Abstract

Information security plays a significant role in recent information society. Increasing number and impact of cyber attacks on information assets have resulted the increasing awareness among managers that attack on information is actually attack on organization itself. Unfortunately, particular model for information security evaluation for management levels is still not well defined. In this study, decision analysis based on Ternary Analytic Hierarchy Process (T-AHP) is proposed as a novel model to aid managers who responsible in making strategic evaluation related to information security issues. In addition, sensitivity analysis is applied to extend our analysis by using several "what-if" scenarios in order to measure the consistency of the final evaluation. Finally, we conclude that the final evaluation made by managers has a significant consistency shown by sensitivity analysis results.

References

• Householder, Houle, K. & Dougherty, C. (2002). Computer attack trends challenge Internet security. Computer IEEE, 35 (4), 5-7, 2002.
• Ransbotham, S. & Mitra, S. (2009). Choice and Chance: A Conceptual Model of Paths to Information Security Compromise. Information Systems Research, 20 (1), 121-139.
• Syamsuddin, I and Hwang, J, 2010, The Use of AHP in Security Policy Decision Making: An Open Office Calc Application, Journal of Software, 5(10), 1162-1169
• Bacik, S. (2008). Building an effective information security policy architecture. United States CRC Press. LLC, Boca Raton.
• Wylder, J. (2004). Strategic Information Security, United States: Auerbach 2008.
• Filipek, R. (2007). Information security becomes a business priority. Internal Auditor, 64 (1), 18.
• Anderson, R. (2001). Why Information Security is Hard: An Economic Perspective. Proceedings of 17th Annual Computer Security Applications Conference, 10-14.
• Gordon, L. A. & Loeb, M. P. (2002). The Economics of Investment in Information Security. ACM Transactions on Information and System Security, 5(4), 438-457.
• Martins, A. & Eloff, J. (2002). Information security culture", IFIP TC11, 17th international conference on information security (SEC2002), Cairo, Egypt, 203–214.
• Saaty, T. L. (1990). The Analytic Hierarchy Process, United States: RWS Publications, Pittsburgh, PA.
• Syamsuddin,I and Hwang, J, 2009, The Application of AHP to Evaluate Information Security Policy Decision Making, International Journal of Simulation, Systems, Science and Technology, 10(4), 46-50.
• Vaidya,O. & Kumar, S. (2006). Analytic hierarchy process: An overview of applications", European Journal of Operational Research, 169(1), 1–29.
• Takahashi, I. (1990) AHP Applied to Binary and Ternary Comparisons. Journal of Operations Research Society of Japan, 33(3),199–206.
• Fulford, H. and Doherty, N. F. (2003). The application of information security policies in large UK-based organizations: an exploratory investigation. Information Management & Computer Security, 11(3). 106-14.
• Nishizawa, K and Takahashi,I (2007) Estimation Methods By Stochastic Model In Binary And Ternary AHP, Journal of the Operations Research Society of Japan 50(2), 101-122.
• Takeda,E, 2001, A method for multiple pseudo-criteria decision problems, Computers & Operations Research, 28(14), 1427–1439.
• Syamsuddin, I, 2012, Evaluation of Strategic Information Security with Fuzzy AHP Method, American Journal of Intelligent Systems, 2(1), 9-13
• Thomson, M. E, & von Solms,R. (1998). Information security awareness: educating your users effectively. Information Management and Computer Security, 6(4), 167–173