Thats a unique idea.You should consider the following idea to enhance your idea so that it would impact uniquely: Purpose#R##N##R##N##R##N##R##N##R##N#In methods and manuals, the product of an information security incident’s probability and severity is seen as a risk to manage. The purpose of the test described in this paper is to investigate if information security risk is perceived in this way, if decision-making style influences the perceived relationship beten the three variables and if the level of information security expertise influences the relationship beten the three variables.#R##N##R##N##R##N##R##N##R##N#Design/methodology/approach#R##N##R##N##R##N##R##N##R##N#Ten respondents assessed 105 potential information security incidents. Ratings of the associated risks re obtained independently from ratings of the probability and severity of the incidents. Decision-making style was measured using a scale inspired from the Cognitive Style Index; information security expertise was self-reported. Regression analysis was used to test the relationship beten variables.#R##N##R##N##R##N##R##N##R##N#Findings#R##N##R##N##R##N##R##N##R##N#The ten respondents did not assess risk as the product of probability and severity, regardless of experience, expertise and decision-making style. The mean variance explained in risk ratings using an additive term is 54.0 or 38.4 per cent, depending on how risk is measured. When a multiplicative term was added, the mean variance only increased by 1.5 or 2.4 per cent. For most of the respondents, the contribution of the multiplicative term is statistically insignificant.#R##N##R##N##R##N##R##N##R##N#Practical Implications#R##N##R##N##R##N##R##N##R##N#The inability or unwillingness to see risk as a product of probability and severity suggests that procedural support (e.g. risk matrices) has a role to play in the risk assessment processes.#R##N##R##N##R##N##R##N##R##N#Originality/value#R##N##R##N##R##N##R##N##R##N#This study is the first to test if information security risk is assessed as an interaction beten probability and severity using suitable scales and a within-subject design.
['Teodor Sommestad', 'Henrik Karlzén', 'Peter Nilsson', 'Jonas Hallberg']
I am writing a research paper on a idea An empirical test of the perceived relationship between risk and the constituents severity and probability
[{"from": "human", "value": "I am writing a research paper on a idea An empirical test of the perceived relationship between risk and the constituents severity and probability"}, {"from": "gpt", "value": "Thats a unique idea.You should consider the following idea to enhance your idea so that it would impact uniquely: Purpose#R##N##R##N##R##N##R##N##R##N#In methods and manuals, the product of an information security incident\u2019s probability and severity is seen as a risk to manage. The purpose of the test described in this paper is to investigate if information security risk is perceived in this way, if decision-making style influences the perceived relationship beten the three variables and if the level of information security expertise influences the relationship beten the three variables.#R##N##R##N##R##N##R##N##R##N#Design/methodology/approach#R##N##R##N##R##N##R##N##R##N#Ten respondents assessed 105 potential information security incidents. Ratings of the associated risks re obtained independently from ratings of the probability and severity of the incidents. Decision-making style was measured using a scale inspired from the Cognitive Style Index; information security expertise was self-reported. Regression analysis was used to test the relationship beten variables.#R##N##R##N##R##N##R##N##R##N#Findings#R##N##R##N##R##N##R##N##R##N#The ten respondents did not assess risk as the product of probability and severity, regardless of experience, expertise and decision-making style. The mean variance explained in risk ratings using an additive term is 54.0 or 38.4 per cent, depending on how risk is measured. When a multiplicative term was added, the mean variance only increased by 1.5 or 2.4 per cent. For most of the respondents, the contribution of the multiplicative term is statistically insignificant.#R##N##R##N##R##N##R##N##R##N#Practical Implications#R##N##R##N##R##N##R##N##R##N#The inability or unwillingness to see risk as a product of probability and severity suggests that procedural support (e.g. risk matrices) has a role to play in the risk assessment processes.#R##N##R##N##R##N##R##N##R##N#Originality/value#R##N##R##N##R##N##R##N##R##N#This study is the first to test if information security risk is assessed as an interaction beten probability and severity using suitable scales and a within-subject design."}]