When the feature to calculate risk levels were first added to system-modeller, the following assumptions were made:
the scales used for risk, impact and likelihood (and related to likelihood, trustworthiness) would each have five levels
risk level (for a threat or threat consequence) should be a function of impact and likelihood levels, as specified by ISO 27005
With these assumptions, it made sense to use a lookup table to get the risk level for a given impact and likelihood. For expediency, this was hard-coded in the Java method RiskCalculator.lookupRiskLevel(), even though the scales themselves (names and descriptions of each level in each scale) are specified in the domain model.
Later, it was realised that having an odd number of levels in these scales is not ideal, because users who need to specify an impact level or an assumed likelihood (i.e., trustworthiness) level may just pick the middle of the scale if they aren't sure. It was not possible to change the number of levels used in these scales because the risk lookup table was specified only for 5 levels in each scale.
To get around this, some extra lookup tables were added in RiskCalculator.lookupRiskLevel(), which selects which table to use based on the number of levels in each scale, as specified in the domain model.
Later, two more sets of lookup tables were added in functions to calculate TW levels (equivalent to the associated likelihood) for assets in a non-singleton population, based on the average TW level in the population, and the size of the population. These are:
JenaQuerierDB.lookupHighestTWLevel(): calculates the likelihood that all members of a population are untrustworthy, equivalent to the TW level for the most trustworthy member of the population
JenaQuerierDB.lookupLowestTWLevel(): calculates the likelihood that any member of a population is untrustworthy, equivalent to the TW level for the least trustworthy member of the population
These functions use lookup tables that calculate a TW level from a population level and a TW level, and from the outset they were created with several lookup tables, one of which is selected based on the number of levels in the TW and population scales.
This arrangement (each function having several lookup tables to choose from) works in practice, but it does mean the domain modeller is restricted on the number of levels they can use in each of these scales (population, impact, likelihood/TW and risk). It also means that the domain modeller cannot freely alter the interpretation of each level in the scale, since these levels are interrelated and must be consistent across each type of scale.
We should
[ ] add specifications for all these lookup tables to the domain model, then
When the feature to calculate risk levels were first added to system-modeller, the following assumptions were made:
With these assumptions, it made sense to use a lookup table to get the risk level for a given impact and likelihood. For expediency, this was hard-coded in the Java method
RiskCalculator.lookupRiskLevel(), even though the scales themselves (names and descriptions of each level in each scale) are specified in the domain model.Later, it was realised that having an odd number of levels in these scales is not ideal, because users who need to specify an impact level or an assumed likelihood (i.e., trustworthiness) level may just pick the middle of the scale if they aren't sure. It was not possible to change the number of levels used in these scales because the risk lookup table was specified only for 5 levels in each scale.
To get around this, some extra lookup tables were added in
RiskCalculator.lookupRiskLevel(), which selects which table to use based on the number of levels in each scale, as specified in the domain model.Later, two more sets of lookup tables were added in functions to calculate TW levels (equivalent to the associated likelihood) for assets in a non-singleton population, based on the average TW level in the population, and the size of the population. These are:
These functions use lookup tables that calculate a TW level from a population level and a TW level, and from the outset they were created with several lookup tables, one of which is selected based on the number of levels in the TW and population scales.
This arrangement (each function having several lookup tables to choose from) works in practice, but it does mean the domain modeller is restricted on the number of levels they can use in each of these scales (population, impact, likelihood/TW and risk). It also means that the domain modeller cannot freely alter the interpretation of each level in the scale, since these levels are interrelated and must be consistent across each type of scale.
We should