Assignemnt

Part I. True or False: Place a T or an F, whichever you consider correct, in the box before each numbered statement.

1. Subjective risk is the mental state of worry as to the outcome of a given event.

2. Objective risk is the variation between actual and expected losses.

3. Perceived risk is the risk estimated by the public.

4. Threat is the potential cause of system damage; usually exogenous to system of interest.

5. Security is the relative protection from adverse consequences usually associated with life and health.

6. Safety is a measure taken to guard against damage.

7. Utility theory is the mathematical tool that assigns the value, or utility, that a particular decision maker attaches to a particular outcome.

8. Bounded rationality suggests that people make decisions that match situations.

9. Naturalistic decision making is prescriptive rather than descriptive,

10. Extreme events may imply that the events are rare.

11. When analyzing extreme events, we can look at the tails of the probability distributions.

12. In real life situations, tails of the distributions are thinner than what classical distributions predict.

13. Extreme value theory (EVT) deals with the study of the asymptotic behavior of only the largest extreme observations (i.e. maxima) of a random variable and not of the smallest extreme observations.

14. Extremal type theorem identifies the possible classes of distributions of the extremes with respect to the actual underlying distribution.

15. In the analysis of extremes, the tails have smaller variance than the rest of the data.

16. Risk can be measured by the probability and severity of adverse effects.

17. Increased reliability always results to reduced risk.

18. Risk should be identified only at the end of the systems development cycle.

19. Risk management cannot be performed under situations of uncertainty.

20. Reducing consequences is the only way to reduce risk.

21. Decision trees cannot be used in single-objective decision process.

22. Decision trees are not appropriate for sequential (i.e. multi-period) decision process.

23. Bounded rationality suggests that people's cognitive processing capacity can perform the most complex - optimization tasks in their head.

24. Bayesian perspective of probability is that of a formal construct usually represented as a curve.

25. Cumulative distribution function assigns to each real value x the probability of X taking on values less than or equal to x.

26. Evidence is carefully selected information that helps draw conclusions.

27. Mathematician's perspective of probability is that it is the degree of confidence or certainty.

28. Statistical perspective of probability is that it is the frequency of outcome of repetitive experiments.

29. In the process of averaging out or calculating expected values, extreme and catastrophic but rare events are emphasized.

30. Extreme value theory focuses primarily on analyzing the extreme observations rather than the observations in the central region of the distribution.

Part II. Matching

Set 1: Match the concepts by placing the Concept letter (A - KO in the box before the concept's best description

1. Mathematical tool that allows the consideration of how risk-averse the decision makers are

2. Suggests people have limited cognitive processing capacity and simply cannot perform complex optimization tasks in their head

3. Probability as a degree of confidence or certainty

4. Assigns to each real value x the probability of X taking on values less than or equal to x

5. Statistical probability of an event occurring or being exceeded in any given time period

6. Carefully selected information that helps draw conclusions

7. The average of N set of numbers

8. The expected value of a function f(x)

9. Inability to determine true state of system

Concepts:
A. Bayes' Theorem
B. p(T | e)
C. Utility theory
D. Evidence ratio, er
E. Probability of exceedance
F. Statistical mean
G. Bayesian perspective
H. Uncertainty
I. E[x]
J. PRA, QRA
K. Cumulative distribution function
L. Bounded rationality
M. Evidence

Set 2: Choose an asymptotic distribution appropriate for the given information (you can choose an answer multiple times)

1. The asymptotic distribution of extremely low rainfall at a particular location.

2. After performing the G-1 plotting procedure, the plot of the tail of interest shows diagonal and linear trend.

3. After performing the G-I plotting procedure, the plot of the tail of interest shows vertical trend.

4. After performing the G-I plotting procedure, the plot of the tail of interest shows horizontal trend.

5. After performing the G-I plotting procedure for extreme high flood level for the purpose of designing a dam, the plot of the tail of interest shows no obvious asymptote -- but you definitely have to choose an asymptotic distribution for use in designing this dam.

6. After performing the G-I plotting procedures for two datasets, the plots of the tails of interest both show diagonal and linear trend, though the plots diverge from each other at the middle region.

Asymptotic distribution:

A. G-I or Gumble
B. G-II or Frechet
C. G-111 or Weibull

Part III. Problem solving Problem 1

The Chief Information Officer (CIO) is trying to improve the university's information network security. The CIO is trying to evaluate a new intrusion detection technology in the market for possible replacement for the existing system. An intrusion detection system sounds an "alarm" each time possible malicious attack on a network is detected. The following information is provided:

• Probability of an actual malicious attack is 0.01.

• For the currently installed system, the probability of an alarm given that there is an actual malicious attack is 0.9, while the probability of an alarm given there is not a malicious attack is 0.25.

• For the new technology, the probability of an alarm given that there is an actual malicious attack is 0.8, while the probability of an alarm given there is not a malicious attack is 0.1.

• The CIO assumes that there are only two types of events: either there is or there is no malicious attack.

• The CIO is using "evidence ratio," described as P(B IA) P(B IA') as a way to compare the technologies. Please help the CIO compare the new technology with the currently installed system by answering the following questions:

1. Based on the definition of evidence ratio in the previous paragraph, what is the evidence ratio for the currently installed system?

