Risk Analysis Commons^™

Systemic Risk Analysis Of Human Factors In Phishing, Mark Guilford

Engineering Management & Systems Engineering Theses & Dissertations

The scope of this study is the systemic risk of the role of humans in the risk of phishing. The relevance to engineering managers and systems engineers of the risks of phishing attacks is the theft of data which has significantly increased in the past couple of years. Phishing has become a systemic persistent threat to all internet users. Understanding the role of humans in phishing from a systemic perspective is a critical objective towards creating a strong defense against complex and manipulative phishing attacks. The systemic view of phishing concentrates on how phishing affects the entire organizational system, not …

Quantifying Cyber Risk By Integrating Attack Graph And Impact Graph, Omer F. Keskin

Engineering Management & Systems Engineering Theses & Dissertations

Being a relatively new risk source, models to quantify cyber risks are not well developed; therefore, cyber risk management in most businesses depends on qualitative assessments. With the increase in the economic consequences of cyber incidents, the importance of quantifying cyber risks has increased. Cyber risk quantification is also needed to establish communication among decision-makers of different levels of an enterprise, from technical personnel to top management.

The goal of this research is to build a probabilistic cybersecurity risk analysis model that relates attack propagation with impact propagation through internal dependencies and allows temporal analysis.

The contributions of the developed …

Cybersecurity Risk Assessment Using Graph Theoretical Anomaly Detection And Machine Learning, Goksel Kucukkaya

Engineering Management & Systems Engineering Theses & Dissertations

The cyber domain is a great business enabler providing many types of enterprises new opportunities such as scaling up services, obtaining customer insights, identifying end-user profiles, sharing data, and expanding to new communities. However, the cyber domain also comes with its own set of risks. Cybersecurity risk assessment helps enterprises explore these new opportunities and, at the same time, proportionately manage the risks by establishing cyber situational awareness and identifying potential consequences. Anomaly detection is a mechanism to enable situational awareness in the cyber domain. However, anomaly detection also requires one of the most extensive sets of data and features …

Using Interacting Multiple Model Filters To Indicate Program Risk, Amy Sunshine Smith-Carroll

Engineering Management & Systems Engineering Theses & Dissertations

Technology development has increased exponentially. Program managers are pushed to accelerate development. There are many resources available to program managers that enable acceleration, such as: additional resources in the form of funding, people and technology. There are also negative impacts to acceleration, such as: inclusion, inexperience program managers, and communication. This research seeks to identify the limit to which a program or project can be accelerated before the program manager begins to accept an unacceptable amount of pre-determined risk.

This research will utilize estimation algorithms used by sensor systems to estimate the current and future state of objects in space. …

A Framework For Adaptive Capacity In Complex Systems, Abdulrahman Alfaqiri

Engineering Management & Systems Engineering Theses & Dissertations

Complex systems are characterized by their high level of inter-connectivity, ambiguity, and emergence. Therefore, a failure in one element of a system (e.g. cyber layer) due to external or internal disturbances can lead to a cascade effect that may influence all elements of the system. Consequently, the complex system will not be able to perform its functional performance. Threats related to complex systems are very dynamic, fast, complex and damage can be severe. Thus, to respond to the dynamic and unpredictable nature of these threats, complex systems need to be highly adaptive to survive and thrive in the face of …

Measuring Risks Of Interdependencies In Enterprise Systems: An Application To Ghana’S Salt Enterprise, Yaw Mensah

Engineering Management & Systems Engineering Theses & Dissertations

This dissertation describes the use of Functional Dependency Network Analysis (FDNA) for modeling risks resulting from dependencies among elements of enterprise systems with application to salt processing enterprise in Ghana. FDNA was developed to model dependencies among members of enterprise systems by highlighting two dimensions of dependency: strength and criticality. Nonetheless, the concepts and analytics for these two dimensions of dependencies needed further development and generalization in the context of project management and systems development in developing countries.

Managing risks within the interdependency in enterprise systems through integration will help improve global economic growth. Coherent theory for enterprise integration must …

Quantifying Impact Of Cyber Actions On Missions Or Business Processes: A Multilayer Propagative Approach, Unal Tatar

Engineering Management & Systems Engineering Theses & Dissertations

Ensuring the security of cyberspace is one of the most significant challenges of the modern world because of its complexity. As the cyber environment is getting more integrated with the real world, the direct impact of cybersecurity problems on actual business frequently occur. Therefore, operational and strategic decision makers in particular need to understand the cyber environment and its potential impact on business. Cyber risk has become a top agenda item for businesses all over the world and is listed as one of the most serious global risks with significant financial implications for businesses.

