Experiences from Using Indicators to Validate Expert Judgments in Security Risk Analysis

Abstract—Expert judgments are often used to estimate likelihood values in a security risk analysis. These judgments are subjective and their correctness rely on the competence, training, and experience of the experts. Thus, there is a need to validate the correctness of the estimates obtained from expert judgments. In this paper we report on experiences from a security risk analysis where indicators were used to validate likelihood estimates obtained from expert judgments. The experiences build on data collected during the analysis and on semi-structured interviews with the client experts who participated in the analysis. Keywords-security risk analysis; expert judgment; indicator I