A fuzzy multi-criteria decision model for information system security investment

Abstract

Decision on how much resources should be invested to curb information security threat at a specific risk level is contingent upon multiple criteria, some of which must be represented by linguistic variables. This paper aims to provide theoretical justifications for the various criteria and the need to use a fuzzy-logic based tool for their selection and classification. © Springer-Verlag 2003.