APPLICATION OF "EXPERT CHOICE" PROGRAM IN ASSESSMENT OF INFORMATION SYSTEM SECURITY VULNERABILITY

Abstract

This paper describes a model for multi-criteria decision-making in the assessment of the security threat to information systems. Multi-criteria analysis was carried out using Analytic Hierarchy Process method together with the development of mathematical models for solving the estimates. The model is implemented in the program Expert Choice. Based on the analysis of the assessment of the security threat, in the studied model the basic criteria are defined according to alternatives, and potential threats to information systems. In the initial phase of decision support system development, a vulnerability assessment of the system is conducted according to the primary alternatives of human resources. At this phase, the criteria is given in the two criterion levels with three alternatives. The first criterion level is based on seven required general criteria. In the second criterion level, sub-criteria level, the criterion "undesired state of the system" is divided to four additional sub-criteria. The model itself is designed so that it can be applied to the assessment of the security threat of any information system. It also provides the possibility of expansion in the real-time and in a specific situation. The present model for multi-criteria decision-making is the initial element of decision support system. The model, together with the Expert Choice program, enables the analysis of possible alternatives in different situations by changing weights of criteria and sub-criteria themselves. The program also gives situation analysis in case of change in the level of consistency against certain alternatives to the required criteria and a direct view of comparing of alternative search criteria. The universality of the model and the system allow the application to the information systems regardless of the size, type and function of the system itself.