Comparative Analysis of Risk Evaluation Models for Risk-aware Access Control in Bring Your Own Device Environment

Abstract

Risk evaluation models are employed by individuals and organisations to determine the level of risk involved in a process. Specifically, such model could be employed in computing risk value for risk-aware access control in bring your own device (BYOD) environment. Remarkably, several of these models vary in their coverages of risk components, output rendering formalisms and areas of application; thereby, putting the burden of model selection on users. Worst still, attempts to compare these models by previous researchers are baffled by subjective criteria that are not well-founded and often based on old taxonomy that are incompatible with pervasive environments. Thus, the study purposely formulated eight comparison criteria from characteristics of BYOD risk factors and countermeasures. Thereafter, the criteria were ranked with Analytic Hierarchy Process (AHP). Then, the ranked criteria were used to compare twelve risk evaluation methods, which were selected through three selection criteria expressly crafted for the study. Specifically, the result was rendered as numeric value, which is easy to understand by nontechnical user. In all, the comparison approach presented in this study will assist BYOD operators in selecting model that could safeguard vital information assets against unauthorised access.