PSI - Issue 22

Jerzy STANIK et al. / Procedia Structural Integrity 22 (2019) 322–333 "Author name" / Structural Integrity Procedia 00 (2019) 000 – 000

328

7

The next step, after identifying resources, is to agree on the scale and criteria for assigning a specific place on the scale to all resources, based on the valuation of resources. Due to the diversity of resources operating within the IT system, it is likely that portion of the resources can be assigned a specific value expressed in money, while for the other portion , only a range of values may be specified, for example, from “very low” to “very high”. It is recommended that the criteria used as the basis for assigning values to all resources are described using unambiguous terms. This is often one of the most difficult aspects of resource valuation, because the value of a portion of resources may be described subjectively and usually such valuation is performed by many different people. The possible criteria used to determine the value of resources include the initial cost, the cost of replacement or reconstruction, but these values can also be abstract, e.g. the value of the organization's good reputation. For the purposes of the model being developed, the basis for valuing assets is the costs incurred as a result of the loss of basic usefulness features as the after-effects of the incident. Such approach will ensure that essential elements are taken into account in the valuation of resources, as a complement to replacement costs, based on the estimation of negative business consequences that could arise from incidents related to loss of IT usefulness given the assumption of a specified set of circumstances. It is emphasized that this approach takes into account the after-effects that are the factors introduced to assess the risk. During valuation, different resources can be assigned different values. Each of the assigned values will most likely be significantly different from the others. The assigned value can be the maximum value of all possible values, it can also be the sum of some or all possible values. It is recommended to carefully indicate in the final analysis, what value or values will be assigned to the given assets, because the final value is the input data used to determine the resources that need to be allocated to protect the assets. In the final phase, the value of all assets should be reduced to a common base. The final result of estimating the value of IT system resources is the list of resources and their values (real losses or damages) in relation to loss of each usefulness feature, as well as replacement costs. Bearing in mind the above-described valuation process of IT resources, the potential of basic systems S can be determined, for example, by means of the general formula of the following type: = ( , , ; u ∈ U IT ; k ∈ u IT ) → ℜ I +T (10) where: u IT - a set of criteria that can be used to estimate potential IT losses or after-effects resulting from the loss of the u-th usefulness feature, , - the real potential of loss, damages to the IT system from the point of view of the k-th criterion in relation to the b-th security attribute. Should it not be possible to directly determine the real potential , it can be determined based on the knowledge of the hypothetical potential , using the below multiplicative formula: , ∶ ℱ × , → ℜ I +T ; (11) where: ℱ - transformation coefficient of hypothetical losses to the category of real losses in relation to the u-th usefulness feature, , - hypothetical potential of IT loss from the point of view of the k-th criterion in relation to the u-th usefulness feature. If we could express all of the partial loss potentials , in a certain normalized numerical space ℕ ∈ ℜ I +T , the total potential of hypothetical partial losses can be determined as a weighted additive function of partial potentials, that is: = ∑ , ̿L̿̿K̿ uIT =1 , , ; u ∈ U IT ; k ∈ LK u IT ) → ℕ (12) where: , - weight coefficients of component partial potentials. The component represents the quantitative and immediate (operational) level of consequences resulting from the loss of the u-th IT usefulness feature. The immediate effect can be of direct or indirect type. The direct effect is,