer review.

This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to this product page is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial purposes. For information on reprint and reuse permissions, please visit www.rand.org/pubs/permissions.

RAND is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.