Toward Risk Assessment of Large-Impact and Rare Events

摘要

Traditional risk assessment methods underestimate the risks of large-impact, hard-to-predict, and rare events in information systems. An alternative approach extends these methods to better evaluate risks associated with black and gray swans. In an example, the authors define a generic model for centralized identity systems. They use the alternative risk assessment approach to compare the total risk of employing a single nationwide identity system with that of employing multiple diverse systems and determine the solution with the least risk for a major stakeholder.