Analytic Network Process (ANP)

Fuzzy linguistic quantifiers Maximum entropy method re p he r Laboratory (DEMATEL) approach to construct interrelations among security control areas. Secondly, like-ation Geer, 2001). Risk management is performed through the process of identifying risks, assessing risks, and taking steps to reduce risks to an acceptable level (Stoneburner, Goguen, & Feringa, 2002). The most important process of information risk management is risk assessment (Peltier, 2005). Risk assessment ascertains the threats associatedwith assets andprioritizes risks to assets. Aneffective risk assessment can protect organizations andmaintain their abilities to for defining the likelihood and impact values especially in cases where interrelations exist between security controls. Despite of this, not much research has been done on the interdependent relation-ships among security controls for information systems. The purpose of this paper is to develop a hybrid procedure enabling organizations to efficiently evaluate risk levels on informa-tion systems. It will help them deal with intertwined relationships between risk controls as well as dealing with evaluations of experts with diverse professional backgrounds and views. The proposed procedure helps analysts find the crucial risk elements even when ⇑ Corresponding author