Risk analysis is one of the …

An Investigation Of General Criteria For Assessing Space Flight Systems Of Diverse Mission Concept Designs, Cindy L. Daniels

Engineering Management & Systems Engineering Theses & Dissertations

The purpose of this research is to investigate the general criteria for assessing the technical implementation risk factors of proposed space science missions at the mission concept stage. According to the National Aeronautics and Space Administration (NASA) Space Flight Program and Project Management Handbook (NASA, 2012), the mission concept review objectives are “To evaluate the feasibility of the proposed mission concept(s) and its fulfillment of the program's needs and objectives. To determine whether the maturity of the concept and associated planning are sufficient to begin Phase A” (p.33). Experts previously defined two technical risk factors, to assess aspects of the …

Safety Culture Monitoring: A Management Approach For Assessing Nuclear Safety Culture Health Performance Utilizing Multiple-Criteria Decision Analysis, James Harold Warren Jr.

Engineering Management & Systems Engineering Theses & Dissertations

Nuclear power plants are among the most technologically complex of all energy facilities. This complexity reflects the precision needed in design, maintenance and operations to harness the energy of the atom safely, reliably and economically. Nuclear energy thus requires consistent, high levels of organizational performance by the highly skilled professionals who operate and maintain nuclear power plants (Nuclear Energy Institute [NEI], 2014, p. 1).

A key element for achieving consistent, high levels of performance in a nuclear organization is its safety culture. Nuclear safety culture is for an organization what character and personality is for an individual: a feature that …

Towards Managing And Understanding The Risk Of Underwater Terrorism, Richard J. Gay

Engineering Management & Systems Engineering Theses & Dissertations

This dissertation proposes a methodology to manage and understand the risk of underwater terrorism to critical infrastructures utilizing the parameters of the risk equation. Current methods frequently rely on statistical methods, which suffer from a lack of appropriate historical data to produce distributions and do not integrate epistemic uncertainty. Other methods rely on locating subject matter experts who can provide judgment and then undertaking an associated validation of these judgments.

Using experimentation, data from unclassified successful, or near successful, underwater attacks are analyzed and instantiated as a network graph with the key characteristics of the risk of terrorism represented as …

Risk Quadruplet: Integrating Assessments Of Threat, Vulnerability, Consequence, And Perception For Homeland Security And Homeland Defense, Kara Norman Hill

Engineering Management & Systems Engineering Theses & Dissertations

Risk for homeland security and homeland defense is often considered to be a function of threat, vulnerability, and consequence. But what is that function? And are we defining and measuring these terms consistently? Threat, vulnerability, and consequence assessments are conducted, often separately, and data from one assessment could be drastically different from that of another due to inconsistent definitions of terms and measurements, differing data collection methods, or varying data sources. It has also long been a challenge to integrate these three disparate assessments to establish an overall picture of risk to a given asset. Further, many agencies conduct these …

Post-Project Risk Perception And Systems Management Reaction, Baqer Alali

Engineering Management & Systems Engineering Theses & Dissertations

The objective of this research is to identify whether risk management in projects has any role in risk management in systems. Projects, systems, and risk management are three integral concepts in the management of various enterprises and agencies. Risk management is a common concept in systems and project processes. To avoid failures or crisis during their life cycles, projects and systems managers practice risk management. Projects and systems have well defined life cycles during which the risk is defined, controlled, and managed. Risk management is conducted in each phase of projects and systems. Projects are initiated to close certain operational …

Utilizing Knowledge Transfer To Promote Management Of Countervailing Risks In Value Stream Analysis, Jeffery A. Temple

Engineering Management & Systems Engineering Theses & Dissertations

Organizations are frequently faced with the challenges of modifying and streamlining their processes by utilizing the latest process improvement techniques such as Lean Thinking. They use these techniques to allow them to better perform their organizational purposes through the elimination of waste and non-value added steps. Personnel performing these modifications need to account for potential outcomes and risks when streamlining processes. An association of knowledge transfer and experience to the identification and handling of these countervailing or alternative risks when performing Lean Thinking value stream analysis is investigated. The elements of risk management, Lean Thinking and knowledge transfer are described. …