2. What is the evidence ratio for the new technology?

3. Which technology is better? Existing technology or new technology?

Problem 2

Frodo, a junior engineer at Baggins Metal Works is considering the introduction of a new line of products. In order to produce the new line, the company needs either a major or minor renovation of the current plant. The market for the new line of products could be either favorable or unfavorable, each with equal chance of occurrence. The company has the option of not developing the new product line at all.

With major renovation, the company's payoff from a favorable market is $100,000, from an unfavorable market, $ -90,000. Minor renovation and favorable market has a payoff of $40,000 and an unfavorable market, $-20,000. Not developing the new product line effectively has $0 payoff.

Frodo realizes that he should get more information before making his final decision. He contracted with Gandaif Market Research to conduct a market analysis to determine for certain if the market will be favorable or unfavorable. How much is the maximum amount Frodo should be willing to pay for this accurate information? (Please indicate your answer to the nearest whole number)

Problem 3

John Doe is a rational person whose satisfaction or preference for various amounts of money can be expressed as a function U(x} = (x/100)A2, where x is in $.

1. How much satisfaction does $20 bring to John?

If we limit the range of U(x) between 0 and 1.0, then we can use this function to represent John's utility (i.e. U(x) becomes his utility function).

2. What is the shape of his utility function?

- Concave
- Convex
- Straight line
- None of these

3. What does this graph show about John's incremental satisfaction?

• Increases with increasing x
• Decreases with increasing x
• Does not change with x
• None of these

4. "The shape of John's utility function shows that he is willing to accept more risk than a risk-neutral person."

• True
• False

5. John is considering a lottery which payoff $80 forty percent of the time, and $10 sixty percent of the time. If John plays this lottery repeatedly, how much will be his long-term average satisfaction?

6. For John, what certain amount would give him satisfaction equal to this lottery? Express your answer to nearest whole $.

Part I. True or False: Place a T or an F, whichever you consider correct, in the box before each numbered statement

1. "Security by obscurity" refers to relying on the attacker's ignorance of the design of a system.

2. Theory of asymmetric information can be used to explain how bad products tend to drive out the good products in a market.

3. Enterprise risk management differs from "traditional" systems engineering risk management in the expanse of the consequence space within which risks affect enterprise goals, mission outcomes, or capabilities.

4. Emergence can be described as the appearance of new and unforeseen system properties which cannot be know before the system operates.

5. Emergence can be totally and completely prevented by thorough system design.

6. The process of system identification followed by risk estimation is what is truly occurring in risk assessments.

7. Systems theory supports the modern view that risk itself is an observer-dependent phenomenon; a relational property between the situation and the observer.

8. Reliance can be described as consistency in performance over time.

9. In Liontief 1-0 model for inoperability, resulting % inoperability can be caused by perturbation h and also by dependence among sub-systems.

10. Tightly coupled systems imply that what occurs in one system directly affects what happens in another.

11. The two descriptors of Complexity for the purpose of Risk Management are (1) Interactions among subsystems and (2) Reliability among subsystems.

12. Partially observable events can be recorded only at a particular threshold of magnitude, time, etc.

13. Privacy and ethical issues can be factors in the observability of events.

14. Readiness and effectiveness for asset protection is one of the cost factors in a DRP.

15. Maximax is a method of decision making using probabilities.

16. Maximin tries to minimize regret of decision makers.

17. Rational decision maker should be willing to pay for perfect information at a price equal to or more than the EVPI.

18. Decision making under uncertainty is when probabilities can be assigned to the occurrence of states of nature in the future.

19. In Hurwicz method, the coefficient of optimism is a measure of a decision maker's optimism from 0 (completely optimistic) to 1 (completely pessimistic).

20. In the pebble-in-the-pond metaphor, the ripples represent the consequences and the number of ripples decreases as time passes.

21. Bounded rationality states that people have limited cognitive processing capacity and simply cannot perform complex optimization tasks in their head.

22. When risks are being identified, it is not essential that subject matter experts from all the engineering disciplines participate.

23. An ordinal scale is a measurement scale in which attributes are assigned a number that represents order.

24. Risk Cubes can not involve human's numerical judgment on risk.

25. Wear-and-tear indicates a scenario where the effects of an adverse condition readily propagate to other systems or subsystems.

26. Because the distance between values in an ordinal scale is arbitrary, arithmetic operations on ordinal data are permissible.

27. Borda algorithm transforms an interval scale into ordinal scale, permitting the summing of scores.

28. The conscious decision to accept the associated level of risk without engaging in special efforts to control it is one method to handle risk.

Part ll. Matching

Match each of the following terms with their most appropriate description.

A. Target risk
B. Countervailing risk
C. Synergistic effect

1. The risk scenario which prompts the whole decision process, often reflected by the main objective
2. The risk that arises from the action of managing the target risk
3. Desirable consequence of managing risk other than reducing the target risk

Part III. Problem solving

Problem 1

There are two sub-systems (1 and 2). Failure of sub-systeml will make sub-system2 35% inoperable, while failure of sub-system2 will make sub-systeml 50% inoperable

Suppose that sub-system2 is attacked with intensity h = 90%. Using matrix equation x = Ax + c, where x is the inoperability of the sub-systems, A is the dependency matrix, and c is the intensity of attack, please match the values to the following questions

2. What is the resulting value of xl?
3. What is the resulting value of x2?

Problem 2

Apply Borda algorithm to score and rank the risk events shown.

1. What is the score of "Telephone"?
2. What is the score of "Cellular"?
3. What is the score of "Cable"?