Refine
Document Type
- Doctoral Thesis (2)
Has Fulltext
- yes (2)
Is part of the Bibliography
- no (2)
Keywords
- Risikomanagement (2) (remove)
Critical infrastructure and contemporary business organizations are experiencing an ongoing paradigm shift of business towards more collaboration and agility. On the one hand, this shift seeks to enhance business efficiency, coordinate large-scale distribution operations, and manage complex supply chains. But, on the other hand, it makes traditional security practices such as firewalls and other perimeter defenses insufficient. Therefore, concerns over risks like terrorism, crime, and business revenue loss increasingly impose the need for enhancing and managing security within the boundaries of these systems so that unwanted incidents (e.g., potential intrusions) can still be detected with higher probabilities. To this end, critical infrastructure organizations step up their efforts to investigate new possibilities for actively engaging in situational awareness practices to ensure a high level of persistent monitoring as well as on-site observation.
Compliance with security standards is necessary to ensure that organizations meet regulatory requirements mostly shaped by a set of best practices. Nevertheless, it does not necessarily result in a coherent security strategy that considers the different aims and practical constraints of each organization. In this regard, there is an increasingly growing demand for risk-based security management approaches that enable critical infrastructures to focus their efforts on mitigating the risks to which they are exposed. Broadly speaking, security management involves the identification, assessment, and evaluation of long-term (or overall) objectives and interests as well as the means of achieving them.
Due to the critical role of such systems, their decision-makers tend to enhance the system resilience against very unpleasant outcomes and severe consequences. That is, they seek to avoid decision options associated with likely extreme risks in the first place. Practically speaking, this risk attitude can significantly influence the decision-making process in such critical organizations. Towards incorporating the aversion to extreme risks into security management decisions, this thesis investigates thoroughly the capabilities of a recently emerged theory of games with payoffs that are probability distributions. Unlike traditional optimization techniques, this theory provides an alternative decision technique that is more robust to extreme risks and uncertainty. Furthermore, this thesis proposes a new method that gives a decision maker more control over the decision-making process through defining loss regions with different importance levels according to people's risk attitudes. In this way, the static decision analysis used in the distribution-valued games is transformed into a dynamic process to adapt to different subjective risk attitudes or account for future changes in the decision caused by a learning process or other changes in the context.
Throughout their different parts, this thesis shows how theoretical models, simulation, and risk assessment models can be combined into practical solutions. In this context, it deals with three facets of security management: allocating limited security resources, prioritizing security actions, and tweaking decision making. Finally, the author discusses experiences and limitations distilled from this research and from investigating the new theory of games, which can be taken into account in future approaches.
In Zeiten von Globalisierung, kurzen Produktlebenszyklen und schnellem technologischen Fortschritt gewinnen Projekte über alle Branchen zunehmend an Bedeutung – so auch in der Softwarebranche. Nahezu jedes Unternehmen muss derzeit große Anstrengungen im Bereich Projektmanagement unternehmen, um die gestiegenen Anforderungen erfüllen zu können, die richtigen Projekte auszuwählen und diese in geeigneter Weise durchzuführen. Ein wesentliches Problem in diesem Bereich ist, dass Umstände und Schlüsselfaktoren des Projekterfolgs während des gesamten Projektverlaufs als veränderlich angesehen werden müssen. Veränderungen der Rahmenbedingungen können jedoch zu steigenden Kosten und/oder sinkenden Ertragsprognosen führen, wodurch möglicherweise eine Weiterführung des bereits begonnenen Projektes unwirtschaftlich wird. Die Frage dahingehend, ob ein bereits laufendes Projekt unter veränderten Rahmenbedingungen weitergeführt oder abgebrochen werden sollte, ist daher eine der Kernfragen des Projektmanagements. Sie wird derzeit jedoch sowohl im Projektmanagement allgemein als auch im Softwareentwickungs-Projektmanagement im Besonderen weitgehend vernachlässigt. Daher war das wesentliche Ziel meiner Arbeit ein generisches Modell zur Entscheidungsunterstützung zu entwickeln. Dieses Modell kann als Framework aufgefasst werden, welches sowohl für verschiedene Arten von Softwareentwicklungsprojekten als auch Unterschiede in der Datenverfügbarkeit konzipiert wurde. Dabei wurde ein Haupt-Fokus auf die Integration von Kernrisiken in die Schätzung von Projektrestaufwänden und -erträgen gelegt, um eine tragfähige Entscheidungsgrundlage zu generieren.