Security Risk Assessment: Towards a Justification for the Security Risk Factor Table Model

Abstract

One of the widely used methods to gauge risk is the Security Risk Factor Table (SRFT) model. While this model has been empirically successful, its use is limited by the fact that its formulas do not have a theoretical explanation – and thus, there is no guarantee that these formulas will work in other situations as well. In this paper, we provide a theoretical explanation for the SFRT formulas.