Information Technology Reference
In-Depth Information
n
Certainty factor—Or conversely, the uncertainty factor is a heuristic for deal-
ing with the fact that things do not always happen as expected.
Confidence factor—A mathematical/statistical representation of certainty.
n
Table 14.2 presents IA
2
application of systems dynamics factors.
Figure 14.2 provides an example of the systems dynamics of risk using a stock
and flow model. Each box represents a stock, something that may accumulate or
reduce. The double arrows represent flows in and out of the stocks. The single
arrows identify influences on the flows. As shown, the threat means, method, moti-
vation, and mission influence the flow of new threats into threat space. Actions
influence what is considered a priority risk. Consequences of those actions affect
the flow of viable threats, e.g., a consequence of reprisal or jail time will affect a
threat's actions. Risk analysis and determination of certainty and confidence levels
affect the flow of new priority risks. Priority risks receive IA budget according to
IA budget priorities. This method of modeling considers the dynamic relationship
of enterprise entities, actors, and actions. The model in the figure is but a partial
model of the overall enterprise dynamics of risk. IA
2
provides a lexicon and foun-
dational concepts to expand on the use of systems dynamics as a modeling tool for
IA and predicting the application of IA within the enterprise.
table 14.2
Syste
ms Dynamics Factors
Factor
IA Application
Awareness factor
Awareness is the first step to specific accommodation;
otherwise, provide contingency plans and a default plan to
cover unknowns.
Control factor
If the organization can control an event, provide a plan.
Influence factor
If the organization cannot control an event, consider if it
can influence the event or the causes. If so, provide a plan.
Response factor
If the organization cannot control or influence the event, it
can at least control its response to it.
Probability factor
An attempt at hard representation of reality that takes on
the form of probability calculations; conditional probability
(the Bayesian probability of X given Y); and compound
conditional probability (probability of X given Y and Z)
Certainty factor
Soft heuristic for the organization to determine the
likelihood of an event; this is more akin to gut feel.
Confidence factor
Hard statistic in determining the likelihood of an event;
careful not to quantify a gut feel solely to add statistical
credibility
