Annualized Loss Expectancy Research Articles

Spatiotemporal Correlation Analysis of Hydraulic Fracturing and Stroke in the United States.

Hydraulic fracturing or fracking has led to a rapid growth of oil and gas production in the United States, but the impact of fracking on public health is an important but underresearched topic. We designed a methodology to study spatiotemporal correlations between the risk of fracking and stroke mortality. An annualized loss expectancy (ALE) model is applied to quantify the risk of fracking. The geographically and temporally weighted regression (GTWR) model is used to analyze spatiotemporal correlations of stroke mortality, fracking ALE, and nine other socioeconomic- and health-related factors. The analysis shows that fracking ALE is moderately correlated with stroke mortality at ages over 65 in most states of fracking, in addition to cardiovascular disease and drug overdose being positively correlated with stroke mortality. Furthermore, the correlations between fracking ALE and stroke mortality in men appear to be higher than in women near the Marcellus Shale, including Ohio, Pennsylvania, West Virginia, and Virginia, while stroke mortality among women is concentrated in the Great Plains, including Montana, Wyoming, New Mexico, and Oklahoma. Lastly, within two kilometers of the fracking mining activity, the level of benzene in the air was found to be significantly correlated with the fracking activity in Colorado.

Ethical Issues in Secondary Use of Personal Health Information

The accessibility of personal health information (PHI) will increase on the Internet of the future to provide timely support for both primary and secondary uses. Although PHI for secondary uses is generally anonymized, its widespread distribution on the Internet raises ethical concerns. The PHI should remain an individual's most closely guarded asset [1], [2]. While other forms of personal data represent what the person does, owns, or knows, PHI represents what the person is. PHI describes the biological attributes of the human being, often containing longitudinal records of wellness, illness, test results, and treatments [3]. These characteristics amplify the seriousness and un-reversible consequences that uniquely differentiate breaches or disclosures of PHI data from other forms of data breach. In conducting risk assessment analysis, the result of even a single PHI data breach can be catastrophic. As it is impossible to place a price on our health, it is similarly impossible to place a price on PHI. Risk assessments calculations [4] involving annual loss expectancy, single loss expectancy, or annualized rate of occurrence are irrelevant when PHI has been breached. In light of this, the questions of: (1) granting the patient the right to consent, that is, opt-in or out, of the de-identification and subsequent secondary use of their PHI; and (2) finding synthetic alternatives to de-identified PHI for certain type of secondary uses to protect patient privacy, urgently need to be addressed.

How Much Matter Probabilities in Information Security Quantitative Risk Assessment?

The starting point of this research essay is a critical review of two methods to conduct a quantitative analysis of information systems security risks: 1) Management of Risk: Guidance for Practitioners and 2) a cost model based on annual loss expectancy. We are focusing on these methods with a perspective that highlights the limits of both empiricism and the theoretical elements that underlie them. From an epistemological point of view we have considered the logical syntax of the two models, the semantics included in statements and the pragmatics of the scientific discourse: the use of models to demonstrate the risk assessment thesis, to solve the problems of risks in the human judgment versus mathematical calculus controversy. The major issues that we are discussing in this article imply various perspectives on scientific criteria, the choice among various theories and the structuring of problems proposed to be solved. We argue that the models that have been developed so far, the top-down approach (which involves well defined and well understood rules), as well as the demonstrations based on the induction method, cannot be applied in a lot of scenarios, because information systems, considered as a complex whole made up of various components, is primarily not a positivistic science solely described by mathematics. The main research question to be answered in this paper is: What are the limits of knowledge in probabilistic computations for information systems security risk assessment? Our purpose is to demonstrate the epistemological limits of the two models and the error of generalizing probability calculus using the interpretive approach.

Quantification, Optimization and Uncertainty Modeling in Information Security Risks

In this paper, the authors present a quantitative model for estimating security risk exposure for a firm. The model includes a formulation for the optimization of controls as well as determining sensitivity of the exposure of assets to different threats. The model uses a series of matrices to organize the data as groups of assets, vulnerabilities, threats, and controls. The matrices are then linked such that data is aggregated in each matrix and cascaded across the other matrices. The computations are reversible and transparent allowing analysts to answer what-if questions on the data. The exposure formulation is based on the Annualized Loss Expectancy (ALE) model, and uncertainties in the data are captured via Monte Carlo simulation. A mock case study based on a government agency is used to illustrate this methodology.

Research Note—A Value-at-Risk Approach to Information Security Investment

Information security investment has been getting increasing attention in recent years. Various methods have been proposed to determine the effective level of security investment. However, traditional expected value methods (such as annual loss expectancy) cannot fully characterize the information security risk confronted by organizations, considering some extremal yet perhaps relatively rare cases in which a security failure may be critical and cause high losses. In this research note we introduce the concept of value-at-risk to measure the risk of daily losses an organization faces due to security exploits and use extreme value analysis to quantitatively estimate the value at risk. We collect a set of internal daily activity data from a large financial institution in the northeast United States and then simulate its daily losses with information based on data snapshots and interviews with security managers at the institution. We illustrate our methods using these simulated daily losses. With this approach, decision makers can make a proper investment choice based on their own risk preference instead of pursuing a solution that minimizes only the expected cost.