Measuring the Information Security Maturity of Enterprises under Uncertainty Using Fuzzy AHP

Abstract

Generally, measuring the Information Security maturity(ISM) is the first step to build a new knowledge information security management system in an organization. Knowing the ISM level helps organizations decide the type of protection strategies and policies will be taken and their priorities to strengthen their competitive ability. One of the possible ways to solve the problem is a using multiple criteria decision-making (MCDM) methodology. Analytic hierarchy process (AHP) is one of the most commonly used MCDM methods, which combines subjective and personal preferences in the information security assessment process. However, the AHP involves human subjectivity, which introduces vagueness type of uncertainty and requires the use of decision-making under those uncertainties. In this paper, the IS maturity is based on hierarchical multilevel information security gap analysis model for ISO 27001:2013 security standard. The concept of fuzzy set is applied to Analytic Hierarchical Process (AHP) to propose a model for measuring organizations IS maturity under uncertain environment. Using fuzzy AHP approach helps determine more efficiently importance weights of factors and indicators, especially deal with imprecise and uncertain expert comparison judgments. A case study is used to illustrate the better new method for IS evaluation.

Multicriteria Decision Making using Analytic Hierarchy Process for Child Protection from Malicious Content on the Internet

“…AHP allows making complex decisions. That is, it is based on a comparison of the elements involved in decision-making which are difficult to [29] calculate. The AHP algorithm includes the following steps:…”

A Fuzzy MCDM Approach for Structured Comparison of the Health Literacy Level of Hospitals

“…However, according to [25,37] the traditional Satty's analytic hierarchy process method does not deal with the uncertainty involved in assessing the importance of the criteria For this reason, a fuzzy version of it was selected. This approach performs analytic hierarchy process under uncertainty and ambiguity, has received increasing acceptance, and has been approved and implemented to solve decision-making problems in many fields.…”

“…The third framework is focused on merging the previous two types into a single evaluation framework with the aim of evaluating the actual level of practices and taking into account the importance of various evaluation indicators and factors. A number of studies have used this framework but in other application domains [25]. Additionally, the fourth type uses additional tools called ranking tools to make comparisons between different institutions in terms of their general or indicator level of application for certain applied practices [8,9].…”

“…However, their approach is not ideal in this situation for two main reasons. The analytic hierarchy process method does not deal with the uncertainty involved in assessing the importance of the factors of an MCDM problem and the organizational health literacy responsiveness level of companies; additionally, their approach is used as a single qualitative preference point measurement scale for capturing the evaluation data, and this approach is sometimes not accurately expressed in the case being assessed [23][24][25]. Additionally, it does not deal with the vague assessment situation.…”

“…The uncertainty problem occurred through the evaluation process because of a lack of information or imprecision related to the decision making values and judgments [24]. Fuzzy based MCDM approaches are accomplished of demonstrating this vagueness and dealing with its fuzzy situations [23][24][25].…”