Time Valuation Of Risk: A Delayed-Bang Approach, Abhishek Pathak

Engineering Management & Systems Engineering Theses & Dissertations

The subject of this thesis is the combined use of engineering economics and survival analysis in estimating time-value of risk-related resources. The discussion includes (1) the need for sustainable risk management, (2) the importance of time-valuation of risk related resources in the allocation or selection among competing risk mitigation alternatives, (3) the convergence of deterministic engineering economics, survivability analysis, and probabilistic analysis, and (4) results and examples of application in the context of prevention of risk event or mitigation of its consequences.

The significance of this thesis is in how three topics: engineering economics, survivability analysis, and probability theory can …

Uncertainty Assessment In High-Risk Environments Using Probability, Evidence Theory And Expert Judgment Elicitation, Stella Barberis Bondi

Engineering Management & Systems Engineering Theses & Dissertations

The level of uncertainty in advanced system design is assessed by comparing the results of expert judgment elicitation to probability and evidence theory. This research shows how one type of monotone measure, namely Dempster-Shafer Theory of Evidence can expand the framework of uncertainty to provide decision makers a more robust solution space. The issues imbedded in this research are focused on how the relevant predictive uncertainty produced by similar action is measured.

This methodology uses the established approach from traditional probability theory and Dempster-Shafer evidence theory to combine two classes of uncertainty, aleatory and epistemic. Probability theory provides the mathematical …

Development Of An Aggregation Methodology For Risk Analysis In Aerospace Conceptual Vehicle Design, Trina Marsh Chytka

Engineering Management & Systems Engineering Theses & Dissertations

The growing complexity of technical systems has emphasized a need to gather as much information as possible regarding specific systems of interest in order to make robust, sound decisions about their design and deployment. Acquiring as much data as possible requires the use of empirical statistics, historical information and expert opinion. In much of the aerospace conceptual design environment, the lack of historical information and infeasibility of gathering empirical data relegates the data collection to expert opinion.

The conceptual design of a space vehicle requires input from several disciplines (weights and sizing, operations, trajectory, etc.). In this multidisciplinary environment, the …

An Integrated Risk Analysis Methodology In A Multidisciplinary Design Environment, Katrina R. Hampton

Engineering Management & Systems Engineering Theses & Dissertations

Design of complex, one-of-a-kind systems, such as space transportation systems, is characterized by high uncertainty and, consequently, high risk. It is necessary to account for these uncertainties in the design process to produce systems that are more reliable. Systems designed by including uncertainties and managing them, as well, are more robust and less prone to poor operations as a result of parameter variability.

The quantification, analysis and mitigation of uncertainties are challenging tasks as many systems lack historical data. In such an environment, risk or uncertainty quantification becomes subjective because input data is based on professional judgment. Additionally, there are …

A Synthesized Methodology For Eliciting Expert Judgment For Addressing Uncertainty In Decision Analysis, Richard W. Monroe

Engineering Management & Systems Engineering Theses & Dissertations

This dissertation describes the development, refinement, and demonstration of an expert judgment elicitation methodology. The methodology has been developed by synthesizing the literature across several social science and scientific fields. The foremost consideration in the methodology development has been to incorporate elements that are based on reasonable expectations for the human capabilities of the user, the expert in this case.

Many methodologies exist for eliciting assessments for uncertain events. These are frequently elicited in probability form. This methodology differs by incorporating a qualitative element as a beginning step for the elicitation process. The qualitative assessment is a more reasonable way …

Development Of A Knowledge Based System For Wastewater Pipeline Failure Risk Assessment, Adam Mayanzani Ngaliga

Engineering Management & Systems Engineering Theses & Dissertations

The purpose of this thesis was to study and analyze the wastewater pipeline failure risk assessment process, and then design and develop an effective and efficient wastewater pipeline risk assessment tool for the Hampton Roads Sanitation District, in Virginia, U.S.A. A knowledge based system was developed using an expert system building shell (Xi-Plus).

The system design is based on the knowledge elicited from the experts and literature in sanitary pipeline failure risk evaluation. The knowledge base contains both heuristics and procedural rules. The system interprets the information provided by the user and reasons from that information to reach conclusions on …